High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others
Published: 2017-02-15T00:00:00

Fast Facts:
Every 2 years, we examine federal programs and operations that are especially vulnerable to waste, fraud, abuse, and mismanagement, or that need transformative change—our High Risk List. This report reviews the status of areas on the list and outlines steps to lasting solutions.
This year, we added 3 areas, expanded 2 existing ones, and found many areas still in need of substantial attention. Yet, a number of agencies have made solid progress, including in 1 area that we removed and 2 others we narrowed.
The new High Risk areas are:
Federal Indian education, health, and energy programs
Federal environmental liabilities
The 2020 Census

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government is one of the world's largest and most complex entities: about $3.9 trillion in outlays in fiscal year 2016 funded a broad array of programs and operations. GAO's high-risk program identifies government operations with greater vulnerabilities to fraud, waste, abuse, and mismanagement or the need for transformation to address economy, efficiency, or effectiveness challenges.
This biennial update describes the status of high-risk areas listed in 2015 and actions that are still needed to assure further progress, and identifies new high-risk areas needing attention by Congress and the executive branch. Solutions to high-risk problems potentially save billions of dollars, improve service to the public, and strengthen government performance and accountability.
GAO uses five criteria to assess progress in addressing high-risk areas: (1) leadership commitment, (2) agency capacity, (3) an action plan, (4) monitoring efforts, and (5) demonstrated progress.
section_title: What GAO Found
paragraphs: Since GAO's last high-risk update, many of the 32 high-risk areas on the 2015 list have shown solid progress. Twenty-three high-risk areas, or two-thirds of all the areas, have met or partially met all five criteria for removal from the High-Risk List; 15 of these areas fully met at least one criterion. Progress has been possible through the concerted efforts of Congress and leadership and staff in agencies. For example, Congress enacted over a dozen laws since GAO's last report in February 2015 to help address high-risk issues.
GAO removed 1 high-risk area on managing terrorism-related information, because significant progress had been made to strengthen how intelligence on terrorism, homeland security, and law enforcement is shared among federal, state, local, tribal, international, and private sector partners. Sufficient progress was made to remove segments of 2 areas related to supply chain management at the Department of Defense (DOD) and gaps in geostationary weather satellite data.
Two high-risk areas expanded—DOD's polar-orbiting weather satellites and the Department of the Interior's restructuring of offshore oil and gas oversight. Several other areas need substantive attention including VA health care, DOD financial management, ensuring the security of federal information systems and cyber critical infrastructure, resolving the federal role in housing finance, and improving the management of IT acquisitions and operations.
GAO is adding 3 areas to the High-Risk List, bringing the total to 34:
Management of Federal Programs That Serve Tribes and Their Members. GAO has reported that federal agencies, including the Department of the Interior's Bureaus of Indian Education and Indian Affairs and the Department of Health and Human Services' Indian Health Service, have ineffectively administered Indian education and health care programs and inefficiently developed Indian energy resources. Thirty-nine of 41 GAO recommendations on this issue remain unimplemented.
U.S. Government's Environmental Liabilities. In fiscal year 2016 this liability was estimated at $447 billion (up from $212 billion in 1997). The Department of Energy is responsible for 83 percent of these liabilities and DOD for 14 percent. Agencies spend billions each year on environmental cleanup efforts but the estimated environmental liability continues to rise. Since 1994, GAO has made at least 28 recommendations related to this area; 13 are unimplemented.
The 2020 Decennial Census. The cost of the census has been escalating over the last several decennials; the 2010 Census was the costliest U.S. Census in history at about $12.3 billion, about 31 percent more than the 2000 Census (in 2020 dollars). The U.S. Census Bureau (Bureau) plans to implement several innovations—including IT systems—for the 2020 Census. Successfully implementing these innovations, along with other challenges, risk the Bureau's ability to conduct a cost-effective census. Since 2014, GAO has made 30 recommendations related to this area; however, only 6 have been fully implemented.
GAO's 2017 High-Risk List
section_title: What GAO Recommends
paragraphs: This report contains GAO's views on progress made and what remains to be done to bring about lasting solutions for each high-risk area. Perseverance by the executive branch in implementing GAO's recommended solutions and continued oversight and action by Congress are essential to achieving greater progress.

section_title: Letter
paragraphs: Since the early 1990s, our high-risk program has focused attention on  government operations with greater vulnerabilities to fraud, waste, abuse,  and mismanagement or that are in need of transformation to address  economy, efficiency, or effectiveness challenges. This effort, supported  by the Senate Committee on Homeland Security and Governmental  Affairs and by the House of Representatives Committee on Oversight and  Government Reform, has brought much-needed attention to problems  impeding effective government and costing billions of dollars each year.
To help improve these high-risk operations, we have made hundreds of  recommendations. Executive agencies either have addressed or are  addressing many of them and, as a result, progress is being made in a  number of areas. Congress also continues to take important actions. For  example, Congress enacted over a dozen laws since our last report in  February 2015 to help make progress on high-risk issues. Progress in  high-risk areas over the past decade (fiscal year 2007 through fiscal year  2016) resulted in financial benefits totaling approximately $240 billion or  an average of about $24 billion per year.
This report describes (1) progress made addressing high-risk areas and  the reasons for that progress, and (2) actions that are still needed to  assure further progress. It also identifies three new high-risk areas, which  include the management of federal programs that serve tribes and their  members, the federal government’s environmental liabilities, and the  2020 Census.
subsections: section_title: High-Risk Areas Making Progress
paragraphs: Since our last high-risk update, while progress has varied, many of the 32  high-risk areas on our 2015 list have shown solid progress. One area  related to sharing and managing terrorism-related information is now  being removed from the list.
Agencies can show progress by addressing our five criteria for removal  from the list: leadership commitment, capacity, action plan, monitoring,  and demonstrated progress. As shown in table 1, 23 high-risk areas, or  two-thirds of all the areas, have met or partially met all five criteria for  removal from our High-Risk List; 15 of these areas fully met at least one  criterion. Compared with our last assessment, 11 high-risk areas showed  progress in one or more of the five criteria. Two areas declined since  2015. These changes are indicated by the up and down arrows in table 1.
subsections: section_title: High-Risk Areas Showing Progress
paragraphs: Of the 11 high-risk areas showing progress between 2015 and 2017,  sufficient progress was made in 1 area—Establishing Effective  Mechanisms for Sharing and Managing Terrorism-Related Information to  Protect the Homeland—to be removed from the list. In two other areas,  enough progress was made that we removed a segment of the high-risk  area—Mitigating Gaps in Weather Satellite Data and Department of  Defense (DOD) Supply Chain Management. The other eight areas  improved in at least one criterion rating by either moving from “not met” to  “partially met” or from “partially met” to “met.”
subsections: section_title: One High-Risk Designation Removed
paragraphs: We removed the area of Establishing Effective Mechanisms for Sharing  and Managing Terrorism-Related Information to Protect the Homeland  from the High-Risk List because the Program Manager for the Information  Sharing Environment (ISE) and key departments and agencies have  made significant progress to strengthen how intelligence on terrorism,  homeland security, and law enforcement, as well as other information  (collectively referred to in this section as terrorism-related information), is  shared among federal, state, local, tribal, international, and private-sector  partners. As a result, the Program Manager and key stakeholders have  met all five criteria for addressing our high-risk designation, and we are  removing this issue from our High-Risk List. While this progress is  commendable, it does not mean the government has eliminated all risk  associated with sharing terrorism-related information. It remains  imperative that the Program Manager and key departments and agencies  continue their efforts to advance and sustain ISE. Continued oversight  and attention is also warranted given the issue’s direct relevance to  homeland security as well as the constant evolution of terrorist threats  and changing technology.
The Program Manager, the individual responsible for planning,  overseeing, and managing ISE, along with the key departments and  agencies—the Departments of Homeland Security (DHS), Justice (DOJ),  State (State), and Defense (DOD), and the Office of the Director of  National Intelligence (ODNI)—are critical to implementing and sustaining  ISE. Following the terrorist attacks of 2001, Congress and the executive  branch took numerous actions aimed explicitly at establishing a range of  new measures to strengthen the nation’s ability to identify, detect, and  deter terrorism-related activities. For example, ISE was established in  accordance with the Intelligence Reform and Terrorism Prevention Act of  2004 (Intelligence Reform Act) to facilitate the sharing of terrorism-related  information. Figure 1 depicts the relationship between the various  stakeholders and disciplines involved with the sharing and safeguarding  of terrorism-related information through ISE.
The Program Manager and key departments and agencies met the  leadership commitment and capacity criteria in 2015, and have  subsequently sustained efforts in both these areas. For example, the  Program Manager clearly articulated a vision for ISE that reflects the  government’s terrorism-related information sharing priorities. Key  departments and agencies also continued to allocate resources to  operations that improve information sharing, including developing better  technical capabilities.
The Program Manager and key departments and agencies also  developed, generally agreed upon, and executed the 2013 Strategic  Implementation Plan (Implementation Plan), which includes the overall  strategy and more specific planning steps to achieve ISE. Further, they have demonstrated that various information-sharing initiatives are being  used across multiple agencies as well as state, local, and private sector  stakeholders. For example, the project manager has developed a  comprehensive framework for managing enterprise architecture to help  share and integrate terrorism-related information among multiple  stakeholders in ISE. Specifically, the Project Interoperability initiative  includes technical resources and other guidance that promote greater  information system compatibility and performance. Furthermore, the key  departments and agencies have applied the concepts of the Project  Interoperability Initiative to improve mission operations by better linking  different law enforcement databases, and facilitating better geospatial  analysis, among other things.
In addition, the Program Manager and key departments and agencies  have continued to devise and implement ways to measure the effect of  ISE on information sharing to address terrorist and other threats to the  homeland. They developed performance metrics for specific information- sharing initiatives (e.g., fusion centers) used by various stakeholders to  receive and share information. The Program Manager and key  departments and agencies have also documented mission-specific  accomplishments (e.g., related to maritime domain awareness) where the  Program Manager helped connect previously incompatible information  systems. The Program Manager has also partnered with DHS to create  an Information Sharing Measure Development Pilot that intends to better  measure the effectiveness of information sharing across all levels of ISE.
Further, the Program Manager and key departments and agencies have  used the Implementation Plan to track progress, address challenges, and  substantially achieve the objectives in the National Strategy for  Information Sharing and Safeguarding. The Implementation Plan  contains 16 priority objectives, and by the end of fiscal year 2016, 13 of  the 16 priority objectives were completed. The Program Manager  transferred the remaining three objectives, which were all underway, to  other entities with the appropriate technical expertise to continue  implementation through fiscal year 2019.
In our 2013 high-risk update, we listed nine action items that were critical  for moving ISE forward. In that report, we determined that two of those  action items—demonstrating that the leadership structure has the needed  authority to leverage participating departments, and updating the vision  for ISE—had been completed. In our 2015 update, we determined that  the Program Manager and key departments had achieved four of the  seven remaining action items—demonstrating that departments are  defining incremental costs and funding; continuing to identify  technological capabilities and services that can be shared collaboratively;  demonstrating that initiatives within individual departments are, or will be,  leveraged to benefit all stakeholders; and demonstrating that  stakeholders generally agree with the strategy, plans, time frames,  responsibilities, and activities for substantially achieving ISE.
For the 2017 update, we determined that the remaining three action items  have been completed: establishing an enterprise architecture  management capability; demonstrating that the federal government can  show, or is more fully developing a set of metrics to measure, the extent  to which sharing has improved under ISE; and demonstrating that  established milestones and time frames are being used as baselines to  track and monitor progress. Achieving all nine action items has, in effect,  addressed our high-risk criteria.
While this demonstrates significant and important progress, sharing  terrorism-related information remains a constantly evolving work in  progress that requires continued effort and attention from the Program  Manager, departments, and agencies. Although no longer a high-risk  issue, sharing terrorism-related information remains an area with some  risk, and continues to be vitally important to homeland security, requiring  ongoing oversight as well as continuous improvement to identify and  respond to changing threats and technology. Table 2 summarizes the  Program Manager’s and key departments’ and agencies’ progress in  achieving the action items.
As we have with areas previously removed from the High-Risk List, we  will continue to monitor this area, as appropriate, to ensure that the  improvements we have noted are sustained. If significant problems again  arise, we will consider reapplying the high-risk designation.
Additional Information on Establishing Effective Mechanisms for Sharing  and Managing Terrorism-Related Information to Protect the Homeland is  provided on page 653 of this report.
section_title: Two High-Risk Areas Narrowed
paragraphs: In the 2 years since our last high-risk update, sufficient progress has been  made in two areas—DOD Supply Chain Management and Mitigating  Gaps in Weather Satellite Data—that we are narrowing their scope.
DOD manages about 4.9 million secondary inventory items, such as  spare parts, with a reported value of approximately $91 billion as of  September 2015. Since 1990, DOD’s inventory management has been  included on our High-Risk List due to the accumulation of excess  inventory and weaknesses in demand forecasting for spare parts. In  addition to DOD’s inventory management, the supply chain management  high-risk area focuses on materiel distribution and asset visibility within  DOD. Based on DOD’s leadership commitment and demonstrated  progress to address weaknesses since 2010, we are removing the  inventory management component from the supply chain management  high-risk area. Specifically, DOD has taken the following actions:  Implemented a congressionally-mandated inventory management  corrective action plan and institutionalized a performance  management framework, including regular performance reviews and  standardized metrics. DOD has also developed and begun  implementing a follow-on improvement plan.
Reduced the percentage and value of its “on-order excess inventory”  (i.e., items already purchased that may be excess due to subsequent  changes in requirements) and “on-hand excess inventory” (i.e., items  categorized for potential reuse or disposal). DOD’s data show that the  proportion of on-order excess inventory to the total amount of on- order inventory decreased from 9.5 percent at the end of fiscal year  2009 to 7 percent at the end of fiscal year 2015, the most recent fiscal  year for which data are available. During these years, the value of on- order excess inventory also decreased from $1.3 billion to $701  million. DOD’s data show that the proportion of on-hand excess  inventory to the total amount of on-hand inventory dropped from 9.4  percent at the end of fiscal year 2009 to 7.3 percent at the end of  fiscal year 2015. The value of on-hand excess inventory also  decreased during these years from $8.8 billion to $6.8 billion.
Implemented numerous actions to improve demand forecasting and  began tracking department-wide forecasting accuracy metrics in 2013,  resulting in forecast accuracy improving from 46.7 percent in fiscal  year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for  which complete data are available.
Implemented 42 of our recommendations since 2006 and is taking  actions to implement an additional 13 recommendations, which are  focused generally on reassessing inventory goals, improving  collaborative forecasting, and making changes to information  technology (IT) systems used to manage inventory.
Additional information on DOD Supply Chain Management is provided on  page 248 of this report.
Mitigating Gaps in Weather Satellite Data  The United States relies on two complementary types of satellite systems  for weather observations and forecasts: (1) polar-orbiting satellites that  provide a global perspective every morning and afternoon, and (2)  geostationary satellites that maintain a fixed view of the United States.  Both types of systems are critical to weather forecasters, climatologists,  and the military, who map and monitor changes in weather, climate, the  oceans, and the environment. Federal agencies are planning or executing  major satellite acquisition programs to replace existing polar and  geostationary satellite systems that are nearing or beyond the end of their  expected life spans. The Department of Commerce’s National Oceanic  and Atmospheric Administration (NOAA) is responsible for the polar  satellite program that crosses the equator in the afternoon and for the  nation’s geostationary weather satellite program; DOD is responsible for  the polar satellite program that crosses the equator in the early morning  orbit.
Over the last several years, we have reported on the potential for a gap in  satellite data between the time that the current satellites are expected to  reach the end of their lifespans, and the time when the next satellites are  expected to be in orbit and operational. We added this area to our High- Risk List in 2013. According to NOAA program officials, a satellite data  gap would result in less accurate and timely weather forecasts and  warnings of extreme events—such as hurricanes, storm surges, and  floods. Such degraded forecasts and warnings would endanger lives,  property, and our nation’s critical infrastructures. Similarly, according to  DOD officials, a gap in space-based weather monitoring capabilities could  affect the planning, execution, and sustainment of U.S. military operations  around the world. In our prior high-risk updates, we reported on NOAA’s  efforts to mitigate the risk of a gap in its polar and geostationary satellite  programs.
With strong congressional support and oversight, NOAA has made  significant progress in its efforts to mitigate the potential for gaps in  weather satellite data on its geostationary weather satellite program.  Specifically, the agency demonstrated strong leadership commitment to  mitigating potential gaps in geostationary satellite data by revising and  improving its gap mitigation/contingency plans. Previously, in December  2014, we reported on shortfalls in the satellite program’s gap  mitigation/contingency plans and made recommendations to NOAA to  address these shortfalls. For example, we noted that the plan did not  sufficiently address  strategies for preventing a launch delay,  timelines and triggers to prevent a launch delay, and whether any of its mitigation strategies would meet minimum  performance levels.
NOAA agreed with these recommendations and released a new version  of its geostationary satellite contingency plan in February 2015 that  addressed the recommendations, thereby meeting the criterion for having  an action plan.
We rated capacity as partially met in our 2015 report due to concerns  about NOAA’s ability to complete critical testing activities because it was  already conducting testing on a round-the-clock, accelerated schedule.  Since then, NOAA adjusted its launch schedule to allow time to complete  critical integration and testing activities. In doing so, the agency  demonstrated that it met the capacity criterion.
NOAA has also met the criterion for demonstrating progress by mitigating  schedule risks and successfully launching the satellite. In September  2013, we reported that the agency had weaknesses in its schedule- management practices on its core ground system and spacecraft. We  made recommendations to address those weaknesses, which included  sequencing all activities, ensuring there are adequate resources for the  activities, and analyzing schedule risks. NOAA agreed with the  recommendations and the Geostationary Operational Environmental  Satellite-R series (GOES-R) program improved its schedule management  practices. By early 2016, the program had improved the links between  remaining activities on the spacecraft schedule, included needed  schedule logic for a greater number of activities on the ground schedule,  and included indications on the ground schedule that the results of a  schedule risk analysis were used in calculating its durations. In addition,  the program successfully launched the GOES-R satellite in November  2016.
Oversight by Congress has been instrumental in reducing the risk of  geostationary weather satellite gaps. For example, Subcommittees of the  House Science, Space, and Technology committee held multiple hearings  to provide oversight of the satellite acquisition and the risk of gaps in  satellite coverage.
As a result, the agency now has a robust constellation of operational and  backup satellites in orbit and has made significant progress in addressing  the risk of a gap in geostationary data coverage. Accordingly, there is  sufficient progress to remove this segment from the high-risk area.
Additional information on Mitigating Gaps in Weather Satellite Data is  provided on pages 19 and 430 of this report.
section_title: Progress in Other Areas
paragraphs: Below are selected examples of areas where progress has been made.
Strengthening Department of Homeland Security Management  Functions. The Department of Homeland Security (DHS) continues  to strengthen and integrate its management functions and progressed  from partially met to met for the monitoring criterion. Since our 2015  high-risk update, DHS has strengthened its monitoring efforts for  financial system modernization programs by entering into a contract  for independent verification and validation services to help ensure that  the modernization projects meet key requirements. These programs  are key to effectively supporting the department’s financial  management operations.
Additionally, DHS continued to meet the criteria for leadership  commitment and a corrective action plan. DHS’s top leadership has  demonstrated exemplary support and a continued focus on  addressing the department’s management challenges by, among  other things, issuing 10 updated versions of DHS’s initial January  2011 Integrated Strategy for High Risk Management.
The National Defense Authorization Act for Fiscal Year 2017  reinforces this focus with the inclusion of a mandate that the DHS  Under Secretary for Management report to us every 6 months to  demonstrate measurable, sustainable progress made in implementing  DHS’s corrective action plans to address the high-risk area, until we  submit written notification of the area’s removal from the High-Risk  List to the appropriate congressional committees. Similar provisions  were included in the DHS Headquarters Reform and Improvement Act  of 2015, the DHS Accountability Act of 2016, and the DHS Reform  and Improvement Act. Additional information on this high-risk area is  provided on page 354 of this report.
Strategic Human Capital Management. This area progressed from  partially met to met on leadership commitment. The Office of  Personnel Management (OPM), agencies, and Congress have taken  actions to improve efforts to address mission critical skills gaps.  Specifically, OPM has demonstrated leadership commitment by  publishing revisions to its human capital regulations in December  2016 that require agencies to, among other things, implement human  capital policies and programs that address and monitor government- wide and agency-specific skills gaps. This initiative has increased the  likelihood that skills gaps with the greatest operational effect will be  addressed in future efforts.
At the same time, Congress has provided agencies with authorities  and flexibilities to manage the federal workforce and make the federal  government a more accountable employer. For example, Congress  included a provision in the National Defense Authorization Act for  Fiscal Year 2016 to extend the probationary period for newly-hired  civilian DOD employees from 1 to 2 years. This action is consistent  with our 2015 reporting that better use of probationary periods gives  agencies the ability to ensure an employee’s skills are a good fit for all  critical areas of a particular job. Additional information on this high-risk  area is provided on page 61 of this report.
Transforming the Environmental Protection Agency’s Process  for Assessing and Controlling Toxic Chemicals. Overall, this high- risk area progressed from not met to partially met on two criteria— capacity and demonstrated progress—and continued to partially meet  the criterion for monitoring due to progress in one program area. The  Environmental Protection Agency’s (EPA) ability to effectively  implement its mission of protecting public health and the environment  is critically dependent on assessing the risks posed by chemicals in a  credible and timely manner. EPA assesses these risks under a variety  of actions, including the Integrated Risk Information System (IRIS)  program and EPA’s Toxic Substances Control Act (TSCA) program.  The IRIS program has made some progress on the capacity,  monitoring, and demonstrated progress criteria. In terms of IRIS  capacity, EPA has partially met this criterion by finalizing a Multi-Year  Agenda to better assess how many people and resources should be  dedicated to the IRIS program. In terms of IRIS monitoring, EPA has  met this criterion in part by using a Chemical Assessment Advisory  Committee to review IRIS assessments, among other actions. In  terms of IRIS demonstrated progress, EPA has partially met this  criterion as of January 2017 by issuing five assessments since fiscal  year 2015.
The Frank R. Lautenberg Chemical Safety for the 21st Century Act  amended TSCA and was enacted on June 22, 2016. Passing TSCA  reform may facilitate EPA’s effort to improve its processes for  assessing and controlling toxic chemicals in the years ahead. The  new law provides EPA with greater authority and the ability to take  actions that could help EPA implement its mission of protecting  human health and the environment. EPA officials stated that the  agency is better positioned to take action to require chemical  companies to report chemical toxicity and exposure data. Officials  also stated that the new law gives the agency additional authorities,  including the authority to require companies to develop new  information relating to a chemical as necessary for prioritization and  risk evaluation.
Using both new and previously existing TSCA authorities should  enhance the agency’s ability to gather new information as necessary  to evaluate hazard and exposure risks. Continued leadership  commitment from EPA officials and Congress will be needed to fully  implement reforms. Additional work will also be needed to issue a  workload analysis to demonstrate capacity, complete a corrective  action plan, and demonstrate progress implementing the new  legislation. Additional information on this high-risk area is provided on  page 417 of this report.
Managing Federal Real Property. The federal government continued  to meet the criteria for leadership commitment, now partially meets  the criterion for demonstrated progress, and made some progress in  each of the other high-risk criteria. The Office of Management and  Budget (OMB) issued the National Strategy for the Efficient Use of  Real Property (National Strategy) on March 25, 2015, which directs  Chief Financial Officer (CFO) Act agencies to take actions to reduce  the size of the federal real property portfolio, as we recommended in  2012. In addition, in December 2016, two real property reform bills  were enacted that could address the long-standing problem of federal  excess and underutilized property. The Federal Assets Sale and  Transfer Act of 2016 may help address stakeholder influence by  establishing an independent board to identify and recommend five  high-value civilian federal buildings for disposal within 180 days after  the board members are appointed, as well as develop  recommendations to dispose and redevelop federal civilian real  properties.
Additionally, the Federal Property Management Reform Act of 2016  codified the Federal Real Property Council (FRPC) for the purpose of  ensuring efficient and effective real property management while  reducing costs to the federal government. FRPC is required to  establish a real property management plan template, which must  include performance measures, and strategies and government-wide  goals to reduce surplus property or to achieve better utilization of  underutilized property. In addition, federal agencies are required to  annually provide FRPC a report on all excess and underutilized  property, and identify leased space that is not fully used or occupied.
In addressing our 2016 recommendation to improve the reliability of  real property data, GSA conducted an in-depth survey that focused on  key real property data elements maintained in the Federal Real  Property Profile, formed a working group of CFO Act agencies to  analyze the survey results and reach consensus on reforms, and  issued a memorandum to CFO Act agencies designed to improve the  consistency and quality of real property data. The Federal Protective  Service, which protects about 9,500 federal facilities, implemented our  recommendation aimed at improving physical security by issuing a  plan that identifies goals and describes resources that support its risk  management approach. In addition, the Interagency Security  Committee, a DHS-chaired organization, issued new guidance  intended to make the most effective use of physical security  resources. Additional information on this high-risk area is provided on  page 77 of this report.
Enforcement of Tax Laws. The Internal Revenue Service’s (IRS)  continued efforts to enforce tax laws and address identity theft refund  fraud (IDT) have resulted in the agency meeting one criterion for  removal from the High-Risk List (leadership commitment) and partially  meeting the remaining four criteria (capacity, action plan, monitoring,  and demonstrating progress). IDT is a persistent and evolving threat  that burdens legitimate taxpayers who are victims of the crime. It cost  the U.S. Treasury an estimated minimum of $2.2 billion during the  2015 tax year.
Congress and IRS have taken steps to address this challenge. IRS  has deployed new tools and increased resources dedicated to  identifying and combating IDT refund fraud. In addition, the  Consolidated Appropriations Act, 2016, amended the tax code to  accelerate Wage and Tax Statement (W-2) filing deadlines to January  31. We had previously reported that the wage information that  employers report on Form W-2 was not available to IRS until after it  issues most refunds. With earlier access to W-2 wage data, IRS could  match such information to taxpayers’ returns and identify  discrepancies before issuing billions of dollars of fraudulent IDT  refunds. Such matching could also provide potential benefits for other  IRS enforcement programs, such as preventing improper payments  via the Earned Income Tax Credit. Additional information on this high- risk area is provided on page 500 of this report.
section_title: Congressional Action Aided Progress on Government-wide High- Risk Issues
paragraphs: In addition to being instrumental in supporting progress in individual high- risk areas, Congress also has taken actions to enact various statutes that,  if implemented effectively, will help foster progress on high-risk issues  government-wide. These include the:
Program Management Improvement Accountability Act:  Enacted in December 2016, the act seeks to improve program and  project management in federal agencies. Among other things, the act  requires the Deputy Director of the Office of Management and Budget  (OMB) to adopt and oversee implementation of government-wide  standards, policies, and guidelines for program and project  management in executive agencies. The act also requires the Deputy  Director to conduct portfolio reviews to address programs on our  High-Risk List. It further creates a Program Management Policy  Council to act as an interagency forum for improving practices related  to program and project management. The Council is to review  programs on the High-Risk List and make recommendations to the  Deputy Director or designee. We are to review the effectiveness of  key efforts under the act to improve federal program management.
Fraud Reduction and Data Analytics Act of 2015 (FRDA): FRDA,  enacted in June 2016, is intended to strengthen federal anti-fraud  controls, while also addressing improper payments. FRDA requires  OMB to use our Fraud Risk Framework to create guidelines for  federal agencies to identify and assess fraud risks, and then design  and implement control activities to prevent, detect, and respond to  fraud. Agencies, as part of their annual financial reports beginning in  fiscal year 2017, are further required to report on their fraud risks and  their implementation of fraud reduction strategies, which should help  Congress monitor agencies’ progress in addressing and reducing  fraud risks. To aid federal agencies in better analyzing fraud risks,  FRDA requires OMB to establish a working group tasked with  developing a plan for the creation of an interagency library of data  analytics and data sets to facilitate the detection of fraud and the  recovery of improper payments. This working group and the library  should help agencies to coordinate their fraud detection efforts and  improve their ability to use data analytics to monitor databases for  potential improper payments. The billions of dollars of improper  payments are a central part of the Medicare Program, Medicaid  Program, and Enforcement of Tax Laws (Earned Income Tax Credit)  high-risk areas.
IT Acquisition Reform, Legislation known as the Federal  Information Technology Acquisition Reform Act (FITARA):  FITARA, enacted in December 2014, was intended to improve how  agencies acquire IT and enable Congress to monitor agencies’  progress and hold them accountable for reducing duplication and  achieving cost savings. FITARA includes specific requirements  related to seven areas: the federal data center consolidation initiative,  enhanced transparency and improved risk management, agency  Chief Information Officer authority enhancements, portfolio review,  expansion of training and use of IT acquisition cadres, government- wide software purchasing, and maximizing the benefit of the federal  strategic sourcing initiative. Effective implementation of FITARA is  central to making progress in the Improving the Management of IT  Acquisitions and Operations government-wide area we added to the  High-Risk List in 2015.
section_title: High-Risk Areas Highlighted for Significant Attention
paragraphs: In the 2 years since the last high-risk update, two areas—Mitigating Gaps  in Weather Satellite Data and Management of Federal Oil and Gas  Resources—have expanded in scope because of emerging challenges  related to these overall high-risk areas. In addition, while progress is  needed across all high-risk areas, particular areas need significant  attention.
subsections: section_title: Expanding High-Risk Area: Mitigating Gaps in DOD Weather Satellite Data
subsections: section_title: DOD’s Polar-Orbiting Weather Satellites
paragraphs: While NOAA has made significant progress, as described earlier, in its  geostationary weather satellite program, DOD has made limited progress  in meeting its requirements for the polar satellite program. In 2010, when  the Executive Office of the President decided to disband a tri-agency  polar weather satellite program, DOD was given responsibility for  providing polar-orbiting weather satellite capabilities in the early morning  orbit. This information is used to provide updated information for weather  observations and models. However, the department was slow to develop  plans to replace the existing satellites that provide this coverage.  Because DOD delayed establishing plans for its next generation of  weather satellites, there is a risk of a satellite data gap in the early  morning orbit.
The last satellite that the department launched in 2014 called Defense  Meteorological Satellite Program (DMSP)-19, stopped providing recorded  data used in weather models in February 2016. A prior satellite, called  DMSP-17, is now the primary satellite operating in the early morning orbit.  However, this satellite, which was launched in 2006, is operating with  limitations due to the age of its instruments. DOD had developed another  satellite, called DMSP-20, but plans to launch that satellite were canceled  after the department did not certify that it would launch the satellite by the  end of calendar year 2016.
The department conducted a requirements review and analysis of  alternatives from February 2012 through September 2014 to determine  the best way forward for providing needed polar-orbiting satellite  environmental capabilities in the early morning orbit. In October 2016,  DOD approved plans for its next generation of weather satellites, called  the Weather System Follow-on—Microwave program, which will meet the  department’s needs for satellite information on oceanic wind speed and  direction to protect ships on the ocean’s surface. The department plans to  launch a demonstration satellite in 2017 and to launch its first operational  satellite developed under this program in 2022. However, DOD’s plans for  the early morning orbit are not comprehensive.
The department did not thoroughly assess options for providing its two  highest-priority capabilities, cloud descriptions and area-specific weather  imagery. These capabilities were not addressed due to an incorrect  assumption about the capabilities that would be provided by international  partners. The Weather System Follow-on—Microwave program does not  address these two highest-priority capabilities and the department has not  yet determined its long-term plans for providing these capabilities. As a  result, the department will need to continue to rely on the older DMSP-17  satellite until its new satellite becomes operational in 2022, and it  establishes and implements plans to address the high-priority capabilities  that the new satellite will not address. Given the age of the DMSP-17  satellite and uncertainty on how much longer it will last, the department  could face a gap in critical satellite data.
In August 2016, DOD reported to Congress its near-term plans to address  potential satellite data gaps. These plans include a greater reliance on  international partner capabilities, exploring options to move a  geostationary satellite over an affected region, and plans to explore  options for acquiring and fielding new equipment, such as satellites and  satellite components to provide the capabilities. In addition, the  department anticipates that the demonstration satellite to be developed  as a precursor to the Weather System Follow-on—Microwave program  could help mitigate a potential gap by providing some useable data.  However, these proposed solutions may not be available in time or be  comprehensive enough to avoid near-term coverage gaps. Such a gap  could negatively affect military operations that depend on weather data,  such as long-range strike capabilities and aerial refueling.
DOD needs to demonstrate progress on its new Weather Satellite Follow- on—Microwave program, and to establish and implement plans to  address the high-priority capabilities that are not included in the program.  Additional information on Mitigating Gaps in Weather Satellite Data is  provided on page 430 of this report.
section_title: Expanding High-Risk Area: Management of Federal Oil and Gas Resources
subsections: section_title: Restructuring of Offshore Oil and Gas Oversight
paragraphs: On April 20, 2010, the Deepwater Horizon drilling rig exploded in the Gulf  of Mexico, resulting in 11 deaths, serious injuries, and the largest marine  oil spill in U.S. history. In response, in May 2010, the Department of the  Interior (Interior) first reorganized its offshore oil and gas management  activities into separate offices for revenue collection, under the Office of  Natural Resources Revenue, and energy development and regulatory  oversight, under the Bureau of Ocean Energy Management, Regulation  and Enforcement. Later, in October 2011, Interior further reorganized its  energy development and regulatory oversight activities when it  established two new bureaus to oversee offshore resources and  operational compliance with environmental and safety requirements. The  new Bureau of Ocean Energy Management (BOEM) is responsible for  leasing and approving offshore development plans while the new Bureau  of Safety and Environmental Enforcement (BSEE) is responsible for lease  operations, safety, and enforcement.
In 2011, we added Interior’s management of federal oil and gas resources  to the High-Risk List based on three concerns: (1) Interior did not have  reasonable assurance that it was collecting its share of billions of dollars  of revenue from federal oil and gas resources; (2) Interior continued to  experience problems hiring, training, and retaining sufficient staff to  oversee and manage federal oil and gas resources; and (3) Interior was  engaged in restructuring its oil and gas program, which is inherently  challenging, and there were questions about whether Interior had the  capacity to reorganize while carrying out its range of responsibilities,  especially in a constrained resource environment.
Immediately after reorganizing, Interior developed memorandums and  standard operating procedures to define roles and responsibilities, and  facilitate and formalize coordination between BOEM and BSEE. Interior  also revised polices intended to improve its oversight of offshore oil and  gas activities, such as new requirements designed to mitigate the risk of a  subsea well blowout or spill. In 2013, we determined that progress had  been made, because Interior had fundamentally completed reorganizing  its oversight of offshore oil and gas activities. As a result, in 2013, we  removed the reorganization segment from this high-risk area.
However, in February 2016, we reported that BSEE had undertaken  various reform efforts since its creation in 2011, but had not fully  addressed deficiencies in its investigative, environmental compliance, and  enforcement capabilities identified by investigations after the Deepwater  Horizon incident.
BSEE’s ongoing restructuring has made limited progress enhancing the  bureau’s investigative capabilities. BSEE continues to use pre– Deepwater Horizon incident policies and procedures. Specifically, BSEE  has not completed a policy outlining investigative responsibilities or  updated procedures for investigating incidents—among the goals of  BSEE’s restructuring, according to restructuring planning documents, and  consistent with federal standards for internal control. The use of outdated  investigative policies and procedures is a long-standing deficiency. Post– Deepwater Horizon incident investigations found that Interior’s policies  and procedures did not require it to plan investigations, gather and  document evidence, and ensure quality control, and determined that  continuing to use them posed a risk to the effectiveness of bureau  investigations. Without completing and updating its investigative policies  and procedures, BSEE continues to face this risk.
BSEE’s ongoing restructuring of its environmental compliance program  reverses actions taken to address post–Deepwater Horizon incident  concerns, and risks weakening the bureau’s environmental compliance  oversight capabilities. In 2011, in response to two post–Deepwater  Horizon incident investigations that found that BSEE’s predecessor’s  focus on oil and gas development might have been at the expense of  protecting the environment, BSEE created an environmental oversight  division with region-based staff reporting directly to the headquarters- based division chief instead of regional management. This reporting  structure was to help ensure that environmental issues received  appropriate weight and consideration within the bureau.
Under the restructuring, since February 2015, field-based environmental  compliance staff again report to their regional directors. BSEE’s rationale  for this action is unclear, as it was not documented or analyzed as part of  the bureau’s restructuring planning. Under federal standards for internal  control, management is to assess the risks posed by external and internal  sources and decide what actions to take to mitigate them. Without  assessing the risk of reversing its reporting structure, Interior cannot be  sure that BSEE will have reasonable assurance that environmental issues  are receiving the appropriate weight and consideration, as called for by  post–Deepwater Horizon incident investigations.
When we reviewed BSEE’s environmental compliance program, we found  that the interagency agreements between Interior and EPA designed to  coordinate water quality monitoring under the National Pollutant  Discharge Elimination System were decades old. According to BSEE  annual environmental compliance activity reports, the agreements may  not reflect the agency’s current resources and needs. For example, a  1989 agreement stipulates that Interior shall inspect no more than 50  facilities on behalf of EPA per year, and shall not conduct water sampling  on behalf of EPA. Almost 30 years later, after numerous changes in  drilling practices and technologies, it is unclear whether inspecting no  more than 50 facilities per year is sufficient to monitor water quality.
Nevertheless, senior BSEE officials told us that the bureau has no plans  to update its agreements with EPA, and some officials said that a  previous headquarters-led effort to update the agreements was not  completed because it did not sufficiently describe the bureau’s offshore oil  and gas responsibilities. According to Standards for Internal Control in the  Federal Government, as programs change and agencies strive to improve  operational processes and adopt new technologies, management officials  must continually assess and evaluate internal controls to ensure that  control activities are effective and updated when necessary.
BSEE’s ongoing restructuring has made limited progress in enhancing its  enforcement capabilities. In particular, BSEE has not developed  procedures with criteria to guide how it uses enforcement tools—such as  warnings and fines—which are among the goals of BSEE’s restructuring,  according to planning documents, and consistent with federal standards  for internal control. BSEE restructuring plans state that the current lack of  criteria causes BSEE to act inconsistently, which makes oil and gas  industry operators uncertain about BSEE’s oversight approach and  expectations. The absence of enforcement climate criteria is a long- standing deficiency. For example, post–Deepwater Horizon incident  investigations recommended BSEE assess its enforcement tools and how  to employ them to deter safety and environmental violations. Without  developing procedures with defined criteria for taking enforcement  actions, BSEE continues to face risks to the effectiveness of its  enforcement capabilities.
To enhance Interior’s oversight of oil and gas development, we  recommended in February 2016 that the Secretary of the Interior direct  the Director of BSEE to take the following nine actions as it continues to  restructure.
To address risks to the effectiveness of BSEE’s investigations,  environmental compliance, and enforcement capabilities, we  recommended that BSEE complete policies outlining the  responsibilities of investigations, environmental compliance, and  enforcement programs, and update and develop procedures to guide  them.
To enhance its investigative capabilities, we recommended that establish a capability to review investigation policy and collect and  analyze incidents to identify trends in safety and environmental  hazards; develop a plan with milestones for implementing the case  management system for investigations;  clearly communicate the purpose of BSEE’s investigations  program to industry operators; and  clarify policies and procedures for assigning panel investigation  membership and referring cases of suspected criminal  wrongdoing to the Inspector General.
To enhance its environmental compliance capabilities, we recommend  conduct and document a risk analysis of the regional-based  reporting structure of its Environmental Compliance Division,  including actions to mitigate any identified risks;  coordinate with the Administrator of the Environmental Protection  Agency to consider the relevance of existing interagency  agreements for monitoring operator compliance with National  Pollutant Discharge Elimination System permits on the Outer  Continental Shelf and, if necessary, update agreements to reflect  current oversight needs; and develop a plan to address documented environmental oversight  staffing needs.
To enhance its enforcement capabilities, we recommended that BSEE  develop a mechanism to ensure that it reviews the maximum daily  civil penalty and adjusts it to reflect changes in the Consumer Price  Index within the time frames established by statute.
In its written comments, Interior agreed that additional reforms—such as  documented policies and procedures—are needed to address offshore oil  and gas oversight deficiencies, but Interior neither agreed nor disagreed  with our specific recommendations. Additional information on  Management of Federal Oil and Gas Resources is provided on page 136  of this report.
section_title: Additional High-Risk Areas Needing Significant Attention
paragraphs: Managing Risks and Improving VA Health Care. Since we added  Department of Veterans Affairs (VA) health care to our High-Risk List  in 2015, VA has acknowledged the significant scope of the work that  lies ahead in each of the five areas of concern we identified: (1)  ambiguous policies and inconsistent processes; (2) inadequate  oversight and accountability; (3) information technology (IT)  challenges; (4) inadequate training for VA staff; and (5) unclear  resource needs and allocation priorities. It is imperative that VA  maintain strong leadership support, and as the new administration  sets its priorities, VA will need to integrate those priorities with its  high-risk related actions.
VA developed an action plan for addressing its high-risk designation,  but the plan describes many planned outcomes with overly ambitious  deadlines for completion. We are concerned about the lack of root  cause analyses for most areas of concern, and the lack of clear  metrics and needed resources for achieving stated outcomes. In  addition, with the increased use of community care programs, it is  imperative that VA’s action plan discuss the role of community care in  decisions related to policies, oversight, IT, training, and resource  needs.
Finally, to help address its high-risk designation, VA should continue  to implement our recommendations, as well as recommendations  from others. While VA’s leadership has increased its focus on  implementing our recommendations in the last 2 years, additional  work is needed. We made 66 VA health care-related  recommendations in products issued since the VA health care high- risk designation in February 2015, for a total of 244 recommendations  from January 1, 2010, through December 31, 2016. VA has  implemented 122 (about 50 percent) of the 244 recommendations, but  over 100 recommendations remain open as of December 31, 2016  (with about 25 percent being open for 3 or more years). It is critical  that VA implement our recommendations in a timely manner.
Additional information on Managing Risks and Improving VA Health  Care is provided on page 627 of this report.
DOD Financial Management. The effects of DOD’s financial  management problems extend beyond financial reporting and  negatively affect DOD’s ability to manage the department and make  sound decisions on mission and operations. In addition, DOD remains  one of the few federal entities that cannot demonstrate its ability to  accurately account for and reliably report its spending or assets.  DOD’s financial management problems continue as one of three  major impediments preventing us from expressing an opinion on the  consolidated financial statements of the federal government.
Sustained leadership commitment will be critical to DOD’s success in  achieving financial accountability, and in providing reliable information  for day-to-day management decision making as well as financial audit  readiness. DOD needs to assure the sustained involvement of  leadership at all levels of the department in addressing financial  management reform and business transformation. In addition, further  action is needed in the areas of capacity and action planning.  Specifically, DOD needs to  continue building a workforce with the level of training and  experience needed to support and sustain sound financial  management;  continue to develop and deploy enterprise resource planning  systems as a critical component of DOD’s financial improvement  and audit readiness strategy, as well as strengthen automated  controls or design manual workarounds for the remaining legacy  systems to satisfy audit requirements and improve data used for  day-to-day decision making; and effectively implement its Financial Improvement and Audit  Readiness Plan and related guidance to focus on strengthening  processes, controls, and systems to improve the accuracy,  reliability, and reporting for its priority areas, including budgetary  information and mission-critical assets.
Further, DOD needs to monitor and assess the progress the  department is making to remediate its internal control deficiencies.  DOD should (1) require the military services to improve their policies  and procedures for monitoring their corrective action plans for  financial management-related findings and recommendations, and (2)  improve its process for monitoring the military services’ audit  remediation efforts by preparing a consolidated management  summary that provides a comprehensive picture of the status of  corrective actions throughout the department. DOD is continuing to  work toward undergoing a full financial statement audit by fiscal year  2018; however, it expects to receive disclaimers of opinion on its  financial statements for a number of years.
A lack of comprehensive information on the corrective action plans  limits the ability of DOD and Congress to evaluate DOD’s progress  toward achieving audit readiness, especially given the short amount of  time remaining before DOD is required to undergo an audit of the  department-wide financial statements for fiscal year 2018. Being able  to demonstrate progress in remediating its financial management  deficiencies will be useful as the department works toward  implementing lasting financial management reform to ensure that it  can generate reliable, useful, and timely information for financial  reporting as well as for decision making and effective operations.  Moreover, stronger financial management would show DOD’s  accountability for funds and would help it operate more efficiently.
Additional information on DOD Financial Management is provided on  page 280 of this report.
Modernizing the U.S. Financial Regulatory System and the  Federal Role in Housing Finance. Resolving the role of the federal  government in housing finance will require leadership commitment  and action by Congress and the administration. The federal  government has directly or indirectly supported more than two-thirds  of the value of new mortgage originations in the single-family housing  market since the beginning of the 2007-2009 financial crisis.  Mortgages with federal support include those backed by Fannie Mae  and Freddie Mac, two large government-sponsored enterprises (the  enterprises). Out of concern that their deteriorating financial condition  threatened the stability of financial markets, the Federal Housing  Finance Agency (FHFA) placed the enterprises into federal  conservatorship in 2008, creating an explicit fiscal exposure for the  federal government. As of September 2016, the Department of the  Treasury (Treasury) had provided about $187.5 billion in funds as  capital support to the enterprises, with an additional $258.1 billion  available to the enterprises should they need further assistance. In  accordance with the terms of agreements with Treasury, the  enterprises had paid dividends to Treasury totaling about $250.5  billion through September 2016.
More than 8 years after entering conservatorship, the enterprises’  futures remain uncertain and billions of federal dollars remain at risk.  The enterprises have a reduced capacity to absorb future losses due  to a capital reserve amount that falls to $0 by 2018. Without a capital  reserve, any quarterly losses—including those due to market  fluctuations and not necessarily to economic conditions—would  require the enterprises to draw additional funds from Treasury.  Additionally, prolonged conservatorships and a change in leadership  at FHFA could shift priorities for the conservatorships, which in turn  could send mixed messages and create uncertainties for market  participants and hinder the development of the broader secondary  mortgage market. For this reason, we said in November 2016 that  Congress should consider legislation establishing objectives for the  future federal role in housing finance, including the structure of the  enterprises, and a transition plan to a reformed housing finance  system that enables the enterprises to exit conservatorship.
The federal government also supports mortgages through insurance  or guarantee programs, the largest of which is administered by the  Department of Housing and Urban Development’s Federal Housing  Administration (FHA). During the financial crisis, FHA served its  traditional role of helping to stabilize the housing market, but also  experienced financial difficulties from which it only recently recovered.  Maintaining FHA’s long-term financial health and defining its future  role also will be critical to any effort to overhaul the housing finance  system.
We previously recommended that Congress or FHA specify the  economic conditions that FHA’s Mutual Mortgage Insurance Fund  would be expected to withstand without requiring supplemental funds.  As evidenced by the $1.68 billion FHA received in 2013, the current 2  percent capital requirement for FHA’s fund may not always be  adequate to avoid the need for supplemental funds under severe  stress scenarios. Implementing our recommendation would be an  important step not only in addressing FHA’s long-term financial  viability, but also in clarifying FHA’s role.
Additional information on Modernizing the U.S. Financial Regulatory  System and the Federal Role in Housing Finance is provided on page  107 of this report.
Pension Benefit Guaranty Corporation Insurance Programs. The  Pension Benefit Guaranty Corporation (PBGC) is responsible for  insuring the defined benefit pension plans of nearly 40 million  American workers and retirees who participate in nearly 24,000  private sector plans. PBGC faces an uncertain financial future due, in  part, to a long-term decline in the number of traditional defined benefit  plans and the collective financial risk of the many underfunded  pension plans that PBGC insures. PBGC’s financial portfolio is one of  the largest of all federal government corporations and, at the end of  fiscal year 2016, PBGC’s net accumulated financial deficit was over  $79 billion—having more than doubled since fiscal year 2013. PBGC  has estimated that, without additional funding, its multiemployer  insurance program will likely be exhausted by 2025 as a result of  current and projected pension plan insolvencies. The agency’s single- employer insurance program is also at risk due to the continuing  decline of traditional defined benefit pension plans, increased financial  risk and reduced premium payments.
While Congress and PBGC have taken significant and positive steps  to strengthen the agency over recent years, challenges related to  PBGC’s funding and governance structure remain. Addressing the  significant financial risk and governance challenges that PBGC faces  requires additional congressional action. To improve the long-term  financial stability of PBGC’s insurance programs, Congress should  consider: (1) authorizing a redesign of PBGC’s single employer  program premium structure to better align rates with sponsor risk; (2)  adopting additional changes to PBGC’s governance structure—in  particular, expanding the composition of its board of directors; (3)  strengthening funding requirements for plan sponsors as appropriate  given national economic conditions; (4) working with PBGC to develop  a strategy for funding PBGC claims over the long term, as the defined  benefit pension system continues to decline; and (5) enacting  additional structural reforms to reinforce and stabilize the  multiemployer system that balance the needs and potential sacrifices  of contributing employers, participants and the federal government.  Absent additional steps to improve PBGC’s finances, the long-term  financial stability of the agency remains uncertain and the retirement  benefits of millions of American workers and retirees could be at risk  of dramatic reductions.
Additional information on Pension Benefit Guaranty Corporation  Insurance Programs is provided on page 609 of this report.
Ensuring the Security of Federal Information Systems and Cyber  Critical Infrastructure and Protecting the Privacy of Personally  Identifiable Information. Federal agencies and our nation’s critical  infrastructures—such as energy, transportation systems,  communications, and financial services—are dependent on  computerized (cyber) information systems and electronic data to carry  out operations and to process, maintain, and report essential  information. The security of these systems and data is vital to public  confidence and the nation’s safety, prosperity, and well-being.  However, safeguarding computer systems and data supporting the  federal government and the nation’s critical infrastructure is a  concern. We first designated information security as a government- wide high-risk area in 1997.
This high-risk area was expanded to include the protection of critical  cyber infrastructure in 2003 and protecting the privacy of personally  identifiable information (PII) in 2015. Ineffectively protecting cyber  assets can facilitate security incidents and cyberattacks that disrupt  critical operations; lead to inappropriate access to and disclosure,  modification, or destruction of sensitive information; and threaten  national security, economic well-being, and public health and safety.  In addition, the increasing sophistication of hackers and others with  malicious intent, and the extent to which both federal agencies and  private companies collect sensitive information about individuals, have  increased the risk of PII being exposed and compromised.
Over the past several years, we have made about 2,500  recommendations to agencies aimed at improving the security of  federal systems and information. These recommendations would help  agencies strengthen technical security controls over their computer  networks and systems, fully implement aspects of their information  security programs, and protect the privacy of PII held on their  systems. As of October 2016, about 1,000 of our information security– related recommendations had not been implemented. In addition, the  federal government needs, among other things, to improve its abilities  to detect, respond to, and mitigate cyber incidents; expand efforts to  protect cyber critical infrastructure; and oversee the protection of PII,  among other things.
Additional information on Ensuring the Security of Federal Information  Systems and Cyber Critical Infrastructure and Protecting the Privacy  of Personally Identifiable Information is provided on page 338 of this  report.
section_title: New High-Risk Areas
paragraphs: For 2017, we are adding three new areas to the High-Risk List.
subsections: section_title: Improving Federal Management of Programs That Serve Tribes and Their Members
paragraphs: We, along with inspectors general, special commissions, and others,  have reported that federal agencies have ineffectively administered Indian  education and health care programs, and inefficiently fulfilled their  responsibilities for managing the development of Indian energy  resources. In particular, we have found numerous challenges facing  Interior’s Bureau of Indian Education (BIE) and Bureau of Indian Affairs  (BIA) and the Department of Health and Human Services’ (HHS) Indian  Health Service (IHS) in administering education and health care services,  which put the health and safety of American Indians served by these  programs at risk. These challenges included poor conditions at BIE  school facilities that endangered students, and inadequate oversight of  health care that hindered IHS’s ability to ensure quality care to Indian  communities. In addition, we have reported that BIA mismanages Indian  energy resources held in trust and thereby limits opportunities for tribes  and their members to use those resources to create economic benefits  and improve the well-being of their communities.
Congress recently noted, “through treaties, statutes, and historical  relations with Indian tribes, the United States has undertaken a unique  trust responsibility to protect and support Indian tribes and Indians.” In  light of this unique trust responsibility and concerns about the federal  government ineffectively administering Indian education and health care  programs and mismanaging Indian energy resources, we are adding  these programs as a high-risk issue because they uniquely affect tribal  nations and their members.
Federal agencies have performed poorly in the following broad areas: (1)  oversight of federal activities; (2) collaboration and communication; (3)  federal workforce planning; (4) equipment, technology, and infrastructure;  and (5) federal agencies’ data. While federal agencies have taken some  actions to address the 41 recommendations we made related to Indian  programs, there are currently 39 that have yet to be fully resolved.
We plan to continue monitoring federal efforts in these areas. To this end,  we have ongoing work focusing on accountability for safe schools and  school construction, and tribal control of energy delivery, management,  and resource development.
subsections: section_title: What Needs to Be Done
paragraphs: Education: We have identified weaknesses in how Indian Affairs  oversees school safety and construction and in how it monitors the way  schools use Interior funds. We have also found limited workforce planning  in several key areas related to BIE schools. Moreover, aging BIE school  facilities and equipment contribute to degraded and unsafe conditions for  students and staff. Finally, a lack of internal controls and other  weaknesses hinder Indian Affairs’ ability to collect complete and accurate  information on the physical conditions of BIE schools.
In the past 3 years, we issued three reports on challenges with Indian  Affairs’ management of BIE schools in which we made 13  recommendations. Eleven recommendations below remain open.
To help ensure that BIE schools provide safe and healthy facilities for  students and staff, we made four recommendations which remain  open, including that Indian Affairs ensure the inspection information it  collects on BIE schools is complete and accurate; develop a plan to  build schools’ capacity to promptly address safety and health  deficiencies; and consistently monitor whether BIE schools have  established required safety committees.
To help ensure that BIE conducts more effective oversight of school  spending, we made four recommendations which remain open,  including that Indian Affairs develop a workforce plan to ensure that  BIE has the staff to effectively oversee school spending; put in place  written procedures and a risk-based approach to guide BIE in  overseeing school spending; and improve information sharing to  support the oversight of BIE school spending.
To help ensure that Indian Affairs improves how it manages Indian  education, we made five recommendations. Three recommendations  remain open, including that Indian Affairs develop a strategic plan for  BIE that includes goals and performance measures for how its offices  are fulfilling their responsibilities to provide BIE with support; revise  Indian Affairs’ strategic workforce plan to ensure that BIA regional  offices have an appropriate number of staff with the right skills to  support BIE schools in their regions; and develop and implement  decision-making procedures for BIE to improve accountability for BIE  schools.
Health Care: IHS provides inadequate oversight of health care, both of its  federally operated facilities and through the Purchase Referred Care  program (PRC). Other issues include ineffective collaboration— specifically, IHS does not require its area offices to inform IHS  headquarters if they distribute funds to local PRC programs using  different criteria than the PRC allocation formula suggested by  headquarters. As a result, IHS may be unaware of additional funding  variation across areas. We have also reported that IHS officials told us  that an insufficient workforce was the biggest impediment to ensuring  patients could access timely primary care.
In the past 6 years, we have made 12 recommendations related to Indian  health care that remain open. Although IHS has taken several actions in  response to our recommendations, such as improving the data collected  for the PRC program and adopting Medicare-like rates for nonhospital  services, much more needs to be done.
To help ensure that Indian people receive quality health care, the  Secretary of HHS should direct the Director of IHS to take the  following two actions: (1) as part of implementing IHS’s quality  framework, ensure that agency-wide standards for the quality of care  provided in its federally operated facilities are developed, and  systematically monitor facility performance in meeting these standards  over time; and (2) develop contingency and succession plans for  replacing key personnel, including area directors.
To help ensure that timely primary care is available and accessible to  Indians, IHS should: (1) develop and communicate specific agency- wide standards for wait times in federally-operated facilities, and (2)  monitor patient wait times in federally-operated facilities and ensure  that corrective actions are taken when standards are not met.
To help ensure that IHS has meaningful information on the timeliness  with which it issues purchase orders authorizing payment under the  PRC program, and to improve the timeliness of payments to  providers, we recommended that IHS: (1) modify IHS’s claims  payment system to separately track IHS referrals and self-referrals,  revise Government Performance and Results Act measures for the  PRC program so that it distinguishes between these two types of  referrals, and establish separate time frame targets for these referral  types; and (2) better align PRC staffing levels and workloads by  revising its current practices, where available, used to pay for PRC  program staff. In addition, as HHS and IHS monitor the effect that new  coverage options available to IHS beneficiaries through PPACA have  on PRC funds, we recommend that IHS concurrently develop potential  options to streamline requirements for program eligibility.
To help ensure successful outreach efforts regarding PPACA  coverage expansions, we recommended that IHS realign current  resources and personnel to increase capacity to deal with enrollment  in Medicaid and the exchanges, and prepare for increased billing to  these payers.
If payments for physician and other nonhospital services are capped,  we recommended that IHS monitor patient access to these services.
To help ensure a more equitable allocation of funds per capita across  areas, we recommended that Congress consider requiring IHS to  develop and use a new method for allocating PRC funds.
To develop more accurate data for estimating the funds needed for  the PRC program and improve IHS oversight, we recommended that  IHS develop a written policy documenting how it evaluates the need  for the PRC program, and disseminate it to area offices so they  understand how unfunded services data are used to estimate overall  program needs. We also recommended that IHS develop written  guidance for PRC programs outlining a process to use when funds  are depleted but recipients continue to need services.
Energy: We have reported on issues with BIA oversight of federal  activities, such as the length of time it takes to review energy-related  documents. We also reported on challenges with collaboration—in  particular, while working to form an Indian Energy Service Center, BIA did  not coordinate with key regulatory agencies, including the Department of  the Interior’s Fish and Wildlife Service, the U.S. Army Corps of Engineers,  and the Environmental Protection Agency. In addition, we found  workforce planning issues at BIA contribute to management shortcomings  that have hindered Indian energy development. Lastly, we found issues  with outdated and deteriorating equipment, technology, and infrastructure,  as well as incomplete and inaccurate data.
In the past 2 years, we issued three reports on developing Indian energy  resources in which we made 14 recommendations to BIA. All  recommendations remain open.
To help ensure BIA can verify ownership in a timely manner and  identify resources available for development, we made two  recommendations, including that Interior take steps to improve its  geographic information system mapping capabilities.
To help ensure BIA’s review process is efficient and transparent, we  made two recommendations, including that Interior take steps to  develop a documented process to track review and response times for  energy-related documents that must be approved before tribes can  develop energy resources.
To help improve clarity of tribal energy resource agreement  regulations, we recommended BIA provide additional guidance to  tribes on provisions that tribes have identified to Interior as unclear.
To help ensure that BIA streamlines the review and approval process  for revenue-sharing agreements, we made three recommendations,  including that Interior establish time frames for the review and  approval of Indian revenue-sharing agreements for oil and gas, and  establish a system for tracking and monitoring the review and  approval process to determine whether time frames are met.
To help improve efficiencies in the federal regulatory process, we  made four recommendations, including that BIA take steps to  coordinate with other regulatory agencies so the Service Center can  serve as a single point of contact or lead agency to navigate the  regulatory process.
To help ensure that BIA has a workforce with the right skills,  appropriately aligned to meet the agency’s goals and tribal priorities,  we made two recommendations, including that BIA establish a  documented process for assessing BIA’s workforce composition at  agency offices.
Congressional Actions Needed: It is critical that Congress maintain its  focus on improving the effectiveness with which federal agencies meet  their responsibilities to serve tribes and their members. Since 2013, we  testified at six hearings to address significant weaknesses we found in the  federal management of programs that serve tribes and their members.  Sustained congressional attention to these issues will highlight the  challenges discussed here and could facilitate federal actions to improve  Indian education and health care programs, and the development of  Indian energy resources.
See pages 200-219 for additional details on what we found.
section_title: U.S. Government’s Environmental Liability
paragraphs: The federal government’s environmental liability has been growing for the  past 20 years and is likely to continue to increase. For fiscal year 2016,  the federal government’s estimated environmental liability was $447  billion—up from $212 billion for fiscal year 1997. However, this estimate  does not reflect all of the future cleanup responsibilities facing federal  agencies. Because of the lack of complete information and the often  inconsistent approach to making cleanup decisions, federal agencies  cannot always address their environmental liabilities in ways that  maximize the reduction of health and safety risks to the public and the  environment in a cost-effective manner.
The federal government is financially liable for cleaning up areas where  federal activities have contaminated the environment. Various federal  laws, agreements with states, and court decisions require the federal  government to clean up environmental hazards at federal sites and  facilities—such as nuclear weapons production facilities and military  installations. Such sites are contaminated by many types of waste, much  of which is highly hazardous.
Federal accounting standards require agencies responsible for cleaning  up contamination to estimate future cleanup and waste disposal costs,  and to report such costs in their annual financial statements as  environmental liabilities. Per federal accounting standards, federal  agencies’ environmental liability estimates are to include probable and  reasonably estimable costs of cleanup work. Federal agencies’  environmental liability estimates do not include cost estimates for work for  which reasonable estimates cannot currently be generated.  Consequently, the ultimate cost of addressing the U.S. government’s  environmental cleanup is likely greater than $447 billion. Federal  agencies’ approaches to addressing their environmental liabilities and  cleaning up the contamination from past activities are often influenced by  numerous site-specific factors, stakeholder agreements, and legal  provisions.
We have also found that some agencies do not take a holistic, risk- informed approach to environmental cleanup that aligns limited funds with  the greatest risks to human health and the environment. Since 1994, we  have made at least 28 recommendations related to addressing the federal  government’s environmental liability. These include 22 recommendations  to the Departments of Energy (DOE) or Defense (DOD), 1  recommendation to OMB to consult with Congress on agencies’  environmental cleanup costs, and 4 recommendations to Congress to  change the laws governing cleanup activities. Of these, 13  recommendations remain unimplemented. If implemented, these steps  would improve the completeness and reliability of the estimated costs of  future cleanup responsibilities, and lead to more risk-based management  of the cleanup work.
subsections: section_title: What Needs to Be Done
paragraphs: Of the federal government’s estimated $447 billion environmental liability,  DOE is responsible for by far the largest share of the liability, and DOD is  responsible for the second largest share. The rest of the federal  government makes up the remaining 3 percent of the liability with  agencies such as the National Aeronautics and Space Administration  (NASA) and the Departments of Transportation, Veteran’s Affairs,  Agriculture (USDA), and Interior holding large liabilities (see figure 2).
Agencies spend billions each year on environmental cleanup efforts but  the estimated environmental liability continues to rise. For example,  despite billions spent on environmental cleanup, DOE’s environmental  liability has roughly doubled from a low of $176 billion in fiscal year 1997  to the fiscal year 2016 estimate of $372 billion. In the last 6 years alone,  DOE’s Office of Environmental Management (EM) has spent $35 billion,  primarily to treat and dispose of nuclear and hazardous waste, and  construct capital asset projects to treat the waste; however, EM’s portion  of the environmental liability has grown over this same time period by  over $90 billion, from $163 billion to $257 billion (see figure 3).
Progress in addressing the U.S. government’s environmental liabilities  depends on how effectively federal departments and agencies set  priorities, under increasingly restrictive budgets, that maximize the risk  reduction and cost-effectiveness of cleanup approaches. As a first step,  some departments and agencies may need to improve the completeness  of information about long-term cleanup responsibilities and their  associated costs so that decision makers, including Congress, can  consider the full scope of the federal government’s cleanup obligations.  As a next step, certain departments, such as DOE, may need to change  how they establish cleanup priorities. For example, DOE’s current  practice of negotiating agreements with individual sites without  considering other sites’ agreements or available resources may not  ensure that limited resources will be allocated to reducing the greatest  environmental risks, and costs will be minimized.
section_title: Completeness of Environmental Liability Estimates
paragraphs: In 1994, we recommended that Congress amend certain legislation to  require agencies to report annually on progress in implementing plans  for completing site inventories, estimates of the total costs to clean up  their potential hazardous waste sites, and agencies’ progress toward  completing their site inventories and on their latest estimates of total  cleanup costs. We believe these recommendations are as relevant, if  not more so, today.
In 2015, we recommended that USDA develop plans and procedures  for completing its inventories of potentially contaminated sites. USDA  disagreed with this recommendation. However, we continue to believe  that USDA’s inventory of contaminated and potentially contaminated  sites—in particular, abandoned mines, primarily on Forest Service  land—is insufficient for effectively managing USDA’s overall cleanup  program. Interior is also faced with an incomplete inventory of  abandoned mines that it is working to improve.
section_title: Reliability of Environmental Liability Estimates
paragraphs: In 2006, we recommended that DOD develop, document, and  implement a program for financial management review, assessment,  and monitoring of the processes for estimating and reporting  environmental liabilities. This recommendation has not been  implemented.
section_title: Risk-Based Decision Making
paragraphs: We have found in the past that DOE’s cleanup strategy is not risk  based and should be re-evaluated. DOE’s decisions are often driven  by local stakeholders and certain requirements in federal facilities  agreements and consent decrees. In 1995, we recommended that  DOE set national priorities for cleaning up its contaminated sites using  data gathered during ongoing risk evaluations. This recommendation  has not been implemented.
In 2003, we recommended that DOE ask Congress to clarify its  authority for designating certain waste with relatively low levels of  radioactivity as waste incidental to reprocessing, and therefore not  managed as high-level waste. In 2004, DOE received this specific  authority from Congress for the Savannah River and Idaho Sites,  thereby allowing DOE to save billions of dollars in waste treatment  costs. The law, however, excluded the Hanford Site.
More recently, in 2015, we found that DOE is not comprehensively  integrating risks posed by National Nuclear Security Administration’s  (NNSA) nonoperational contaminated facilities with EM’s portfolio of  cleanup work. By not integrating nonoperational facilities from  NNSA, EM is not providing Congress with complete information about  EM’s current and future cleanup obligations as Congress deliberates  annually about appropriating funds for cleanup activities. We  recommended that DOE integrate its lists of facilities prioritized for  disposition with all NNSA facilities that meet EM’s transfer  requirements, and that EM should include this integrated list as part of  the Congressional Budget Justification for DOE. DOE neither agreed  nor disagreed with this recommendation.
See pages 232-247 for additional details on what we found.
section_title: 2020 Decennial Census
paragraphs: One of the most important functions of the U.S. Census Bureau (Bureau)  is conducting the decennial census of the U.S. population, which is  mandated by the Constitution and provides vital data for the nation. This  information is used to apportion the seats of the U.S. House of  Representatives; realign the boundaries of the legislative districts of each  state; allocate billions of dollars in federal financial assistance; and  provide social, demographic, and economic profiles of the nation’s people  to guide policy decisions at each level of government. A complete count  of the nation’s population is an enormous challenge as the Bureau seeks  to control the cost of the census while it implements several new  innovations and manages the processes of acquiring and developing new  and modified IT systems supporting them. Over the past 3 years, we have  made 30 recommendations to help the Bureau design and implement a  more cost-effective census for 2020; however, only 6 of them had been  fully implemented as of January 2017.
The cost of the census, in terms of cost for counting each housing unit,  has been escalating over the last several decennials. The 2010 Census  was the costliest U.S. Census in history at about $12.3 billion, and was  about 31 percent more costly than the $9.4 billion cost of the 2000  Census (in 2020 dollars). The average cost for counting a housing unit  increased from about $16 in 1970 to around $92 in 2010 (in 2020  constant dollars). Meanwhile, the return of census questionnaires by mail  (the primary mode of data collection) declined over this period from 78  percent in 1970 to 63 percent in 2010. Declining mail response rates—a  key indicator of a cost-effective census—are significant and lead to higher  costs. This is because the Bureau sends enumerators to each  nonresponding household to obtain census data. As a result,  nonresponse follow-up is the Bureau’s largest and most costly field  operation. In many ways, the Bureau has had to invest substantially more  resources each decade to match the results of prior enumerations.
The Bureau plans to implement several new innovations in its design of  the 2020 Census. In response to our recommendations regarding past  decennial efforts and other assessments, the Bureau has fundamentally  reexamined its approach for conducting the 2020 Census. Its plan for  2020 includes four broad innovation areas that it believes will save it over  $5 billion (2020 constant dollars) when compared to what it estimates  conducting the census with traditional methods would cost. The Bureau’s  innovations include (1) using the Internet as a self-response option, which  the Bureau has never done on a large scale before; (2) verifying most  addresses using “in-office” procedures and on-screen imagery rather than  street-by-street field canvassing; (3) re-engineering data collection  methods such as by relying on an automated case management system;  and (4) in certain instances, replacing enumerator collection of data with  administrative records (information already provided to federal and state  governments as they administer other programs). These innovations  show promise for a more cost-effective head count. However, they also  introduce new risks, in part, because they include new procedures and  technology that have not been used extensively in earlier decennials, if at  all.
The Bureau is also managing the acquisition and development of new  and modified IT systems, which add complexity to the design of the  census. To help control census costs, the Bureau plans to significantly  change the methods and technology it uses to count the population, such  as offering an option for households to respond to the survey via the  Internet or phone, providing mobile devices for field enumerators to  collect survey data from households, and automating the management of  field operations. This redesign relies on acquiring and developing many  new and modified IT systems, which could add complexity to the design.
These cost risks, new innovations, and acquisition and development of IT  systems for the 2020 Census, along with other challenges we have  identified in recent years, raise serious concerns about the Bureau’s  ability to conduct a cost-effective enumeration. Based on these concerns,  we have concluded that the 2020 Census is a high-risk area and have  added it to the High-Risk List in 2017.
subsections: section_title: What Needs to Be Done
paragraphs: To help the Bureau mitigate the risks associated with its fundamentally  new and complex innovations for the 2020 Census, the commitment of  top leadership is needed to ensure the Bureau’s management, culture,  and business practices align with a cost-effective enumeration. For  example, the Bureau needs to continue strategic workforce planning  efforts to ensure it has the skills and competencies needed to support  planning and executing the census. It must also rigorously test individual  census-taking activities to provide information on their feasibility and  performance, their potential for achieving desired results, and the extent  to which they are able to function together under full operational  conditions.
We have recommended that the Bureau also ensure that its scheduling  adheres to leading practices and be able to support a quantitative  schedule risk assessment, such as by having all activities associated with  the levels of resources and effort needed to complete them. The Bureau  has stated that it has begun maturing project schedules to ensure that the  logical relationships are in place and plans to conduct a quantitative risk  assessment. We will continue to monitor the Bureau’s efforts.
The Bureau must also improve its ability to manage, develop, and secure  its IT systems. For example, the Bureau needs to prioritize its IT  decisions and determine what information it needs in order to make those  decisions. In addition, the Bureau needs to make key IT decisions for the  2020 Census in order to ensure they have enough time to have the  production systems in place to support the end-to-end system test. To  this end, we recommended the Bureau ensure that the methodologies for  answering the Internet response rate and IT infrastructure research  questions are determined and documented in time to inform key design  decisions. Further, given the numerous and critical dependencies  between the Census Enterprise Data Collection and Processing and 2020  Census programs, their parallel implementation tracks, and the 2020  Census’s immovable deadline, we recommended that the Bureau  establish a comprehensive and integrated list of all interdependent risks  facing the two programs, and clearly identify roles and responsibilities for  managing this list. The Bureau stated that it plans to take actions to  address our recommendations.
It is also critical for the Bureau to have better oversight and control over  its cost estimation process and we have recommended that the Bureau  ensure its cost estimate is consistent with our leading practices. For  example, the Bureau will need to, among other practices, document all  cost-influencing assumptions; describe estimating methodologies used for  each cost element; ensure that variances between planned and actual  cost are documented, explained, and reviewed; and include a  comprehensive sensitivity analysis, so that it can better estimate costs.  We also recommended that the Bureau implement and institutionalize  processes or methods for ensuring control over how risk and uncertainty  are accounted for and communicated within its cost estimation process.  The Bureau agreed with our recommendations, and we are currently  conducting a follow-up audit of the Bureau’s most recent cost estimate  and will determine whether the Bureau has implemented them.
Sustained congressional oversight will be essential as well. In 2015 and  2016, congressional committees held five hearings focusing on the  progress of the Bureau’s preparations for the decennial. Going forward,  active oversight will be needed to ensure these efforts stay on track, the  Bureau has needed resources, and Bureau officials are held accountable  for implementing the enumeration as planned.
We will continue monitoring the Bureau’s efforts to conduct a cost- effective enumeration. To this end, we have ongoing work focusing on  such topics as the Bureau’s updated lifecycle cost estimate and the  readiness of IT systems for the 2018 End-to-End Test.
See pages 219 – 231 for additional details on what we found.
section_title: Monitoring Previous High-Risk Areas
paragraphs: After we remove areas from the High-Risk List we continue to monitor  them, as appropriate, to determine if the improvements we have noted  are sustained and whether new issues emerge. If significant problems  again arise, we will consider reapplying the high-risk designation. DOD’s  Personnel Security Clearance Program is one former high-risk area that  we continue to closely monitor in light of government-wide reform efforts.
subsections: section_title: Personnel Security Clearances
paragraphs: The Office of the Director of National Intelligence (ODNI) estimates that  approximately 4.2 million federal government and contractor employees  held or were eligible to hold a security clearance as of October 1, 2015.  Personnel security clearances provide personnel with access to classified  information, the unauthorized disclosure of which could, in certain  circumstances, cause exceptionally grave damage to national security.  High profile security incidents, such as the disclosure of classified  programs and documents by a National Security Agency contractor and  the OPM data breach of 21.5 million records, demonstrate the continued  need for high-quality background investigations and adjudications, strong  oversight, and a secure IT process, which have been areas of long- standing challenges for the federal government.
In 2005, we designated the DOD personnel security clearance program  as a high-risk area because of delays in completing background  investigations and adjudications. We continued the high-risk designation  in the 2007 and 2009 updates to our High-Risk List because of issues  with the quality of investigation and adjudication documentation, and  because delays in the timely processing of security clearances  continued.
In our 2011 high-risk report, we removed DOD’s personnel security  clearance program from the High-Risk List because DOD took actions to  develop guidance to improve its adjudication process, develop and  implement tools and metrics to assess quality of investigations and  adjudications, and improve timeliness for processing clearances. We  also noted that DOD continues to be a prominent player in the overall  security clearance reform effort, which includes entities within the OMB,  OPM, and ODNI that comprise the Performance Accountability Council  (PAC) which oversees security clearance reform. The executive branch  has also taken steps to monitor its security clearance reform efforts. The  GPRA Modernization Act of 2010 requires OMB to report through a  website—performance.gov—on long-term cross-agency priority goals,  which are outcome-oriented goals covering a limited number of  crosscutting policy areas, as well as goals to improve management  across the federal government. Among the cross-agency priority goals,  the executive branch identified security clearance reform as one of the  key areas it is monitoring.
Since removing DOD’s personnel security clearance program from the  High-Risk List, the government’s overall reform efforts that began after  passage of the Intelligence Reform and Terrorism Prevention Act of 2004  have had mixed progress, and key reform efforts have not yet been  implemented. In the aftermath of the June 2013 disclosure of classified  documents by a former National Security Agency contractor and the  September 2013 shooting at the Washington Navy Yard, OMB issued, in  February 2014, the Suitability and Security Processes Review Report to  the President, a 120-day review of the government’s processes for  granting security clearances, among other things.
The 120-day review resulted in 37 recommendations, 65 percent of which  have been implemented as of October 2016, including the issuance of  executive branch-wide quality assessment standards for investigations in  January 2015. Additionally, the recommendations led to expanding  DOD’s ability to continuously evaluate the continued eligibility of cleared  personnel. However, other recommendations from the 120-day review  have not yet been implemented. For example, the reform effort is still  trying to fully implement the revised background investigation standards  issued in 2012 and improve data sharing between local, state, and federal  entities.
In addition, the 120-day review further found that performance measures  for investigative quality are neither standardized nor implemented  consistently across the government, and that measuring and ensuring  quality continues to be a challenge. The review contained three  recommendations to address the development of quality metrics, but the  PAC has only partially implemented those recommendations. We  previously reported that the executive branch had developed some  metrics to assess quality at different phases of the personnel security  clearance process; however, those metrics had not been fully developed  and implemented.
The development of metrics to assess quality throughout the security  clearance process has been a long-standing concern. Since the late  1990s we have emphasized the need to build and monitor quality  throughout the personnel security clearance process. In 2009, we again  noted that clearly defined quality metrics can improve the security  clearance process by enhancing oversight of the time required to process  security clearances and the quality of the investigation and adjudicative  decisions. We recommended that OMB provide Congress with results of  metrics on comprehensive timeliness and the quality of investigations and  adjudications. According to ODNI, in October 2016, ODNI began  implementation of a Quality Assessment and Reporting Tool to document  customer issues with background investigations. The tool will be used to  report on the quality of 5 percent of each executive branch agency’s  background investigations.
ODNI officials stated that they plan to develop metrics in the future as  data are gathered from the tool, but did not identify a completion date for  these metrics. Separately, the NDAA for Fiscal Year 2017, among other  things, requires DOD to institute a program to collect and maintain data  and metrics on the background investigation process, in the context of  developing a system for performance of background investigations. The  PAC’s effort to fully address the 120-day review and our  recommendations on establishing metrics on the quality of investigations  as well as DOD’s efforts to address the broader requirements in the  NDAA for Fiscal Year 2017 remain open and will need to be a continued  focus of the department moving forward in its effort to improve its  management of the security clearance process.
Further, in response to the 2015 OPM data breach, the PAC completed a  90-day review which led to an executive order establishing the National  Background Investigations Bureau, within OPM, to replace the Federal  Investigative Services and transferred responsibility to develop, maintain  and secure new IT systems for clearances to DOD. Additionally, the  Executive Order made DOD a full principal member of the PAC. The  Executive Order also directed the PAC to review authorities, roles, and  responsibilities, including submitting recommendations related to revising,  as appropriate, executive orders pertaining to security clearances. This  effort is ongoing.
In addition to addressing the quality of security clearances and other  goals and recommendations outlined in the 120-day and 90-day reviews,  and the government’s cross-agency priority goals, the PAC has the added  challenge of addressing recent changes that may result from the NDAA  for Fiscal Year 2017. Specifically, section 951 of the Act requires the  Secretary of Defense to develop an implementation plan for the Defense  Security Service to conduct background investigations for certain DOD  personnel—presently conducted by OPM—after October 1, 2017. The  Secretary of Defense must submit the plan to the congressional defense  committees by August 1, 2017. It also requires the Secretary of Defense  and Director of OPM to develop a plan by October 1, 2017, to transfer  investigative personnel and contracted resources to DOD in proportion to  the workload if the plan for DOD to conduct the background investigations  were implemented. It is unknown if these potential changes will impact  recent clearance reform efforts.
Given the history and inherent challenges of reforming the government- wide security clearance process, coupled with recent amendments to a  governing Executive Order and potential changes arising from the NDAA  for Fiscal Year 2017, we will continue reviewing critical functions for  personnel security clearance reform and monitor the government’s  implementation of key reform efforts. We have ongoing work assessing  progress being made on the overall security clearance reform effort and  in implementing a continuous evaluation process, a key reform effort  considered important to improving the timeliness and quality of  investigations. We anticipate issuing a report on the status of the  government’s continuous evaluation process in the fall of 2017.  Additionally, we have previously reported on the importance of securing  federal IT systems and anticipate issuing a report in early 2017 that  examines IT security at OPM and efforts to secure these types of critical  systems. Continued progress in reforming personnel security clearances  is essential in helping to ensure a federal workforce entrusted to protect  U.S. government information and property, promote a safe and secure  work environment, and enhance the U.S. government’s risk management  approach.
The high-risk assessment continues to be a top priority and we will  maintain our emphasis on identifying high-risk issues across government  and on providing insights and sustained attention to help address them,  by working collaboratively with Congress, agency leaders, and OMB. As  part of this effort, with the new administration and Congress in 2017 we  hope to continue to participate in regular meetings with the incoming  OMB Deputy Director for Management and with top agency officials to  discuss progress in addressing high-risk areas. Such efforts have been  critical for the progress that has been made.
This high-risk update is intended to help inform the oversight agenda for  the 115th Congress and to guide efforts of the administration and  agencies to improve government performance and reduce waste and  risks. We are providing this update to the President and Vice President,  congressional leadership, other Members of Congress, OMB, and the  heads of major departments and agencies.
section_title: Appendix I: Background
subsections: section_title: What Is the History of the High-Risk Program?
paragraphs: In 1990, we began a program to report on government operations that we  identified as “high risk.” Since then, generally coinciding with the start of  each new Congress, we have reported on the status of progress  addressing high-risk areas and have updated the High-Risk List. Our  most recent high-risk update was in February 2015. That update  identified 32 high-risk areas.
Overall, this program has served to identify and help resolve serious  weaknesses in areas that involve substantial resources and provide  critical services to the public. Since our program began, the federal  government has taken high-risk problems seriously and has made long- needed progress toward correcting them. In a number of cases, progress  has been sufficient for us to remove the high-risk designation. A summary  of changes to our High-Risk List over the past 27 years is shown in table  3. This 2017 update identifies 34 high-risk areas.
section_title: What Are the Criteria for Being Added to the High- Risk List?
paragraphs: To determine which federal government programs and functions should  be designated high risk, we use our guidance document, Determining  Performance and Accountability Challenges and High Risks. In making  this determination, we consider whether the program or function is of  national significance or is key to performance and accountability.
Further, we consider qualitative factors, such as whether the risk  involves public health or safety, service delivery, national security,  national defense, economic growth, or privacy or citizens’ rights, or  could result in significantly impaired service, program failure, injury or  loss of life, or significantly reduced economy, efficiency, or  effectiveness.
We also consider the exposure to loss in monetary or other quantitative  terms. At a minimum, $1 billion must be at risk, in areas such as the value  of major assets being impaired; revenue sources not being realized;  major agency assets being lost, stolen, damaged, wasted, or  underutilized; potential for, or evidence of improper payments; and  presence of contingencies or potential liabilities.
Before making a high-risk designation, we also consider corrective  measures planned or under way to resolve a material control weakness  and the status and effectiveness of these actions.
section_title: What Are the Criteria for Removal from the High- Risk List?
paragraphs: Our experience has shown that the key elements needed to make  progress in high-risk areas are top-level attention by the administration  and agency leaders grounded in the five criteria for removal from the  High-Risk List, as well as any needed congressional action. The five  criteria for removal that we issued in November 2000 are as follows:
Leadership Commitment. Demonstrated strong commitment and top  leadership support.
Capacity. Agency has the capacity (i.e., people and resources) to  resolve the risk(s).
Action Plan. A corrective action plan exists that defines the root  cause, solutions, and provides for substantially completing corrective  measures, including steps necessary to implement solutions we  recommended.
Monitoring. A program has been instituted to monitor and  independently validate the effectiveness and sustainability of  corrective measures.
Demonstrated Progress. Ability to demonstrate progress in  implementing corrective measures and in resolving the high-risk area.
section_title: How Can Agencies Use the Criteria to Make Progress on High-Risk Issues?
paragraphs: The five criteria form a road map for efforts to improve and ultimately  address high-risk issues. Addressing some of the criteria leads to  progress, while satisfying all of the criteria is central to removal from the  list. Our April 2016 report provided additional information drawn from our  2015 high-risk update on how agencies had made progress addressing  high-risk issues. We provided illustrative actions that agencies took that  led to progress or removal from our High-Risk List. This information  provides additional guidance to agencies whose programs are on the  High-Risk List.
Figure 4 shows the five criteria and illustrative actions taken by agencies  to address the criteria as cited in that report. Importantly, the actions  listed are not “stand alone” efforts taken in isolation from other actions to  address high-risk issues. That is, actions taken under one criterion may  be important to meeting other criteria as well. For example, top leadership  can demonstrate its commitment by establishing a corrective action plan  including long-term priorities and goals to address the high-risk issue and  using data to gauge progress—actions which are also vital to monitoring  criteria.
section_title: How Are High-Risk Areas Rated?
paragraphs: In each of our high-risk updates, for more than a decade, we have  assessed progress to address the five criteria for removing a high-risk  area from the list. In our 2015 update, we added clarity and specificity to  our assessments by rating each high-risk area’s progress on the criteria  and used the following definitions:
Met. Actions have been taken that meet the criterion. There are no  significant actions that need to be taken to further address this  criterion.
Partially Met. Some, but not all, actions necessary to meet the  criterion have been taken.
Not Met. Few, if any, actions towards meeting the criterion have been  taken.
Figure 5 shows a visual representation of varying degrees of progress in  each of the five criteria for a high-risk area. Each point of the star  represents one of the five criteria for removal from the High-Risk List and  each ring represents one of the three designations: not met, partially met,  or met. An unshaded point at the innermost ring means that the criterion  has not been met, a partially shaded point at the middle ring means that  the criterion has been partially met, and a fully shaded point at the  outermost ring means that the criterion has been met.
Further, a plus symbol inside the star indicates the rating for that criteria  progressed since our last high-risk update in 2015. Likewise, a minus  symbol inside the star indicates the rating for that criteria declined since  our last update. At the bottom of the star graphic are summary statements  showing the number of criteria that have been met as well as the number  that progressed, declined, or both since the 2015 high-risk update.
Some high-risk areas are comprised of segments or subareas that make  up the overall high-risk area. For example, the high-risk area  Transforming EPA’s Process for Assessing Toxic Chemicals includes two  segments—EPA’s Integrated Risk Information System and the Toxic  Substances Control Act—to reflect two interrelated parts of the overall  high-risk area. Multidimensional high-risk areas such as these have  separate ratings for each segment as well as a summary rating of the  overall high-risk area that reflects a composite of the ratings received  under the segment for each of the five high-risk criteria.
section_title: What Is the History of Programs Removed from the High-Risk List?
paragraphs: A summary of areas removed from our High-Risk List over the past 27  years is shown in figure 6.
section_title: When Were Areas Added to the High-Risk List?
paragraphs: The areas on our 2017 High-Risk List, and the year each was designated  as high risk, are shown in table 4.
section_title: Appendix II: Overview for Each High-Risk Area
paragraphs: The following pages provide overviews of the 34 high-risk areas on our  updated list. Each overview discusses (1) why the area is high risk, (2)  the actions that have been taken and that are under way to address the  problem since our last update in 2015, and (3) what remains to be done.  Each of these high-risk areas is also described on our High-Risk List  website, http://www.gao.gov/highrisk/overview. We also provide additional  details on the one area that was removed from the High-Risk List in 2017.
section_title: Strategic Human Capital Management
subsections: section_title: Why Area Is High Risk
paragraphs: Since we last reported on government-wide efforts to address skills gaps,  the Office of Personnel Management (OPM), the Chief Human Capital  Officers (CHCO) Council, and individual agencies have strengthened  their leadership over this area; however, OPM and agencies have only  partially met the criteria for removal from the High-Risk List. Mission- critical skills gaps within the federal workforce pose a high risk to the  nation. Regardless of whether the shortfalls are in such government-wide  occupations as cybersecurity and acquisitions, or in agency-specific  occupations such as nurses at the Veterans Health Administration (VHA),  skills gaps impede the federal government from cost-effectively serving  the public and achieving results. Agencies can have skills gaps for  different reasons: they may have an insufficient number of people or their  people may not have the appropriate skills or abilities to accomplish  mission-critical work. Moreover, current budget and long-term fiscal  pressures, the changing nature of federal work, and a potential wave of  employee retirements that could produce gaps in leadership and  institutional knowledge, threaten to aggravate the problems created by  existing skills gaps. Indeed, the government’s capacity to address  complex challenges such as disaster response, national and homeland  security, and rapidly-evolving technology and privacy security issues  requires a skilled federal workforce able to work seamlessly with other  agencies, with other levels of government, and across sectors.
We first added strategic human capital management to the High-Risk List  in 2001. In our 2015 update, we noted that while OPM and agencies had  made strides in developing an infrastructure for identifying and  addressing skills gaps, they needed to do additional work to more fully  use workforce analytics to identify their gaps, implement specific  strategies to address these gaps, and evaluate the results of actions  taken so as to demonstrate progress in closing the gaps. Mission critical  skills gaps were also a factor in making other areas across government  high risk. Of the 34 other high-risk areas covered in this report, 15  areas—such as IT management, acquisitions, and management of oil and  gas resources—had skills gaps playing a contributory role.
section_title: What GAO Found
paragraphs: Since we last reported on government-wide efforts to address skills gaps,  OPM, the CHCO Council, and individual agencies have strengthened  their leadership over this area, including establishing a new human capital  framework to guide their efforts. In doing so, they have (1) taken  important steps to institutionalize efforts to close skills gaps and (2)  enhanced the analytical method used to identify skills gaps. However,  OPM and agencies have only partially met the criteria for removal from  the High-Risk List for developing the capacity to close skills gaps,  designing and implementing action plan strategies for closing skills gaps,  and monitoring efforts to close existing skills gaps as well as identify  emerging ones. Additionally, OPM and agencies have not yet  demonstrated sustainable progress in closing skills gaps.
To date, Congress has provided agencies with authorities and flexibilities  to manage the federal workforce and make the federal government a  more accountable employer. For example, Congress included a provision  in the National Defense Authorization Act for Fiscal Year 2016 to extend  the probationary period for newly hired civilian Department of Defense  (DOD) employees from 1 year to 2 years. As we noted in our 2015  report, better use of probationary periods gives agencies the ability to  ensure an employee’s skills are a good fit for all critical areas of a  particular job. Dismissing employees who cannot do the work becomes  more difficult and time consuming after the probationary period because  of the procedural requirements agencies must follow and the greater  appeal rights afforded.
Further, oversight hearings held by the House and Senate focusing on  federal human capital management challenges have been important for  ensuring that OPM and agencies continue to make progress in acquiring,  developing, and retaining employees with the skills needed to carry out  the government’s vital work.
section_title: What Remains to Be Done
paragraphs: OPM and agencies can continue taking actions to address skills gaps  with respect to capacity, action plan, monitoring, and demonstrated  progress. In particular, we have identified several priority  recommendations to OPM, in its role as leader for human capital  management in the federal government:
OPM needs to strengthen the approach and methodology for  addressing skills gaps by working with agencies to develop targets  that are clear, measurable, and outcome-oriented.
OPM needs to establish a schedule specifying when it will modify its  EHRI database to collect staffing data, in concert with agency  CHCOs, and needs to help bolster agencies’ ability to assess  workforce competencies, either by sharing competency surveys,  disseminating lessons learned, or by other means.
OPM, in consultation with the CHCO Council, should develop a core  set of human capital metrics that agencies can use to monitor  progress in closing skills gaps through HRstat reviews, and OPM  should ensure that these efforts are coordinated with other agency  skills gap initiatives.
Individual agencies must also take steps to address skills gaps identified  in our prior work. For example, we recommended that the Department of  Veterans Affairs (VA) institute a system-wide evaluation of the initiatives  to recruit and retain VHA nurses. Doing so could provide VHA with better  data to identify resource needs across its medical centers and ensure that  its nursing workforce is keeping pace with the health care needs of  veterans. VA agreed with our recommendation and indicated in August  2016 that it had formed a working group that is charged with reporting on  observations from data on recruitment and retention effectiveness by  October 2017.
Continued congressional attention to improving the government’s human  capital policies and procedures will be essential going forward. For  example, in our August 2016 report, to help improve the federal hiring  process, we recommended that OPM assess the effectiveness of  government hiring authorities to determine whether opportunities exist to  refine, consolidate, eliminate, or expand them. In cases where legislation  would be necessary to implement changes, we recommended that OPM  should work with the CHCO Council to develop legislative proposals.  OPM concurred with this recommendation and said it would work with the  CHCO Council and others to develop proposals as appropriate.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: OPM and agencies have fully met the leadership criterion for removal  from the High-Risk List. In December 2016, OPM finalized revisions to its  strategic human capital management regulation that include the new  Human Capital Framework. This framework is to be used by agencies to  plan, implement, evaluate, and improve human capital policies and  programs. Additionally, the revised regulation provides that agency  human capital policies and programs must monitor and address skills  gaps within government-wide and agency-specific mission-critical  occupations by using comprehensive data analytic methods and gap  closure strategies. The revised regulation also requires that agency  leadership participate in a quarterly, data-driven review process known as  HRstat, which, as we reported in 2015, could be an important tool in  reviewing key performance metrics related to closing skills gaps.
OPM and the CHCO Council also improved the method that agencies use  to identify mission-critical occupations with skills gaps, in response to our  recommendation. We previously reviewed the CHCO Council’s 2011- 2012 efforts to identify skills gaps. We reported that those efforts lacked a  quantitative grounding and the CHCO Council did not use workforce  analytics, such as employee attrition rates, until after it had already  selected an initial set of occupations based on qualitative methods. In  2015, OPM and the CHCO Council worked with agencies to refine their  inventory of government-wide and agency-specific skills gaps. They  narrowed the scope for identifying skills gaps by using a quantitative  multi-factor model—which included the 2-year retention rate, the quit rate,  retirement rate, and average manager satisfaction with applicant quality.  Using this model, OPM, the CHCO Council, and agencies identified six  government-wide occupational areas with mission-critical skills gaps:
Human Resources Specialist;
The Science, Technology, Engineering, and Mathematics (STEM)  functional area.
OPM and the CHCO Council asked individual agencies to use the same  process to identify 2 to 3 occupations within their own agency, resulting in  48 unique occupations with agency-specific skills gaps among the 24  Chief Financial Officers Act agencies.
OPM also worked with the Office of Management and Budget (OMB) to  issue guidance in November 2016 that outlined three broad objectives  and seven practices agencies should use to achieve excellence in  hiring. As part of OPM’s People and Culture Cross-Agency Priority goal,  this memorandum encouraged agencies to, among other things, use data  to inform workforce planning and strategic recruitment—as well as fully  leverage relevant hiring authorities—consistent with our prior  recommendations.
With these actions, OPM, the CHCO Council, and agencies have built a  framework to address skills gaps. It will be important for OPM to sustain  this leadership commitment through budgetary challenges and the  transition to a new administration so that institutional gains are not lost.
section_title: Capacity
paragraphs: OPM and agencies have partially met this criterion. After agencies  identified sets of occupations with skills gaps, OPM and the CHCO  Council worked with the agencies to establish working groups of  occupational leaders and CHCO representatives—known as Federal  Agency Skills Teams (FAST). According to OPM, the FASTs are to  analyze root causes, develop strategies to address skills gaps through  action plans, and monitor progress in closing skills gaps within each  occupation. Beginning in January 2017, each FAST for both government- wide and agency-specific skills gaps is to report quarterly to OPM on  progress and ensure that action plan strategies and performance metrics  are aligned with the root cause analyses performed by the FASTs. These  institutional resources can help sustain efforts to address skills gaps  going forward.
OPM has made less progress on other aspects of capacity building. For  example, OPM has not finalized efforts to centralize collection of agency  staffing data that could be used to detect emerging skills gaps. OPM  officials have reported that modifying the Enterprise Human Resources  Integration (EHRI) database to perform this function may not be feasible.  Moreover, OPM officials reported that they were still working with  stakeholders to develop a framework to assist agencies in assessing  competencies. We reported, in 2015, that agencies vary in the extent to  which they assess competencies, and thus some agencies have limited  ability to respond to external workforce planning factors, despite the  importance of conducting these assessments. Without more rigorous data collection across government on the number and skills of people  filling mission-critical occupations, OPM and agencies may be unable to  build the predictive capacity to identify and address emerging skills gaps.
section_title: Action Plan
paragraphs: OPM and agencies have partially met this criterion. Working with the  CHCO Council, OPM designed an action plan template that agency  FASTs are to use as a model. In reviewing past efforts to address skills  gaps, we found that agencies’ planning documents did not always adhere  to best practices for project planning. We found that some plans did not  consistently identify the root causes of the skills gaps, assign roles and  responsibilities for implementing actions, or develop and use outcome- oriented performance metrics. OPM and the CHCO Council included all  of these practices in their most recent template, which asks each agency  FAST to identify key actions, responsible parties for those actions,  milestones, time frames, and performance metrics for monitoring  progress and skills gap risk reduction and closure. Moreover, the  template asks FASTs to explain how the actions discussed in the  document relate to the root cause of that skills gap. Going forward, OPM  and the CHCO Council will need to ensure that agencies and their FASTs  use the template appropriately and incorporate the best practices into  their action plans.
OPM has yet to show, however, whether agencies are consistently  adopting these practices in their action plans. As of the end of 2016, nine  agencies had not submitted action plans for closing skills gaps. OPM  officials noted that they are still working with agencies on the submission  of the outstanding plans.
section_title: Monitoring
paragraphs: OPM and agencies have partially met this criterion. Agencies can take a  number of actions to meet the monitoring criterion for removal from the  High-Risk List, such as (1) holding frequent review meetings to assess  status and performance, (2) reporting to senior managers on program  progress and potential risks, and (3) tracking progress against goals. As  noted, OPM’s revisions to its strategic human capital management  regulations will require agency leadership to participate in quarterly, data- driven HRstat review sessions, and beginning in 2017 each FAST is to  report quarterly to OPM and show that action plan strategies are aligned  with monitored performance metrics. Together, these two actions could  help ensure that skills gaps receive the visibility and attention of senior  managers—as well as the accountability that comes from presenting  quarterly results—that have been applied to other human capital  challenges such as improving employee engagement.
However, OPM could do more to assist agencies in developing consistent  practices for HRstat and to improve the visibility of skills gaps to  managers. In 2015, we recommended that OPM work with the CHCO  Council to develop a core set of metrics that agencies should use in  HRstat to track common skills gap challenges, while still allowing  agencies discretion to include metrics that meet their specific needs. In  response to our recommendation, OPM officials stated that they consider  HRstat an agency-centric initiative and that, while OPM has no plans to  prescribe a core set of skills gap metrics that all agencies must use for  HRstat, OPM may recommend metrics for each type of skills gap  challenge (e.g., training, recruitment, staffing, or competency  assessments) that an agency may encounter. OPM has, however, used  its November 2016 guidance to recommend specific metrics to be tracked  in HRstat that are tailored to improving hiring practices. We maintain  that this practice should be applied to skills gaps in general and that an  appropriate core set of metrics would be beneficial because it would (1)  help ensure agencies were monitoring skills gaps with a consistent set of  robust metrics, (2) provide OPM and Congress greater visibility over  government-wide progress in addressing skills gaps, and (3) help OPM  and agencies target government-wide actions toward those areas where  progress is lagging across agencies.
OPM officials have also said that they have no plans to require agencies  to integrate the work of their FASTs with their HRstat reviews. OPM  officials again cited deference to agencies on identifying the most  appropriate metrics to use for their HRstat reviews. The quarterly  reporting mechanism that OPM has instituted with each agency FAST  could be an effective monitoring tool going forward; however, requiring  agencies to routinely monitor skills gap metrics as part of the mandatory  HRstat reviews could increase the visibility and urgency of skills gaps for  top agency management.
section_title: Demonstrated Progress
paragraphs: OPM and agencies have not met this criterion because at present there  are no government-wide targets or goals for closing skills gaps, and  agencies are not reporting progress. In our 2015 review we reported that  government-wide goals to close skills gaps lacked clarity and  measurability. OPM previously had a Cross Agency Priority (CAP) goal to  close skills gaps by 50 percent in at least 3 of the government-wide  mission-critical occupations by the end of fiscal year 2013. The CAP Goal  on skills gaps provided important visibility across the government.  Following the expiration of this CAP Goal, the Fiscal Year 2015 Budget  included a 4-year CAP Goal on People and Culture that included  workforce planning elements related to skills gaps but had no  government-wide performance targets for closing skills gaps. Currently  there are no government-wide goals regarding skills gaps that have the  same visibility that the prior CAP Goal provided. As a result, it is unclear  what would be the appropriate yardstick for closing skills gaps across the  government.
OPM and agencies also have not reached the stage of reporting progress  on strategies to close skills gaps. As part of the multi-year process OPM  and the CHCO Council have developed with agency FASTs, OPM  expects to see agencies reporting progress according to their  performance metrics by September 2017. As noted above, not all  agencies have even drafted action plans with performance metrics as of  December 2016.
Strengthening agencies’ abilities to identify and close skills gaps is critical  because they can affect mission accomplishment across the government.  Since our 2015 high-risk report, we have published over two dozen  additional reports with findings related to skills gaps. Additionally, as  noted above, 15 other sections in this report feature discussions related  to skills gaps. Included in the examples below are issues found elsewhere  in the 2017 high-risk report.
Information Technology (IT) Workforce. We have underscored IT  skills gaps in prior high-risk reports, and elements of the IT workforce–  particularly cybersecurity– have been highlighted in OPM’s skills gap  efforts since 2011. Challenges remain in this area. In November 2016,  we reported that five selected agencies had not consistently applied  key workforce planning steps and activities that help to ensure that  program staff members have the knowledge and skills critical to  successfully acquire IT investments. Moreover, we reported in April  2016 that the Federal Emergency Management Agency (FEMA) had  not established time frames for completing its workforce planning  activities and lacked an understanding of its regional IT workforce.  In particular, FEMA’s 2014 competency assessment only covered part  of its IT workforce, and multiple regional offices told us that they faced  shortages in IT staff, such as computer and network engineers.  Without a better understanding of its current IT workforce, FEMA will  be unable to address its workforce planning needs and may not have  the skills needed to respond to major disasters. The Department of  Homeland Security (DHS) concurred in April 2016 with our  recommendation to establish time frames for current and future  workforce planning, and we will verify these efforts going forward. See  Improving the Management of IT Acquisitions and Operations on page  180 for more information.
Acquisition Management. Agencies have continued to face  challenges in hiring sufficient staff and in monitoring the competencies  of its workforce in acquisitions, an area we have highlighted in prior  high-risk reports. For instance, DHS’s 2016 staffing assessments did  not take into account all acquisition-related positions, potentially  limiting DHS’s insight into the size and nature of potential staffing  shortfalls. DHS announced plans in December 2016 to pilot new  staffing assessment guidance to be more inclusive of acquisition  positions, but the timing of full implementation is not yet known.  Additionally, in December 2015, we found that while DOD has  assessed workforce competencies for nearly all of its 13 career  acquisition fields, the agency has not established a timeline for  reassessing competencies in 10 of those fields to gauge progress  addressing previously identified gaps. Officials agreed with our  recommendation to work with functional leaders in setting timeframes  for completing future career field competency assessments and,  according to an October 2016 workforce strategic plan, intend to  conduct career field competency assessments at a minimum of every  5 years. Doing so will better allow the agency to track improvements  in the capability of a workforce that oversaw $273.5 billion in contracts  for goods and services in fiscal year 2015. See Strengthening  Department of Homeland Security Management Functions on page  354 and DOD Contract Management on page 483 for more  information.
Oil and Gas Management. In 2014, we recommended that The  Department of the Interior (Interior) should collect data on hiring times  and explore the expanded use of existing authorities to retain key oil  and gas oversight positions, such as petroleum engineers, geologists,  and geophysicists. In September 2016, we found that Interior  continued to face challenges hiring and retaining staff for these  positions and has taken steps to address low salaries and lengthy  hiring times for certain occupations but has not evaluated the  effectiveness of such measures. Moreover, Interior has not  evaluated training needs or the effectiveness of existing training and  has not promoted collaboration across its bureaus to discuss and  address shared hiring and retention challenges. We recommended  that Interior take steps to evaluate its training programs and promote  cross-bureau hiring collaboration. In response to our  recommendations, Interior officials indicated that their Office of Policy,  Management, and Budget would monitor cross-bureau collaboration  on a range of issues including hiring, retention, and training through  ongoing quarterly performance reviews and that Interior’s bureaus  would coordinate their training needs. See Management of Federal Oil  and Gas Resources on page 136 for more information.
Veterans Health Administration (VHA) Human Resources  Personnel. In our December 2016 report on VHA’s human resources  (HR) capacity, we recommended that VHA (1) develop its own  comprehensive competency assessment tool for HR staff that  evaluates knowledge of all three of VHA’s personnel systems and (2)  ensure that all VHA HR staff complete it so that VHA may use the  data to identify and address competency gaps among medical center  HR staff. Without such a tool, VHA will have limited insights into the  abilities of its HR staff and be ill-positioned to provide necessary  support and training. The Department of Veterans Affairs (VA) agreed  with both recommendations and indicated it has realigned its HR  training office to ensure that a comprehensive competency  assessment tool be developed and implemented. See Managing  Risks and Improving VA Health Care on page 627 for more  information.
Oversight of Medical Products. As part of our December 2016  report, we found that vacancies at foreign Food and Drug  Administration (FDA) offices persist. As of July 2016, 46 percent of  foreign offices’ authorized positions, including those covering staff  conducting medical product investigations, were vacant, and we found  that FDA still faces challenges in recruiting staff to these positions.  While FDA has set a goal for reducing this vacancy rate, the  performance measure selected to track progress on this goal includes  both foreign and domestic staff in FDA’s Office of International  Programs. FDA could thus fulfill its overall vacancy goal without  lowering vacancies in foreign offices. The Department of Health and  Human Services (HHS) agreed with our December 2016  recommendation to establish staffing goals by position type at foreign  offices, and FDA indicated that recruiting and hiring have long been  challenges at these offices. We will monitor future developments in  FDA’s foreign inspection staffing. See Protecting Public Health  through Enhanced Oversight of Medical Products on page 400 for  more information.
In addition, our work published since the 2015 high-risk report has  identified additional skills gaps that will require agencies’ attention  because of their operational impact. For example, we reported in October  2015 that the Small Business Administration (SBA) did not have an up-to- date agency-wide competency assessment. Officials said that when  SBA centralized its loan processing functions—and thus removed these  functions from the agency’s district offices—as part of a 2004  reorganization, district offices had to take on new responsibilities, and  certain staff no longer had skills that matched their day-to-day work. For  example, employees with financial backgrounds—needed to process  loans—were now asked to perform marketing and business development  tasks. SBA also noted that the skills gap had been compounded by recent  changes in job requirements and new initiatives that required new skill  sets for its employees. SBA agreed with our recommendation to complete  a workforce plan that includes a competency and skills gap assessment,  and in October 2016 SBA indicated it had finalized such an assessment  and would be incorporating it into its strategic workforce planning  process.
Going forward, agencies will need to continue to monitor these and other  existing and newly emerging skills gap challenges. Managing these  challenges is especially important because, as we have reported  previously, agencies are facing a wave of potential retirements, as figure  7 shows. According to OPM data, government-wide over 34 percent of  federal employees on board by the end of fiscal year 2015 will be eligible  to retire by 2020. Some agencies, such as the Department of Housing  and Urban Development, will have particularly high eligibility levels by  2020.
Various factors can affect when individuals actually retire, and some  amount of retirement and other forms of attrition can be beneficial  because it creates opportunities to bring fresh skills on board and it allows  organizations to restructure themselves to better meet program goals and  fiscal realities. But if turnover is not strategically monitored and managed,  gaps can develop in an organization’s institutional knowledge and  leadership.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Robert  Goldenkoff at 202-512-6806 or GoldenkoffR@gao.gov or Yvonne Jones  at 202-512-6806 or JonesY@gao.gov.
section_title: Related GAO Products
paragraphs: Veterans Health Administration: Management Attention Is Needed to  Address Systemic, Long-standing Human Capital Challenges.  GAO-17-30. Washington, D.C.: December 23, 2016.
Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but  Needs to Assess the Effectiveness and Staffing of Its Foreign Offices.  GAO-17-143. Washington, D.C.: December 16, 2016.
IT Workforce: Key Practices Help Ensure Strong Integrated Program  Teams; Selected Departments Need to Assess Skill Gaps. GAO-17-8.  Washington, D.C.: November 30, 2016.
Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring,  Retention, and Training but Needs a More Evaluative and Collaborative  Approach. GAO-16-742. Washington, D.C.: September 29, 2016.
Aviation Security: TSA Should Ensure Testing Data Are Complete and  Fully Used to Improve Screener Training and Operations. GAO-16-704.  Washington, D.C.: September 7, 2016.
Federal Hiring: OPM Needs to Improve Management and Oversight of  Hiring Authorities. GAO-16-521. Washington, D.C.: August 2, 2016.
Information Technology: FEMA Needs to Address Management  Weaknesses to Improve Its Systems. GAO-16-306. Washington, D.C.:  April 5, 2016.
Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts  and Improve Workforce Capability. GAO-16-80. Washington, D.C.:  December 14, 2015.
VA Health Care: Oversight Improvements Needed for Nurse Recruitment  and Retention Initiatives. GAO-15-794. Washington, D.C.: October 30,  2015.
Small Business Administration: Leadership Attention Needed to  Overcome Management Challenges. GAO-15-347. Washington, D.C.:  September 22, 2015.
Federal Workforce: Improved Supervision and Better Use of Probationary  Periods Are Needed to Address Substandard Employee Performance.  GAO-15-191. Washington, D.C.: February 6, 2015.
Federal Workforce: OPM and Agencies Need to Strengthen Efforts to  Identify and Close Mission-Critical Skills Gaps. GAO-15-223. Washington,  D.C.: January 30, 2015.
section_title: Managing Federal Real Property
subsections: section_title: Why Area Is High Risk
paragraphs: The federal government’s real estate portfolio is vast and diverse— including approximately 273,000 buildings that are leased or owned in the  United States and that cost billions of dollars annually to operate and  maintain by civilian and defense agencies. Since federal real property  management was placed on the High-Risk List in 2003, the federal  government has given high-level attention to this issue, such as issuing  the National Strategy for the Efficient Use of Real Property (National  Strategy) in 2015, which provides a foundation to further assist agencies  in strategically managing their real property inventories. However, federal  agencies continue to face long-standing challenges in several areas of  real property management, including: (1) disposing of excess and  underutilized property effectively, (2) relying too heavily on leasing, (3)  collecting reliable real property data to support decision making, and (4)  protecting federal facilities. Issues with the reliability of the Federal Real  Property Profile (FRPP) data—particularly the utilization variable—make it  difficult to quantify the overall number of vacant and underutilized federal  buildings.
In September 2016, we reported on some vacant properties in the  Washington, D.C., area that illustrate the challenges associated with  disposing of or repurposing vacant property. Figure 8 illustrates the  following examples:
The Cotton Annex: This building, held by the General Services  Administration (GSA), which serves as the federal government’s  primary disposal agent, is located just a couple blocks off the National  Mall in Washington, D.C., is approximately 118,000 gross square feet  and has been vacant since 2007. In 2016, we found that GSA’s recent  attempt to exchange the property for construction services failed when  GSA was unable to obtain sufficient value from the exchange, making  the fate of this unneeded building unclear.
GSA Warehouses: In 2014, we found that some GSA warehouses  listed in FRPP as used had been vacant for as long as 10 years. GSA  only lists warehouses as unused if they are in the process of being  disposed. Interpreting use this way in FRPP caused GSA to list as  used some warehouses that had been vacant for years. We made a  priority recommendation to GSA, to improve the way GSA manages  its warehouses. According to GSA officials, they are in the process of  developing a Guide for Strategic Warehouse Planning.
St. Elizabeths: The west campus of St. Elizabeths, a National  Historic landmark in Washington, D.C., is made up of 61 buildings on  about 182 acres. Many buildings have been vacant for extended  periods of time and are in badly deteriorated condition. As we  reported in 2014, GSA developed a plan to establish a consolidated  headquarters for the Department of Homeland Security (DHS) on the  site in 2009. Since then, GSA has completed construction of a new  headquarters building for the Coast Guard on the campus, but most of  the project has been delayed. The estimated timeline for completing  the project has been extended multiple times, from an initial estimated  completion date of 2016, to an estimated completion date of 2021  based on a scaled back plan as of 2015.
In addition, the federal government continues to face challenges in  protecting federal facilities from potential attacks. For example, DHS’s  Federal Protective Service (FPS), responsible for the physical protection  of 9,500 federal facilities, continues to work to apply a risk-based  approach for assessing facilities and ensuring that guards are adequately  trained. In January 2017, we also reported that GSA is leasing from  foreign owners about 3.3 million square feet in 20 buildings that require  higher levels of security that could present security risks, such as  espionage and unauthorized cyber and physical access.
section_title: What GAO Found
paragraphs: The federal government continues to meet the high-risk criterion for  demonstrating leadership commitment to improving the management of  real property by executing a number of reform efforts since the last high- risk update in 2015. For example, the Office of Management and Budget  (OMB) has issued several key guidance documents since 2015. Most  notably, OMB introduced the National Strategy in March 2015, and more  recently issued a memo on Improving Federal Real Property Data Quality  in January 2016. In response to OMB’s memo, GSA issued its Federal  Real Property Data Validation and Verification (V&V) Guidance in May  2016. These actions represent key examples of the federal government’s  continued commitment to improve its management of real property. The  federal government has also continued to make progress toward  increasing its capacity, developing an action plan, and monitoring its  progress toward improving real property management and has made  improvements in the demonstrating progress criterion to move it from a  not met to a partially met rating. For example, in June 2016, OMB and  GSA continued efforts to implement our March 2016 recommendation to  improve FRPP data quality by conducting an in-depth survey of agencies  and soliciting information on several data elements that have been known  to be unreliable. GSA issued a memo in December 2016 to Chief  Financial Officer (CFO) Act agencies that revised the definitions to  improve the consistency and quality of several FRPP data elements. GSA  also launched the Asset Consolidation Tool, a software application that  allows federal agency users to generate geospatial information about  assets in close proximity to identify potential candidates for colocation  and consolidation. In addition, GSA implemented two priority  recommendations since 2015 related to improving data reliability and is  taking steps toward developing a 5-year capital plan.
Although progress is evident, these reforms have not fully addressed the  underlying challenges to manage real property efficiently. For example,  we found that federal agencies have not demonstrated that they have the  capacity to reduce their reliance on costly leases, particularly high-value  leases where owning properties would be less costly in the long run. GSA  has also made strides to improve data reliability, including but not limited  to issuing new data validation and verification guidance that requires  agencies to investigate anomalies and resolve them. However, GSA will  not finish measuring and tracking the progress of its data reliability efforts  until late in 2017; agencies submitted their first data under the new  approach in December 2016 and address all data irregularities by  October 2017.
Related to physical security, we found that the federal government could  do more to improve capacity, monitoring, action plans, and demonstrate  progress. For example, FPS, GSA, and other agencies could improve the  action plan criterion by collaborating and by clearly defining roles and  responsibilities to adequately protect federal facilities. Further, FPS has  taken some action to demonstrate progress but has yet to fully implement  our March 2015 and September 2013 recommendations to improve  security screening at federal buildings and guard training, respectively.
In December 2016, Congress enacted two real property reform bills that  could address the long-standing problem of federal excess and  underutilized property. The Federal Assets Sale and Transfer Act of 2016  may help address stakeholder influence by establishing an independent  board to identify and recommend at least five high-value civilian federal  buildings for disposal within 180 days after the board members are  appointed, as well as develop recommendations to dispose and  redevelop federal civilian real properties. Additionally, the Federal  Property Management Reform Act of 2016 codified the Federal Real  Property Council (FRPC) for the purpose of ensuring efficient and  effective real property management while reducing costs to the federal  government. The FRPC is required to establish a real property  management plan template, which must include performance measures,  and strategies and government-wide goals to reduce surplus property or  to achieve better utilization of underutilized property. In addition, federal  agencies are required to annually provide FRPC a report on all excess  and underutilized property and identify leased space that is not fully used  or occupied.
section_title: What Remains to Be Done
paragraphs: While the federal government has made progress on different aspects of  managing federal real property, additional work is needed. In order to  further improve the management of real property, OMB and GSA should  implement our open recommendations to build upon the National Strategy  and improve data reliability. Improving data reliability was also included  as a priority recommendation in our August 2016 letter to the GSA  Administrator. While the National Strategy mentions some underlying  causes of the challenges that federal agencies face in managing their  portfolios, it does not expound on the extent to which these challenges  impede agencies’ ability to dispose of, better utilize, or repair their real  property and offers discussion on how agencies can overcome these  challenges by addressing the underlying causes, such as legal and  budgetary limitations and competing stakeholder interests.
OMB also could increase the usefulness of the National Strategy by  discussing alternative funding mechanisms, such as retaining fees and  enhanced-use leasing. Further, despite OMB’s efforts to focus agencies’  attention on measuring progress through the Reduce the Footprint policy,  the government’s efforts to monitor progress remain limited without  reliable real property data in the FRPP. In June 2016, OMB and GSA  officials noted that they continue to implement our March 2016  recommendation to analyze the differences in how agencies collected  and reported data by conducting a survey of agencies that contribute  FRPP data on several key indicators such as status, utilization, and  replacement value. GSA plans to convene an inter-agency working group  in early 2017 to discuss each of the data elements and devise an action  plan to address the findings of the survey.
To further build capacity and develop action plans for reducing the federal  government’s overreliance on costly leasing, GSA should implement our  priority recommendation from 2013 to develop a strategy for the federal  government to own rather than lease prioritized high-value properties  such as agency headquarters buildings. While GSA has taken some  steps to increase its capacity to make its existing leasing program less  costly by increasing competition, further action is required to decrease  leasing costs by reducing unneeded fees, which is one of our priority  recommendations.
Finally, FPS, GSA, and other agencies can take additional measures to  increase capacity, develop action plans, and monitor as well as  demonstrate progress in securing federal facilities and courthouses. For  example, FPS can take additional action to address our March 2016  recommendation to improve human capital planning by developing  performance measures with targets that are aligned to FPS goals. FPS  and the Department of Justice’s (DOJ) U.S. Marshals Service (USMS)  can continue work they have under way to implement our March 2015  recommendation to improve their security screening at federal buildings  and courthouses. Further, FPS should implement our September 2013  recommendation to ensure that all guards have received screening and  active-shooter training. Finally, the Administrator of GSA and the  Secretary of Homeland Security should work jointly to implement our  other open priority recommendation to improve the management of the  Department of Homeland Security headquarters consolidation project.
section_title: Additional Details on What GAO Found
subsections: section_title: Excess and Underutilized Property
subsections: section_title: Leadership Commitment
paragraphs: OMB continues to meet this criterion by demonstrating leadership  commitment to reducing the amount of excess and underutilized federal  real property. In March 2015, OMB implemented our recommendation by  issuing government-wide guidance—the National Strategy—which  identifies actions to reduce the size of the federal real property portfolio  by prioritizing consolidation, colocation, and disposal actions. The  strategy provides a foundation to further assist agencies strategically  manage their real property. In conjunction with the National Strategy,  OMB also issued the Reduce the Footprint policy, which requires all CFO  Act agencies to implement a 5-year, rolling planning process that sets  annual square-feet reduction targets to reduce their real property  portfolios and to adopt space design standards to optimize domestic  office space use.
section_title: Capacity
paragraphs: OMB and federal real property-holding agencies continue to partially meet  the criterion for having the capacity to address the risks associated with  managing excess and underutilized property. For example, GSA  introduced the Asset Consolidation Tool in June 2016. It allows users to  identify potential candidates for colocation and consolidation by  generating geospatial information about assets in close proximity. In  addition, GSA also introduced the Real Property Management Tool that  uses multiple sources to help agencies identify opportunities for property  consolidations, collocations, and disposals. While progress is evident, we  have previously identified additional ways the federal government can  strengthen its capacity to reduce excess and underutilized property. In  2016, we reported that the National Strategy mentions some of the  causes underlying the challenges federal agencies face in managing their  portfolios—such as limited funding—but it neither addresses the extent to  which challenges impede agencies’ abilities to dispose of, better use, or  repair their real property, nor does it offer guidance on how agencies can  overcome these challenges by addressing the underlying causes.
Furthermore, the strategy does not discuss alternative-funding  mechanisms that we have previously identified to help manage budgetary  constraints, such as retaining fees in real property and exploring  enhanced use lease authority. OMB staff told us that their efforts are  focused on identifying policy options within the current statutory framework to reduce excess and underutilized property while seeking  legislative options to address the underlying challenges. We  recommended that OMB expand the National Strategy to more clearly  articulate planned actions and identify alternative approaches to address  underlying causes of real property problems. In June 2016, OMB staff told  us that they plan to expand the National Strategy since it is not a one-time  policy but a living document that they plan to use to address long- standing challenges. As of December 2016, OMB had not made any  changes to the National Strategy.
section_title: Action Plan
paragraphs: OMB showed improvement and met the criterion of establishing an action  plan for reducing excess and underutilized property. Under the Reduce  the Footprint policy, OMB has, for the first time, established a  government-wide action plan to use property as efficiently as possible  and to reduce agency portfolios through annual reduction targets. For  example, the Reduce the Footprint policy requires agencies to develop  and submit annual Real Property Efficiency Plans, which describe the  agency’s overall strategic and tactical approach in managing its real  property, including measures to dispose of unneeded properties, improve  efficiency, and save money. The policy also requires agencies to adopt  space design standards to optimize how they use domestic office space  and to set annual square foot reduction targets for their portfolio of office  and warehouse space.
section_title: Monitoring
paragraphs: OMB and federal real property-holding agencies continue to partially meet  the criterion for monitoring progress toward reducing excess and  underutilized real property. To implement the National Strategy, the  Reduce the Footprint policy requires agencies to set annual reduction  targets to measure agency performance. When agencies combine these  reduction targets with the fiscal year 2014 benchmarking metrics  developed under the President’s Management Agenda, the government  has a 3-year set of performance measures to drive portfolio-wide  efficiency improvements and property disposals. Despite multiple efforts  outlined above, the government’s efforts remain limited without reliable  real property data in the FRPP, which is necessary to effectively measure  reductions in excess and underutilized property. For example, in our  March 2016 report, we found that agencies tailored how they collect and  report data to meet their mission needs and portfolio requirements, thus  limiting OMB’s and GSA’s insight into the quality of the FRPP data and  the extent to which agencies are following sound and comparable  collection and reporting practices.
For example, our review found that some of the agencies estimated,  rather than determined, actual operating costs for each building, as these  agencies do not maintain data on costs for specific buildings. As a result,  standardizing data has been challenging since agencies have applied  different approaches to collecting data that align closely with their mission  but that in some cases are inconsistent with existing GSA guidance. In  December 2016, GSA issued a memo to senior real property officers of  the FRPC that revised the definitions to improve the consistency and  quality of several FRPP data elements including replacement value,  annual maintenance costs, and annual operating costs. Although a step  in the right direction, agencies are not required to implement these  revised definitions until the December 2018 FRPP reporting cycle.
section_title: Demonstrated Progress
paragraphs: Since the last high-risk update, OMB and GSA have demonstrated some  progress and partially met this criterion by taking a number of steps to  reduce excess and underutilized properties. GSA implemented a new  asset management tool, the Federal Real Property Profile Management  System (FRPP MS), which helps agencies identify opportunities to  consider new space and improves transparency by enabling agencies to  access each other’s data. GSA officials said that the new platform will  include capabilities to help identify underutilized properties and potential  candidates for colocations and consolidations and address long-standing  management challenges, while OMB staff noted that the new platform  has the potential to improve real property data management. Further,  OMB reported, in September 2016, that in fiscal years 2014 and 2015 the  federal government disposed of over 12,000 buildings with 71.8 million  square feet of space, saving $64 million in annual operation and  maintenance costs. While progress is apparent, we testified in September  2016 that a lack of reliable data makes it difficult to accurately measure  the amount of excess property and has undermined efforts to effectively  reform real property management and judge progress. In two  assessments of the federal government’s reported results of real property  reforms, we identified problems with data reliability. While OMB and GSA  have taken steps to address some of these data reliability issues such as  revising FRPP definitions to improve data quality and consistency, more  time is needed to determine the effectiveness of these measures and to  demonstrate that the federal government’s real property data are reliable.
section_title: Costly Leasing
subsections: section_title: Leadership Commitment
paragraphs: OMB and GSA continue to meet this criterion and demonstrate leadership  commitment in addressing its overreliance on leasing privately owned  space in situations where owning buildings would be more cost efficient in  the long run. As previously stated, OMB implemented our  recommendation in March 2015 to issue a National Strategy, which  requires agencies to identify opportunities to consolidate within their  leased assets and to improve space utilization, steps that would reduce  leasing. In addition, GSA could also save money by reducing the costs of  the leases that remain. For example, GSA has implemented a number of  measures, including leasing reform, and, at a June 2015 hearing, a top  GSA manager stated that the agency’s ongoing lease reform efforts  include plans to reduce costs by increasing competition for its leases.
section_title: Capacity
paragraphs: GSA still does not meet this criterion as it has not demonstrated that it  has the capacity to reduce its reliance on costly leases, particularly high- value leases that represent a disproportionately large amount of the rent  GSA pays. Although GSA has taken some actions to reduce the size of  its leases, it has not addressed its overall reliance on high-value leases  (defined as $2.85 million and over per year in rent) in situations where  ownership would be less expensive in the long run. In particular, GSA has  not implemented our 2013 recommendation to develop a strategy to  increase ownership investments for a prioritized list of high-value leases  where it would be less expensive in the long run to own. GSA has taken  some steps to increase its capacity to reduce the cost of its existing  leasing program by increasing competition for GSA leases but has not  implemented our other recommendation to decrease leasing costs by  reducing interest fees. For example, we found that GSA could potentially  help tenant agencies save millions of dollars for some leases by loaning  them the funds needed to improve newly leased spaces—that is, to make  tenant improvements—instead of having the tenants finance these costs  with private-sector owners at private-sector interest rates as high as 9  percent over the term of the lease.
section_title: Action Plan
paragraphs: GSA showed improvement and partially met the action plan criterion by  taking some steps to rank and prioritize long-term ownership solutions for  current high-value leases. For example, GSA developed and provided us  a list of criteria to rank and prioritize the space needs that are currently  being met in high-value leases to determine which of those leases would  benefit most from converting to a federally owned solution. GSA has also  implemented a new software program for its 5-year capital-planning  process that considers avoiding lease costs, among many other criteria,  in prioritizing projects for approval. According to GSA officials, several of  the projects approved in the capital plan covering fiscal years 2015-2019  would reduce lease costs by moving tenants out of leases into federally  owned property. These efforts are producing incremental progress, but  GSA has not implemented our recommendation to create a long-term,  cross-agency strategy for considering targeted investments in ownership.
In addition, we reported, in January 2016, that while GSA has taken steps  to reform leasing and reduce leasing costs, certain factors—such as a  tenant agency’s need for space in restricted geographic areas and  specialized building requirements—may drive down competition and  result in agencies obtaining leasing rates that are higher than local market  rates. Developing additional plans to reduce barriers to competition,  where possible, and identifying sources of capital to allow tenants to fund  tenant improvements could decrease leasing costs and lead to millions in  cost savings for some leases.
section_title: Monitoring
paragraphs: OMB and GSA have shown improvement and partially met the criterion  for monitoring progress toward reducing its overreliance on leasing  privately owned space. By issuing the National Strategy, OMB instituted  key property management reform by requiring agencies to measure the  costs and utilization of individual real property assets to support more  efficient use of federal space, which would include reducing the amount of  space leased. However, GSA has not implemented our recommendation  to set a long-term, cross-agency strategy for investing in ownership,  which would improve the ability to monitor and track progress by defining  success. As previously mentioned, adopting criteria to rank and prioritize  potential long-term ownership alternatives to current high-value leases  could help develop goals and a strategy to consider targeted investments  in ownership specifically related to these costly leases. With regard to the  costs of leasing, GSA is making progress by monitoring the extent to  which its leases are competitive and signed at rates below the private  sector. However, GSA should also implement our 2016 recommendations  to reduce the costs to tenants by exploring strategies to enhance  competition for GSA leases and reducing unneeded fees.
section_title: Demonstrated Progress
paragraphs: OMB and GSA have demonstrated some progress since 2015 and  partially met this criterion. OMB required agencies to reduce their overall  footprint through the Reduce the Footprint policy and the National  Strategy. Even though the National Strategy does not directly address the  issue of leasing, it requires agencies to adopt space design standards to  optimize how they use federal domestic office space, a step that would  likely include reducing leased space by using space more efficiently and  consolidating leases onto federally owned property. According to GSA  data, the amount of space that GSA leases has fallen for 3 straight years,  but only by 4 percent since 2013. GSA’s recent progress in reducing its  reliance on leasing has been modest. GSA has outlined a number of  actions that it has taken to implement our January 2016 recommendation  to reduce leasing costs for federal agencies by increasing competition for  GSA leases. Specifically, it has established a framework for broadening the delineated geographic areas agencies request—a key driver for  competition. GSA officials said in 2016 that the agency has also  implemented a performance measure to encourage competition. As a  result, GSA said that 81 percent of its leases are competitive. However,  these steps to reduce the costs of leases are still too recent to clearly  demonstrate progress. Further, fully implementing our recommendation  for GSA to develop and use criteria to rank and prioritize potential long- term ownership solutions to create a cross-agency strategy for making  those investments is a needed first step in addressing its overreliance on  leasing that could then lead to demonstrating progress in saving money in  the long term.
section_title: Data Reliability
subsections: section_title: Leadership Commitment
paragraphs: The federal government continued to demonstrate leadership  commitment and met this criterion by taking a number of steps to improve  data reliability within the FRPP. In addition to the National Strategy, which  called for additional data quality improvements that support data-driven  decision making, in January 2016, OMB issued a government-wide memo  requiring all CFO Act agencies to implement standard data validation and  verification checks when submitting their annual FRPP data to GSA  beginning in fiscal year 2017. Subsequently, in May 2016, GSA issued its  Federal Real Property Data Validation and Verification (V&V) Guidance,  which establishes a new mandatory data validation and verification  process and requires agencies to investigate data anomalies.
section_title: Capacity
paragraphs: OMB and GSA improved the government’s capacity to ensure that  reliable data are available to inform real property decision making through  a series of reforms to FRPP and now meet this criterion. For example,  GSA upgraded FRPP from its legacy system to a new platform with  several enhancements and tools. The new FRPP MS is an asset  management tool that now supports the new Asset Consolidation Tool,  which helps agencies identify opportunities to consider new space and  improves transparency by enabling agencies to access each other’s data.  GSA has also improved agencies’ capacity to submit accurate data by  improving the clarity of variables and helping with data verification.
section_title: Action Plan
paragraphs: GSA continues to partially meet this criterion by putting plans in place to  continue implementing our recommendations aimed at addressing the  reliability of federal real property data. In June 2016, OMB and GSA  noted that they continue to implement our recommendation to improve  FRPP data quality by conducting an in-depth survey focusing on several  data elements including replacement value, status, owned and otherwise  managed operating costs, repair needs, utilization, and lease costs. GSA  officials told us that they implemented the survey to better understand the  methods CFO Act agencies are employing to collect and prepare real  property data submitted into the FRPP. Each survey question began with  the FRPP definition for a specific data element, followed by a series of  questions designed to elicit information about how each agency applies  the FRPP reporting requirements. GSA completed its analysis of the  survey results, and in December 2016, GSA issued a memorandum to  senior real property officers of FRPC based on the survey results  designed to improve the consistency and quality of real property data. In  addition, GSA plans to convene an inter-agency working group—made up  of GSA, OMB, and executive branch agencies that contribute data to the  FRPP—in early 2017 to discuss each of the data elements and devise an  action plan to address the findings of the survey. The working group will  review the survey results in more detail and reach consensus on: (1)  changes to the definitions and requirements for these data elements in  the FRPP data dictionary; (2) limitations on the use of the data for cross- agency analysis, and (3) best practices and methodologies for reporting  these data elements.
section_title: Monitoring
paragraphs: The federal government continues to partially meet the criterion for  monitoring progress toward improving FRPP data reliability. With OMB  issuing its January 2016 memo on improving federal real property data  quality and GSA issuing its recent V&V guidance, agencies will be  required to adhere to a revised process for resolving data anomalies  when they submit data into the FRPP. Specifically, the V&V guidance  now includes a new mandate—referred to as anomaly resolution—that  requires agencies to investigate whether the underlying data flagged by  the anomalies are accurate or inaccurate. GSA’s updated information  technology platform, FRPP MS, allows GSA and agencies to analyze the  numbers and percentages of anomalies resolved versus total number of  assets in a given anomaly category. The system will maintain records of  data anomalies for each year that V&V is performed. Moreover, agencies  will have year-to-year records of all data tagged as anomalous, as well as  the reason for the tag. This has the potential to improve data quality,  promote consistency among agencies, and enable OMB and other  policymakers to measure how data quality improves over time. Although a  step in the right direction, measuring and tracking the progress of these  V&V checks will have to wait several years, as agencies submitted data  under the new approach in December 2016, and will be required to  address all data irregularities by October 2017.
section_title: Demonstrated Progress
paragraphs: GSA showed improvement since 2015 and partially met the  demonstrating progress criterion by improving the reliability of federal real  property data, but challenges still remain. In March 2016, we reported that  OMB and GSA took important steps to revise and modify several FRPP  data definitions based upon user feedback and internal data  evaluations. As previously mentioned, GSA issued its federal real  property data validation and verification guidance, requiring agencies to  confirm whether data flagged as anomalous are accurate or inaccurate,  and has plans in place to address our recommendations through the  recent survey it administered. However, until GSA acts on these survey  findings and takes concrete steps to address differences in data collection  and identify any limitations, the usefulness of FRPP data for decision  making will remain unclear. For example, in our March 2016 report, we  found that some of the agencies in our review estimated, rather than  determined, actual operating costs into FRPP for each building, as these  agencies do not maintain data on costs for each specific building.  Estimating practices also varied by agency. As a result, it may be difficult  for OMB or agencies to accurately determine aggregate cost savings from  successfully reducing excess or underutilized property. Finally, it is  unlikely that all of the data for 2 dozen variables submitted by agencies  each year on over half a million buildings and structures will ever be  completely correct and consistent. As a result, GSA should fully  implement our 2016 recommendation to assess, analyze, and identify any  limitations in how agencies collect and report data to FRPP.
section_title: Physical Security
subsections: section_title: Leadership Commitment
paragraphs: The federal government continued to meet the criterion for demonstrating  leadership commitment to improving the physical security of federal  facilities. In August 2013, the Interagency Security Committee (ISC), a  DHS-chaired organization, showed leadership commitment by issuing a  consolidated set of standards for physical security at federal facilities,  called The Risk Management Process for Federal Facilities: An  Interagency Security Committee Standard. In January 2016, it continued  to show leadership commitment by updating the Risk Management  Process elements related to current threats, countermeasures to mitigate  the threats, and the protection level for federal child care centers. In 2015,  FPS, which protects about 9,500 federal facilities in conjunction with  GSA, implemented our recommendation by issuing a revised government  facilities sector plan that identifies goals and describes resources that  support the risk management approach.
section_title: Capacity
paragraphs: FPS and GSA continued to partially meet the criterion for having the  capacity to address the risks associated with ensuring the safety of our  federal facilities. For example, FPS developed a Strategic Human Capital  Plan that included strategies tailored to address identified gaps and  needs in its workforce and identified actions that build organizational  capability to support those strategies. FPS also designed and plans to  implement a staffing model—which identifies the federal workforce  necessary to meet its mission—consistent with most key practices we  identified. However, FPS has not fully developed performance measures  to evaluate progress toward goals, which is also a key strategic workforce  planning principle. For example, FPS has not identified performance  measures for all of the Plan’s strategies, nor has it included performance  targets. Additionally, FPS has made consistent progress in its efforts to  conduct facility security assessments that are consistent with ISC  standards. Specifically, in March 2012, FPS developed the Modified  Infrastructure Survey Tool (MIST) to assess the vulnerabilities of federal  facilities. In October 2016, FPS officials stated that FPS inspectors are  currently using MIST augmented with external threat and consequence  data to provide a more complete assessment for federal facilities than can  be achieved by using MIST alone. As of October 2016, FPS had also  developed a Mission Needs Assessment that outlines how FPS will  enhance its ability to assess risks to federal facilities by incorporating  threat, vulnerability, and consequence information in a single, integrated,  and automated tool. FPS officials said that this new tool could improve  FPS’s ability to better protect federal facilities and help minimize  agencies’ duplicative risk assessment activities.
section_title: Action Plan
paragraphs: FPS has shown improvement since our last high-risk update and partially  met this criterion by developing action plans that should improve the  physical security of federal facilities. We recommended, in December  2015, that FPS and GSA—two agencies that share responsibility for  protecting federal facilities—take actions to improve their collaboration  and finalize the two agencies’ memorandum of agreement (MOA)  accordingly. As of August 2016, FPS reported that it has taken steps  with GSA to resolve differences in agency opinions on security-related  authorities for protecting federal real property. FPS also stated that once  an agreement or an updated MOA has been established, both agencies  would be better positioned to devise a plan with time frames for finalizing  a joint strategy. However, progress toward an agreement is slow; the  MOA has not been updated since 2006. Further, in September 2011, we  recommended that FPS and DOJ work with other agencies to improve  collaboration to address a number of courthouse security challenges.  USMS and FPS formed a working group in 2015 to assess the costs and  benefits of a pilot program that would enhance security. However, as of  January 2017, FPS, USMS, the Administrative Office of the U.S. Courts,  and GSA were still working to finalize the draft MOA on courthouse  security.
section_title: Monitoring
paragraphs: The federal government has shown improvement since our last high-risk  update and partially met the criterion for monitoring progress in securing  our nation’s federal facilities. For example, we reported, in March 2015,  that action is needed to better assess cost-effectiveness of security  enhancements at federal facilities. In December 2015, ISC implemented  our recommendation that they help federal agencies implement the cost- effectiveness and performance measurements by amending the federal  government’s risk management standard and published new guidance  intended to help federal entities make the most effective use of resources  available for physical security across their facilities. As a result, federal  entities will be able to better determine the benefits of security  investments and assess whether they have reduced federal facilities’  vulnerability to threats, including acts of terrorism or other forms of  violence. With regard to FPS guard training, further action is required to  monitor progress. FPS relies on 13,500 privately contracted guards to  provide security to federal facilities under the custody and control of GSA.  We recommended in September 2013 that FPS immediately determine  which guards have not had screener (x-ray and magnetometer  equipment) or active-shooter scenario training and ensure the training  has been provided to them. FPS has taken some steps to build a  monitoring and tracking system to identify guards who completed training  but has not yet completed and implemented the tracking system. In  addition, we reported in January 2017 that GSA is leasing from foreign  owners about 3.3 million square feet in 20 buildings that require higher  levels of security. Most of the tenant agencies we contacted were  unaware that the space they occupy is in a foreign-owned building.  Federal officials who assess foreign investments and some tenant  agencies said that leasing space in foreign-owned buildings could present  security risks, such as espionage and unauthorized cyber and physical  access. We recommended that GSA identify foreign owners of high  security space and inform the tenant agencies for any needed security  mitigation. GSA agreed with the recommendations.
section_title: Demonstrated Progress
paragraphs: Although FPS and other agencies have improved some areas of physical  security, they have not yet met the criterion for demonstrated progress.  To do so, FPS and USMS should continue work they have under way to  implement our March 2015 recommendation related to security screening  at federal buildings and courthouses. More specifically, we recommended  that (1) FPS develop and implement a strategy for using covert-testing  data and data on prohibited items to improve FPS’s security-screening  efforts and (2) USMS develop and implement a strategy for using  intrusion-testing data and data on prohibited items to improve security  screening at federal courthouses held by GSA. Further, FPS must fully  implement our September 2013 recommendations to ensure that its  guards have met training and certification requirements and that contract  guard companies’ instructors be certified to teach basic and refresher  training courses to guards. As previously described, developing a  tracking system that monitors guards’ training would also improve the way  FPS oversees its contract guard program, which is central to effectively  protecting employees and visitors in federal facilities.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In July 2011, we recommended that FPS establish a process for  verifying the accuracy of federal facility and guard training and  certification data before entering them into the guard database. FPS  developed and implemented procedures in 2014 to verify the  accuracy of that data before entering it into its interim contract guard  database. This step will help FPS in its continued efforts to verify the  accuracy of federal facility and contract guard data.
In June 2012, we recommended that OMB, in collaboration with  Federal Real Property Council member agencies, develop and publish  a national strategy for managing federal excess and underutilized real  property. In the spring of 2015, OMB issued the National Strategy. By  issuing the National Strategy, the federal government has taken a  major step forward to increase the efficiency of federal real property  management and address long-standing real property challenges.
In March 2015, we recommended that the Secretary of Homeland  Security direct ISC to develop guidance for helping federal entities  meet the cost-effectiveness and performance measurement aspects  of lSC’s risk management standard. In December 2015, ISC  published new guidance that provides entities with an introduction and  understanding of the most efficient processes and procedures to  effectively allocate physical security resources across an entities’  portfolio of facilities, including discussions on how to determine cost- effectiveness and implement performance measures. As a result,  federal entities will be able to better determine the benefits of security  investments and whether they have reduced federal facilities’  vulnerability to acts of terrorism or other forms of violence.
In August 2012, we recommended that DHS direct FPS to coordinate  with GSA and other federal tenant agencies to reduce any  unnecessary duplication in security assessments of facilities under the  custody and control of GSA. In 2016, we determined that FPS had  taken steps to coordinate with these agencies. For example, in 2014,  FPS surveyed GSA and other federal agencies to determine why they  were conducting their own risk assessments, among other things. As  a result of both coordinating with and surveying GSA as well as other  federal agencies, FPS has reduced or prevented the duplication of  effort associated with its risk assessments.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact the following  people. On real property management, contact Dave Wise at (202)512- 2834 or wised@gao.gov. On issues related to physical security of federal  facilities, contact Lori Rectanus at (202) 512-2834 or rectanusl@gao.gov.
section_title: Related GAO Products
paragraphs: Federal Real Property: GSA Should Inform Tenant Agencies When  Leasing High-Security Space from Foreign Owners. GAO-17-195.  Washington, D.C.: January 3, 2017.
Federal Real Property: Efforts Made, but Challenges Remain in Reducing  Unneeded Facilities. GAO-16-869T. Washington, D.C.: September 23,  2016.
Federal Real Property: Actions Needed to Enhance Information on and  Coordination among Federal Entities with Leasing Authority.  GAO-16-648. Washington, D.C.: July 6, 2016.
Federal Real Property: Observations on GSA’s Canceled Swap  Exchange Involving Buildings in the Federal Triangle South Area,  GAO-16-571R. Washington, D.C.: June 16, 2016.
Federal Real Property: Improving Data Transparency and Expanding the  National Strategy Could Help Address Long-standing Challenges.  GAO-16-275. Washington, D.C.: March 31, 2016.
Federal Protective Service: Enhancements to Performance Measures and  Data Quality Processes Could Improve Human Capital Planning.  GAO-16-384. Washington, D.C.: March 24, 2016.
Federal Real Property: GSA Could Decrease Leasing Costs by  Encouraging Competition and Reducing Unneeded Fees. GAO-16-188.  Washington, D.C.: January 13, 2016.
Homeland Security: FPS and GSA Should Strengthen Collaboration to  Enhance Facility Security. GAO-16-135. Washington, D.C.: December 16,  2015.
Homeland Security: Actions Needed to Better Manage Security Screening  at Federal Buildings and Courthouses. GAO-15-445. Washington, D.C.:  March 31, 2015.
Homeland Security: Action Needed to Better Assess Cost-Effectiveness  of Security Enhancements at Federal Facilities. GAO-15-444.  Washington, D.C.: March 24, 2015.
Federal Real Property: Strategic Focus Needed to Help Manage Vast and  Diverse Warehouse Portfolio. GAO-15-41. Washington, D.C.: November  12, 2014.
Capital Financing: Alternative Approaches to Budgeting for Federal Real  Property. GAO-14-239. Washington, D.C.: March 12, 2014.
Federal Facility Security: Additional Actions Needed to Help Agencies  Comply with Risk Assessment Methodology Standards. GAO-14-86.  Washington, D.C.: March 5, 2014.
Federal Real Property: Greater Transparency and Strategic Focus  Needed for High-Value GSA Leases. GAO-13-744. Washington, D.C.:  September 19, 2013.
Federal Protective Service: Challenges with Oversight of Contract Guard  Program Still Exist, and Additional Management Controls Are Needed.  GAO-13-694. Washington, D.C.: September 17, 2013.
Critical Infrastructure: DHS Needs to Refocus Its Efforts to Lead the  Government Facilities Sector. GAO-12-852. Washington, D.C.: August  13, 2012.
Federal Protective Service: Actions Needed to Assess Risk and Better  Manage Contract Guards at Federal Facilities. GAO-12-739. Washington,  D.C.: August 10, 2012.
Federal Buildings Fund: Improved Transparency and Long-term Plan  Needed to Clarify Capital Funding Priorities. GAO-12-646. Washington,  D.C.: July 12, 2012.
Federal Real Property: National Strategy and Better Data Needed to  Improve Management of Excess and Underutilized Property.  GAO-12-645. Washington, D.C.: June 20, 2012.
Federal Courthouses: Improved Collaboration Needed to Meet Demands  of a Complex Security Environment. GAO-11-857. Washington, D.C.:  September 28, 2011.
section_title: Funding the Nation’s Surface Transportation System
subsections: section_title: Why Area Is High Risk
paragraphs: The nation’s surface transportation system—including highways, transit,  maritime ports, and rail systems that move both people and freight—is  critical to the economy and affects the daily lives of most Americans.  However, the system is under growing strain, and the cost to repair and  upgrade the system to meet current and future demands is estimated in  the hundreds of billions of dollars. The oldest portions of the Interstate  Highway System are approaching 60 years of age, and 10 percent of the  nation’s bridges were rated as structurally deficient in 2015. While this  percentage of bridges rated as structurally deficient improved from 13  percent in 2006, bridge conditions may become more challenging to  address as a growing proportion approach the end of their 50-year design  life.
Challenges to the nation’s surface transportation system are amplified by  shifting demographics, the need to transport the goods and services to  support a growing economy, rapid development of new technologies, and  other factors. The U.S. population is expected to increase by 70 million  over the next 30 years. As the Department of Transportation (DOT) has  reported, this projected increase includes a growing percentage of  Americans over the age of 65 with limited ability to drive or use transit to  access critical services, and millennials, many of whom drive less than  previous generations and choose to live in urban areas where they can  walk, bike, or use public transportation. Though employment options in  suburban areas are increasing, poverty is also increasing in such areas.  Collectively, these changes will complicate future infrastructure planning  decisions.
These trends are altering transportation investment decision making. The  amount of freight moving through the country is expected to grow, a factor  that will place strain on existing freight bottlenecks. Rapidly evolving  vehicle technologies present new opportunities, but also pose challenges  to creating a statutory and regulatory framework that will allow people to  use these technologies while addressing privacy and other concerns they  raise. Climate change also poses risks to existing transportation assets  and presents opportunities and challenges to enhance resilience and  reduce potential future losses, rather than simply pursuing a reactive  approach of funding after a disaster occurs. financial condition and fiscal outlook. Funding the nation’s surface  transportation system has been on GAO’s High-Risk List since 2007.
section_title: What GAO Found
paragraphs: There is no rating for this high-risk area because addressing it primarily  involves congressional action and the high-risk criteria and subsequent  ratings were developed to reflect the status of agencies’ actions and the  additional steps they need to take.
Motor fuel taxes and additional truck-related taxes that support the  Highway Trust Fund—the major source of federal surface transportation  funding—are eroding. Federal motor fuel tax rates have not increased  since 1993, and drivers of passenger vehicles with average fuel efficiency  currently pay about $96 per year in federal gasoline taxes. Because of  inflation, the 18.4 cent-per-gallon tax on gasoline enacted in 1993 is worth  about 11 cents today. The tax base will likely continue to erode as  demand for gasoline decreases with the introduction and adoption of  more fuel-efficient and alternative fuel vehicles. To maintain spending  levels of about $45-50 billion a year for highway and transit programs and  to cover revenue shortfalls, Congress transferred a total of about $141  billion in general revenues to the Highway Trust Fund on eight occasions  from 2008 through 2015. This funding approach has effectively ended  the long-standing principle of “users pay” in highway finance, breaking the  link between the taxes paid and the benefits received by highway users.
The most recent surface transportation reauthorization measure, enacted  in December 2015 and which authorized funding through 2020, was the  Fixing America’s Surface Transportation (FAST) Act. In addition to funds  authorized from the Highway Trust Fund, the FAST Act provided around  $70 billion of the $141 billion in transfers from general revenues. The  general revenues provided in the FAST Act represented a one-time  transfer of funding, not a sustainable long-term source of revenues. After  2020, the gap between projected revenues and spending will recur. In  March 2016, the Congressional Budget Office estimated that $107 billion  in additional funding would be required to maintain current spending  levels plus inflation from 2021 through 2026, as shown in figure 9.
section_title: What Remains to Be Done
paragraphs: Congress and the administration need to agree on a long-term plan for  funding surface transportation. Continuing to augment the Highway Trust  Fund with general revenues may not be sustainable, given competing  demands and the federal government’s fiscal challenges. A sustainable  solution would balance revenues to and spending from the Highway Trust  Fund. New revenues from users can come only from taxes and fees;  ultimately, major changes in transportation spending or in revenues, or in  both, will be needed to bring the two into balance. enhancing the management of discretionary grant programs. These  actions are essential to maximizing the use of available resources.
section_title: Additional Details on What GAO Found
paragraphs: The challenge of funding the nation’s surface transportation system is  magnified by the fact that spending for surface transportation programs  has not commensurately improved system performance. Many programs  have not effectively addressed key challenges—such as deteriorating  infrastructure conditions and increasing congestion and freight demand— because federal goals and roles have been unclear, programs have  lacked links to performance, and programs have not used the best tools  and approaches to ensure effective investment decisions. Beginning in  2008, we recommended that Congress consider a fundamental  reexamination of these programs to clarify federal goals and roles,  establish performance links, and improve investment decision making.  More recently, we found that it can be difficult to determine the extent to  which federal funding has improved system performance. Specifically, in  2016, we found that while the Federal Highway Administration (FHWA)  collects and maintains data on both federal funding for bridge projects  and bridge conditions, it lacks a means of demonstrating the link between  such funding and changes in bridge conditions. We recommended that  the FHWA Administrator develop an efficiency measure to demonstrate  the link between funding and bridge infrastructure outcomes, and report  that information to Congress. DOT concurred with our recommendation  and we are awaiting information on what steps DOT plans to take to  implement it.
Congress passed provisions in MAP-21 in 2012 to help address the key  challenges we identified in 2008. Among other things, the act included  provisions to move toward a more performance-based highway and  transit program. Specifically, MAP-21 established national performance  goals in areas such as infrastructure condition, safety, and system  performance; MAP-21 also outlined a three-stage process in which (1)  DOT establishes performance measures for these national goals, (2)  states and other grantees set targets based on these performance  measures and report annually on their progress, and (3) DOT evaluates  whether grantees have met their targets and reports to Congress. bridge conditions, and system performance. For example, the System  Performance Measure rule includes measures for freight movement,  traffic congestion, and air quality and received over 8,800 public  comments. MAP-21 also required states to report on their progress in  implementing the transportation performance management requirements  to DOT by October 2016 and required DOT to report to Congress on  progress made by October 2017. Because several of the final rules were  recently issued, it is too early for states to report on progress, and thus  DOT provided guidance to states, requesting that they instead report on  their general performance management activities. We plan to report on  DOT and state progress and anticipated challenges implementing the  new national transportation performance management framework in the  summer of 2017.
Congress and DOT have also taken steps to more strategically address  freight congestion, though many of DOT’s actions are in the early stages.  For example, MAP-21 established national goals and directed the  Secretary of Transportation to establish a national freight network,  develop a strategic freight plan, and provide the tools necessary to  support a performance-based approach for evaluating and selecting new  freight projects. The 2015 FAST Act made some changes to, and built  upon, some of MAP-21’s freight provisions. Specifically, it extended the  deadline for DOT to finalize the National Freight Strategic plan from  October 2015 to December 2017. The public comment period for the draft  plan closed on April 2016 and, according to DOT, it is on track to finalize  the plan by the new deadline. The FAST Act also directed DOT to  establish for the first time a National Multimodal Freight Network and also  a National Highway Freight Network.
The National Highway Freight Network is to be used to strategically direct  federal resources and policies toward improved performance of highway  portions of the U.S. freight transportation system. Finally, the FAST Act  established a competitive grant program to fund freight and highway  projects of regional or national importance. In 2016, DOT awarded  approximately $760 million for the Fostering Advancements in Shipping  and Transportation for the Long-term Achievement of National  Efficiencies (FASTLANE) grant program to 18 freight projects. outcome—that of returning revenues to their attributed state of origin. For  three highway programs designed to meet national and regional  transportation priorities, we recommended that Congress consider a  competitive, criteria-based process for distributing federal funds. The  FAST Act authorized about a dozen new discretionary grant programs,  some of which DOT is already implementing, including the FASTLANE  program. While over 90 percent of funds will continue to be distributed by  formula, the FAST Act represents a promising development to address  national and regional transportation priorities.
Nevertheless, we have found challenges with DOT’s implementation of  discretionary grant programs, including problems documenting key  evaluation and project selection decisions. For example, in May 2014, we  found that DOT did not document key decisions—such as accepting and  reviewing project applications received after the published deadline, or  changes to projects’ technical ratings— and deviated from established  procedures and recognized internal control practices in awarding  Transportation Investment Generating Economic Recovery (TIGER)  discretionary grants. We recommended that the Secretary of  Transportation establish additional accountability measures by, among  other things, issuing a decision memorandum or similar mechanism to  document and approve major decisions in the application evaluation and  project-selection process. DOT generally agreed with, but has not fully  implemented, this recommendation.
In addition, in December 2016, we found that the Federal Transit  Administration (FTA) did not document key decisions in awarding $3.6  billion in discretionary, competitive grants for projects to increase the  resilience of transit systems to withstand future disasters in areas affected  by Hurricane Sandy. For example, FTA did not document how it  addressed reviewers’ concerns that some of the proposed—and  ultimately funded—projects were outside the scope of the grant program.  We also found that because FTA did not incorporate information collected  from applicants and reviewers into its selection process, it may have  funded projects that may no longer be needed if other resilience projects  in the same region are implemented. We recommended that FTA  examine its funded projects for potential duplication with other resilience  efforts and determine if realigning or rescinding those funds is  appropriate. DOT concurred with our recommendation and we are  awaiting information on what steps DOT plans to take to implement it. we recommended in December 2016 that the Secretary of Transportation  issue a directive governing department-wide and modal administration  discretionary grant programs. Such a directive should include  requirements to, among other things, (1) develop an up-front plan for  evaluating project proposals to ensure DOT reviews applications  consistently; and (2) document key decisions, including the reason for  any rating changes, as well as how high-level concerns raised during the  process were addressed. Developing such a directive would help to  ensure the integrity of future DOT discretionary grant programs. DOT  concurred with our recommendation and we are awaiting information on  what steps DOT plans to take to implement it.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Susan  Fleming at (202) 512-2834 or FlemingS@gao.gov.
section_title: Related GAO Products
paragraphs: DOT Discretionary Grants: Problems with Hurricane Sandy Transit Grant  Selection Process Highlight the Need for Additional Accountability.  GAO-17-20. Washington, D.C.: December 14, 2016.
West Coast Ports: Better Supply Chain Information Could Improve DOT’s  Freight Efforts. GAO-17-23. Washington, D.C.: October 31, 2016.
Highway Bridges: Linking Funding to Conditions May Help Demonstrate  Impact of Federal Investment. GAO-16-779. Washington, D.C.:  September 14, 2016.
U.S. Border Communities: Ongoing DOT Efforts Could Help Address  Impacts of International Freight Rail. GAO-16-274. Washington, D.C.:  January 28, 2016.
Surface Transportation: DOT Is Progressing Toward a Performance- Based Approach, but States and Grantees Report Potential  Implementation Challenges. GAO-15-217. Washington, D.C.: January 16,  2015.
Surface Transportation: Department of Transportation Should Measure  the Overall Performance and Outcomes of the TIGER Discretionary Grant  Program. GAO-14-766. Washington, D.C.: September 23, 2014.
Freight Transportation: Developing National Strategy Would Benefit from  Added Focus on Community Congestion Impacts. GAO-14-740.  Washington, D.C.: September 19, 2014.
Surface Transportation: Actions Needed to Improve Documentation of  Key Decisions in the TIGER Discretionary Grant Program. GAO-14-628R.  Washington, D.C.: May 28, 2014.
Highway Trust Fund: Pilot Program Could Help Determine the Viability of  Mileage Fees for Certain Vehicles. GAO-13-77. Washington, D.C.:  December 13, 2012.
Highway Trust Fund: All States Received More Funding Than They  Contributed in Highway Taxes from 2005 to 2009. GAO-11-918.  Washington, D.C.: September 8, 2011.
Surface Transportation: Clear Federal Role and Criteria-Based Selection  Process Could Improve Three National and Regional Infrastructure  Programs. GAO-09-219. Washington, D.C.: February 6, 2009.
Surface Transportation: Restructured Federal Approach Needed for More  Focused, Performance-Based, and Sustainable Programs. GAO-08-400.  Washington, D.C.: March 6, 2008.
section_title: Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Finance
subsections: section_title: Why Area Is High Risk
paragraphs: Congress and financial regulators have made progress in meeting criteria  for removing the issue area of reforming the U.S. financial regulatory  system from our High-Risk List. However, definitive steps have yet to be  taken to address the federal government’s role in housing finance. As the  worst financial crisis in more than 75 years unfolded, unprecedented  federal support was provided to many firms, including Fannie Mae and  Freddie Mac, two large, housing-related government-sponsored  enterprises (the enterprises). Many households suffered as a result of  falling asset prices, tightening credit, and increasing unemployment.  These events clearly demonstrated that the U.S. financial regulatory  system had failed to respond effectively to developments in the markets  and to the increase in systemic risks that contributed to the crisis. Given  the challenges that regulators would face in identifying and implementing  changes to reduce the potential for such events to occur again, we  designated reform of the financial regulatory system as a high-risk area in  2009. developments at the enterprises and FHA, we added this issue to the  scope of this high-risk area in 2013.
section_title: What GAO Found
paragraphs: Congress and financial regulators have made progress in meeting criteria  for removing the issue area of reforming the U.S. financial regulatory  system from our High-Risk List, but additional steps are needed to  improve the structure of the financial regulatory system and the  implementation of some reforms. Demonstrating leadership commitment  and capacity, Congress enacted sweeping reforms in 2010 through the  Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act) and regulators have worked to implement the act’s numerous  reforms. Continued leadership commitment from financial regulators and  Congress will be needed to fully implement the reforms and additional  work will be needed to exhibit capacity to complete oversight and  monitoring plans, monitor progress, and demonstrate the effectiveness of  the new oversight bodies and regulations.
Policymakers have made proposals to overhaul the federal role in the  housing finance system, but additional leadership commitment will be  needed to reach consensus and enact changes to the system. The  ongoing federal conservatorship of the enterprises and FHA’s need for  supplemental funds in 2013 underscore the need to reconsider the  federal role. Federal agencies have taken some steps to develop plans,  build capacity, and provide monitoring mechanisms that could help build a  more robust housing finance system. However, progress toward resolving  the federal role within that system will be difficult to achieve without an  overall blueprint for change. new and more complex financial products for consumers and investors.  Taking steps to better position regulators to oversee firms and products  that pose risks to the financial system and consumers, and to adapt to  new products and participants as they arise, could reduce the likelihood  that the financial markets will experience another financial crisis similar to  the one in 2007–2009.
Losses from risky mortgage products also resulted in the enterprises  being placed into federal conservatorship in 2008, creating an explicit  fiscal exposure for the federal government. The enterprises received  more than $187 billion in financial assistance from the Department of the  Treasury (Treasury) through purchases of senior preferred stock, but  have paid more than $250 billion in dividends to Treasury under the stock  purchase agreements. Distressed housing and mortgage markets also  expanded FHA’s role in the mortgage market, while leading to  deterioration in the agency’s financial condition from which it has taken  years to recover. In 2015, mortgages directly or indirectly supported by  the federal government accounted for more than 70 percent of the dollar  value of new single-family mortgage originations, according to data from  Inside Mortgage Finance.
Although more needs to be done to address this high-risk issue, there  have been several benefits achieved by implementing our  recommendations.
In a March 2016, we reported that Treasury had not instituted a  system to review the extent to which it would use the available  program balance for the Making Home Affordable (MHA) program.  Consistent with our recommendations, Treasury updated estimates of  future MHA program expenditures, deobligated $2 billion from the  MHA program, and announced a $2 billion increase in funding for the  Hardest Hit Fund.
In June 2013, we made recommendations intended to increase FHA’s  returns on sales of foreclosed properties with FHA-insured mortgages.  FHA’s actions in response to our recommendations improved its  returns and led to financial benefits totaling more than $3.4 billion in  fiscal years 2013–2016. approximately $7.1 billion dollars, which was returned to the general  fund in fiscal year 2013.
In November 2005, we recommended that FHA take a number of  steps to mitigate the risks associated with mortgages with down  payment assistance from nonprofit organizations funded by property  sellers. Citing our work, Congress prohibited seller-funded down- payment assistance, effective October 1, 2008. In fiscal year 2013,  the financial benefit to the federal government of not insuring such  loans was approximately $2.5 billion.
section_title: What Remains to Be Done
subsections: section_title: Actions Needed to Complete and Ensure the Effective Functioning of Reforms to the U.S. Financial Regulatory System
paragraphs: Continued leadership commitment is needed to ensure that financial  regulations foster stable, competitive and well-functioning markets. Our  review of selected major rules—that is, those likely to result in an annual  impact on the economy of $100 million or more, among other things— found that regulators generally quantified some of the costs but not  always the benefits of each rule, noting data and other limitations.  Although the federal financial regulators—as independent agencies—are  not subject to executive orders requiring detailed cost-benefit analysis in  accordance with Office of Management and Budget (OMB) guidance, we  have recommended that the regulators more fully incorporate OMB’s  regulatory guidance into their written rulemaking policies. However, not all  regulators have implemented this recommendation. The Administration  and members of Congress have expressed intentions to reduce financial  regulatory burdens. Such actions would be most effective if they largely  preserve the benefits sought by the regulations while allowing institutions  to comply with the requirements in less costly ways. requirements that regulators adopted for banks in October 2013 have  some provisions that will not be fully effective until January 2019.
Additional leadership from Congress is also needed to improve the  inefficiencies that hamper the current financial regulatory system.  Although the Dodd-Frank Act implemented a number of key reforms  intended to address significant weaknesses and gaps in the regulatory  system, the U.S. financial regulatory structure remains complex, with  responsibilities fragmented among a number of regulators that have  overlapping authorities. We have noted that this fragmentation, overlap,  and duplication introduce significant challenges for efficient and effective  oversight of financial institutions and activities.
The framework we developed in 2009 for evaluating regulatory reform  proposals noted that an effective regulatory system would address certain  structural shortcomings created by fragmentation and overlap. To help  achieve this, we have suggested that Congress consider whether  additional changes to the financial regulatory structure are needed to  reduce or better manage fragmentation and overlap in the oversight of  financial institutions and activities to improve the efficiency and  effectiveness of oversight. For example, Congress could consider  consolidating the number of federal agencies involved in overseeing the  safety and soundness of depository institutions, combining the entities  involved in overseeing the securities and derivatives markets, transferring  the remaining prudential regulators’ consumer protection authorities over  large depository institutions to the Consumer Financial Protection Bureau  (CFPB), and determining the optimal federal role in insurance regulation.
Congressional leadership also could improve the ability of the U.S.  regulatory system to address systemic risks. Although the Financial  Stability Oversight Council (FSOC) represents advancement in  addressing systemic risk threats to the U.S. financial system, its legal  authorities may not be broad enough to ensure that it can address all  threats effectively. Under the Dodd-Frank Act, FSOC can respond to  certain potential systemic risks primarily through its authority to designate  certain entities or activities that pose a threat to financial stability for  enhanced supervision by a specific federal regulator. We reported in  February 2016 that FSOC’s designation authorities, by statute, cannot be  used to address certain types of risks, such as specific industry-wide  activities involving nonbank financial institutions, and the full scope of  FSOC’s designation authority remains untested and unclear to date.
FSOC has other nondesignation authorities that allow it to recommend  that individual regulators address specific risks, but these  recommendations are nonbinding. As a result, we suggested that  Congress consider whether legislative changes would be necessary to  align FSOC’s authorities with its mission to respond to systemic risks.  Such actions could include changes to FSOC’s mission, its authorities, or  both, or to the missions and authorities of one or more of the FSOC  member agencies to support a stronger link between its responsibility and  capacity to respond to systemic risks.
Additional leadership, planning, capacity, and monitoring activities by U.S.  financial regulators also could improve systemic risk oversight. While the  newly created systemic risk and financial research bodies have been  established, we have continued to identify additional steps they need to  take to fully meet their envisioned missions. The Dodd-Frank Act  maintained the independence of the system’s multiple regulators but  created FSOC to identify and respond to systemic risks. We noted in  February 2016 that this approach to systemic risk oversight requires  consistent and highly effective interagency collaboration and the use of  good quantitative and qualitative information. However, we reported then  that FSOC’s Systemic Risk Committee is not fully and consistently  informed by the Office of Financial Research (OFR) and the Federal  Reserve’s monitoring tools or other outputs, and we recommended this  be done.
In addition, we found that both OFR and the Federal Reserve conduct  broad-based systemic risk monitoring activities that aim to identify threats  across the financial system and recommended that the two agencies  jointly articulate individual and common goals for their systemic risk  monitoring activities, including a plan to monitor progress toward  articulated goals, and formalize regular strategic and technical  discussions around their activities and outputs to support those goals.  Such efforts could help ensure that FSOC more accurately measures the  effect of significant Dodd-Frank Act regulations but also more efficiently  coordinates with its members to leverage retrospective reviews. agencies, to better ensure that the monitoring and analysis of the financial  system are comprehensive and not unnecessarily duplicative. In  addition, to improve the data that council members need to conduct their  responsibilities, FSOC should direct OFR to work with its members to  identify and collect the data necessary to assess the effect of the Dodd- Frank Act regulations on, among other things, the stability, efficiency, and  competitiveness of the U.S. financial markets.
Financial regulators need to demonstrate further progress by taking  additional actions. Although FSOC’s ability to identify firms whose  financial difficulties could pose threats to the overall financial system is an  important oversight tool, we reported in November 2014 that the  transparency of its process for designating systemically important  nonbank entities could be improved. Designating these entities in a way  that supports public and market confidence could help mitigate the  potential for such entities to endanger the stability of the U.S. financial  system. Thus, we recommended that FSOC take various steps to  improve the tracking of its process and disclose the rationales for its  designations in greater detail. Since then, FSOC has issued supplemental  procedures for nonbank financial company designations that stated its  commitment to continuing to provide the public with an understanding of  the council’s analysis and a subsequent designation document included  additional information compared to prior ones. However, that document  did not fully explain how FSOC concluded that a company’s  characteristics were sufficiently large or significant enough, or had other  attributes, to meet a determination standard.
Corporation address these weaknesses. In addition, we recommended in  2016 numerous steps the Federal Reserve could take to improve the  stress tests that assess how large financial institutions would be affected  by changes in economic or other conditions.
Additional progress is needed to address other risks. Although the  Federal Reserve has worked with the two clearing banks for the  repurchase (repo) market to reduce their problematic credit exposures,  the FSOC 2015 annual report notes that the risk of fire sales of collateral  by creditors of a defaulted broker-dealer remains an important financial  stability concern. For instance, many of the creditors may themselves be  vulnerable to runs in a stress event. As a result, the council expressed the  need for market participants to continue to improve the settlement  processes for these transactions.
section_title: Actions Needed to Resolve the Federal Role in Housing Finance
paragraphs: Resolving the role of the federal government in housing finance will  require continued leadership commitment by Congress and the  administration. Prolonged conservatorships and a change in leadership at  FHFA could shift priorities for the conservatorships, which in turn could  send mixed messages and create uncertainties for market participants  and hinder the development of the broader secondary mortgage market.  For this reason, we said in November 2016 that Congress should  consider legislation establishing objectives for the future federal role in  housing finance, including the structure of the enterprises, and a  transition plan to a reformed housing finance system that enables the  enterprises to exit conservatorship.
Maintaining FHA’s long-term financial health and defining its future role  also will be critical to any effort to overhaul the housing finance system.  We previously recommended that Congress or FHA specify the economic  conditions that FHA’s Mutual Mortgage Insurance (MMI) Fund would be  expected to withstand without requiring supplemental funds. As  evidenced by the $1.68 billion FHA received in 2013, the 2 percent capital  requirement for FHA’s MMI Fund may not always be adequate to avoid  the need for supplemental funds under severe stress scenarios.
Implementing our recommendation would be an important step not only in  addressing FHA’s long-term financial viability, but also in clarifying FHA’s  role. FHA also will need to sustain the progress it made in strengthening  the health of the MMI Fund and implementing sound risk-management  practices. Furthermore, it will be important for FHA and other agencies  with housing finance-related responsibilities to fully implement our  recommendations on evaluating the effectiveness of foreclosure  mitigation actions, opportunities for consolidating similar housing  programs, and the effect of recent mortgage market regulations.
Due to the interconnected nature of the housing finance system and the  central role homeownership plays in the U.S. economy, changes will need  to be carefully designed and implemented. In October 2014, we issued a  framework consisting of nine elements that Congress and others can use  as they consider changes to the housing finance system. The  framework has the following elements:  clearly defined and prioritized goals for the housing finance system; policies and mechanisms that are aligned with goals and other adherence to an appropriate financial regulatory framework; government entities with the capacity to manage risks; protections for mortgage borrowers and actions to address barriers to protection for mortgage securities investors;  consideration of the cyclical nature of housing finance and the effect  of housing finance on financial stability;  recognition and control of fiscal exposure and mitigation of moral  hazard; and emphasis on implications of the transition.
Each element in the framework is critically important in establishing the  most effective and efficient housing finance system. Applying the  elements of this framework would help policymakers identify the relative  strengths and weaknesses of any proposals they consider. Similarly, the  framework can be used to craft proposals or to identify changes to  existing proposals to make them more effective and appropriate for  addressing any limitations of the current system. However, any viable  proposal for change must recognize that sometimes tradeoffs will exist  among and within the nine elements. If Congress enacts changes to the  housing finance system, relevant federal agencies will need to develop  the capacity and action plans necessary to effectively implement the  changes and monitor progress.
FHA needs to complete or build on steps it has taken in response to two  priority recommendations that were not fully implemented as of October  2016. First, FHA has partially addressed recommendations from our June  2012 report on reducing losses from troubled mortgages, but needs to  finish analyzing and reevaluating its loss mitigation approaches in order to  optimize these efforts. Second, FHA and other agencies that are part of  a single-family housing task force need to evaluate and report on the  opportunities for consolidating similar housing programs, as we  recommended in an August 2012 report.
section_title: Congressional Actions Needed
paragraphs: federal role in housing finance, including the structure of the enterprises,  and a transition plan to a reformed housing finance system that enables  the enterprises to exit conservatorship.
section_title: Additional Details on What GAO Found
subsections: section_title: Implementation and Effective Functioning of Regulations and New Financial Regulatory Bodies
subsections: section_title: Leadership Commitment
paragraphs: U.S. financial system and acting to mitigate risks that might destabilize  the system. In addition, the act consolidated responsibility for consumer  financial protection laws into a new agency, CFPB. However, some  reforms, including several rules addressing over-the-counter derivatives  reforms, have yet to be fully implemented.
Additional leadership is needed from Congress to address the limitations  that hamper the current financial regulatory structure. Although the Dodd- Frank Act made changes that were consistent with some of the  characteristics we have identified for an effective financial regulatory  framework, the existing regulatory structure does not always ensure (1)  efficient and effective oversight, (2) consistent consumer protections, and  (3) consistent financial oversight. As a result, negative effects of  fragmented and overlapping authorities persist throughout the system.  Without congressional action it is unlikely that remaining fragmentation  and overlap in the U.S. financial regulatory system can be reduced or that  policymakers and regulators can more effectively and efficiently oversee  financial institutions. Members of Congress have also expressed  concerns about the burdens that the new regulations may have created  for financial institutions and have indicated plans to reduce these  burdens.
section_title: Capacity
paragraphs: they continue to face such constraints they are taking steps to address  their obligations to finalize the remaining rules.
section_title: Action Plan
paragraphs: Regulators have made some progress in developing action plans for  completing reforms and have partially met this criterion for removal from  the High-Risk List. Since 2010, regulators have taken steps to prioritize  rulemakings, including FSOC issuing an integrated implementation road  map for required rules and publishing a consultation framework for  guiding rulemaking coordination activities among agencies. FSOC’s  annual reports serve as the council’s key accountability document, as  each report discusses the progress regulators have made in  implementing reforms, identifies newly emerging threats, and includes  recommendations to address them. We also reported in February 2016  that the work of FSOC’s Systemic Risk Committee has become better  integrated into the council’s annual reports.
section_title: Monitoring
paragraphs: over time, may be useful to these regulators in monitoring the effect of  regulations on banks and credit unions.
section_title: Demonstrated Progress
paragraphs: Regulators have partially met the demonstrated progress criterion for  removal from the High-Risk List. The new regulatory bodies have been  taking actions to carry out their missions. For example, FSOC meets  regularly to discuss issues related to risks to the U.S. financial system  and issues an annual report that addresses market and regulatory  developments across the financial system.
As a result of FSOC determining that the activities or characteristics of  some entities are systemically important, various financial market utilities  (which perform key functions in the financial system) were designated to  be subject to prescribed risk management standards and four nonbank  financial companies were designated to be subjected to enhanced  prudential standards and supervision by the Board of Governors of the  Federal Reserve (Federal Reserve), although the United States District  Court for the District of Columbia rescinded the designation applicable to  one company and FSOC rescinded the designation of another after the  company changed its operations to reduce its systemic importance.
As part of making progress in demonstrating the effectiveness of  implemented reforms, FSOC also issued a mandated report in March  2016 that addressed the effect regulatory changes are having on firm  sizes, diversification, and other issues. CFPB has implemented rules and  taken enforcement actions that resulted in billions of dollars of relief to  consumers. With the recent crisis demonstrating the importance of  efficiently resolving systemically important financial institutions that fail,  the Federal Reserve and the Federal Deposit Insurance Corporation  completed several annual reviews of resolution plans that the Dodd-Frank  Act mandates large systemically important financial institutions prepare.  And in response to one of our recommendations, the agencies made  additional information public about the criteria they use to evaluate the  plans.
Regulators also made progress reducing the potential systemic  implications of certain concentrations of credit risks the Dodd-Frank Act  had not addressed. Regulators have been working to reduce the potential  for serious problems arising from the failure of one of the two clearing  banks that provide credit to facilitate transactions in the tri-party  repurchase (repo) market that provides short-term funding to many  financial institutions. FSOC’s 2015 annual report noted that market  participants have reduced their reliance on intraday credit from the  clearing banks, which reduces the risks posed by these activities.
section_title: Resolution of the Role of the Federal Government in Housing Finance
subsections: section_title: Leadership Commitment
paragraphs: housing finance system. As of December 2016, none of the proposals  had passed the Senate or the House of Representatives.
Housing and regulatory agencies also have demonstrated commitment to  strengthening the housing finance system. FHA has enhanced its risk- management practices in response to our recommendations, including  creating credit and operational risk committees, and has taken actions to  recapitalize its MMI Fund. FHFA has continued efforts to develop a single  security for the enterprises—which may enhance market liquidity for  mortgaged-backed securities—and put in place a common securitization  platform for the enterprises. Additionally, as we reported in our 2015  high-risk update, financial regulators have finalized rules defining qualified  mortgages and qualified residential mortgages that are designed to  prevent a recurrence of risky mortgage origination and securitization  practices.
section_title: Capacity
paragraphs: Agencies have partially met this criterion for removal from the High-Risk  List. FHA has made progress in strengthening its financial capacity. In  fiscal years 2009–2014, FHA’s MMI Fund was out of compliance with its  statutory 2 percent minimum capital requirement. And at the end of fiscal  year 2013, FHA drew on $1.68 billion in permanent and indefinite budget  authority to ensure the MMI Fund had sufficient resources to pay for  expected future losses on existing insurance obligations. However, as of  September 30, 2016, the MMI Fund’s capital ratio was in compliance with  the statutory requirement and stood at 2.32 percent. scores. FHA took steps to mitigate losses by revising guidelines on home  retention options for struggling borrowers and by implementing cost- effective alternatives for disposing of nonperforming loans and foreclosed  properties. FHA also acted on our recommendations for increasing  returns on foreclosed properties, which could help strengthen its financial  position.
Under FHFA’s conservatorship, the enterprises generally have operated  profitably since 2012, and, through September 2016, paid more than  $250 billion to Treasury in dividends. However, FHFA’s Inspector General  warned in March 2015 that the continued profitability of the enterprises  was not assured and that the enterprises faced many financial  challenges. These challenges included lower earnings on their retained  investment portfolios and a reduced capacity to absorb future losses due  to a capital reserve amount that falls to $0 by 2018. Without a capital  reserve, any quarterly losses—including those due to market fluctuations  and not necessarily to economic conditions—would require the  enterprises to draw additional funds from Treasury. Treasury has  provided about $187.5 billion in funds as capital support to the  enterprises, with an additional $258.1 billion available to the enterprises  should they need further assistance.
Congress should consider granting FHFA the authority to examine third  parties, including nonbank mortgage servicers doing business with the  enterprises. As of December 2016, Congress had not yet acted on that  recommendation.
section_title: Action Plan
paragraphs: Although fundamental changes to the housing finance system have yet to  be enacted, federal agencies have taken some planning steps in relation  to resolving the federal role in housing finance and have therefore  partially met this criterion for removal from the High-Risk List. As we  noted in our 2015 high-risk update, these steps included a 2011  Treasury-HUD plan outlining a vision for the federal role, a 2014 FHFA  plan identifying strategic goals for enterprise conservatorship, and a 2014  Treasury initiative to obtain public comments on the role of the private- label securities market in the current and future housing finance system.  As we found in November 2016, FHFA’s 2014 strategic plan shifted  emphasis away from contracting the enterprises’ operations, which was a  goal in the 2012 plan developed under FHFA’s previous director. Since  launching its initiative in 2014, Treasury has provided a forum for  stakeholders in the private-label market to identify the structural reforms  needed to bring back capital into that market in a responsible way.  Additionally, in July 2016, Treasury, FHFA, and HUD issued a report with  guiding principles for future efforts to mitigate mortgage losses based on  lessons from the financial crisis.
section_title: Monitoring
paragraphs: through their housing market scorecard. Furthermore, FHFA and FHA  have continued to monitor and report on the financial condition of the  enterprises and FHA’s MMI Fund.
A number of agencies—such as CFPB and HUD—have begun planning  required retrospective reviews of mortgage market reforms—specifically,  the qualified mortgage and qualified residential mortgage rules noted  previously. However, in June 2015, we found the agencies had not yet  developed sufficient metrics, baselines, and analytical methods to  effectively conduct the retrospective reviews. We recommended that  they complete plans for the reviews and include the three elements we  identified. As of December 2016, some of the agencies reported making  progress to develop these improvements but had not yet completed them.
section_title: Demonstrated Progress
paragraphs: Policymakers and regulators have not met this criterion for removal from  the High-Risk List. Overall progress on resolving the federal role in  housing finance will be difficult to achieve until Congress provides further  direction by enacting changes to the housing finance system. Federal  agencies have begun taking some planning, capacity building, and  monitoring steps. Among these are actions mentioned above to  strengthen the financial condition of FHA and mitigate risks of the housing  enterprises. FHFA and FHA have also taken steps to monitor progress in  these areas by reporting on their financial condition and activities.  Furthermore, Treasury and HUD have combined to report regularly on the  condition of the housing market. Nonetheless, assessing progress against  specific goals is not yet possible because Congress has not provided an  overall blueprint for the future federal role in housing finance or  determined the specific roles federal agencies will play.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: to the TARP-funded Hardest Hit Fund, as authorized. Consistent  with our recommendations, Treasury updated estimates of future  MHA program expenditures, deobligated $2 billion from the MHA  program, and announced a $2 billion increase in funding for the  Hardest Hit Fund.
In June 2013, we found that HUD’s performance in selling foreclosed  properties with FHA-insured mortgages lagged the performance of  Fannie Mae and Freddie Mac. We made recommendations intended  to increase FHA’s returns on such property dispositions. FHA’s  actions in response to our recommendations improved its returns and  led to financial benefits totaling more than $3.4 billion in fiscal years  2013–2016.
In a June 2012 report on federal foreclosure mitigation efforts, we  found that Treasury had not reassessed its need for the $8 billion  letter of credit facility for FHA’s Refinance for Borrowers in Negative  Equity Positions program. We recommended that Treasury and FHA  update their estimates of program participation and use the updated  estimates to reassess the terms of the letter of credit facility. The  agencies implemented our recommendation. As a result, Treasury  amended the purchase agreement and deobligated approximately  $7.1 billion dollars, which was returned to the general fund in fiscal  year 2013. training for its staff and obtained assurance from the Office of  Management and Budget that its collection of credit card data  complied with federal requirements. These steps should help ensure  CFPB collects and protects consumer financial data in accordance  with federal requirements.
After the Dodd-Frank Act prohibited certain types of proprietary  trading that had caused large losses for banks, regulators  implemented our recommendation to improve their oversight by  reviewing trading data before issuing final rules to implement the  restriction in December 2013. These rules also identified trading data  some firms will have to report to regulators. As a result, regulators  should have better information to help them reduce the risk that banks  will incur large trading losses.
FHA takes possession of thousands of homes as a result of  foreclosures on FHA-insured mortgages. In June 2013, we found FHA  generally did not take market conditions into account when reducing  list prices for unsold foreclosed properties, but instead generally  followed standardized schedules. We recommended that FHA adopt  practices used by other federally related housing entities, which base  price reduction decisions on property-level information and market  conditions. FHA implemented our recommendations in June 2016,  which could reduce holding times for and improve returns on  foreclosed properties.
Additionally, in response to our November 2011 recommendation that  FHA establish ongoing mechanisms for anticipating potential risks  presented by changing conditions, FHA created credit and operational  risk committees, which have specified tools they use to address  emerging risks. Taking these steps should help FHA more effectively  identify, plan for, and address risks facing the agency.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Lawrance  Evans at (202) 512-8678 or evansl@gao.gov.
section_title: Related GAO Products
subsections: section_title: U.S. Financial Regulatory System
paragraphs: Resolution Plans: Regulators Have Refined Their Review Processes but  Could Improve Transparency and Timeliness. GAO-16-341. Washington,  D.C: April 12, 2016.
Financial Regulation: Complex and Fragmented Structure Could Be  Streamlined to Improve Effectiveness. GAO-16-175. Washington, D.C:  February 25, 2016.
Dodd-Frank Regulations: Impacts on Community Banks, Credit Unions  and Systemically Important Institutions. GAO-16-169. Washington, D.C:  December 30, 2015.
Bank Regulation: Lessons Learned and a Framework for Monitoring  Emerging Risks and Regulatory Response. GAO-15-365. Washington,  D.C: June 25, 2015.
Financial Stability Oversight Council: Further Actions Could Improve the  Nonbank Designation Process. GAO-15-51. Washington, D.C: November  20, 2014.
Financial Stability: New Council and Research Office Should Strengthen  the Accountability and Transparency of Their Decisions. GAO-12-886.  Washington, D.C: September 11, 2012.
Dodd-Frank Act Regulations: Implementation Could Benefit from  Additional Analyses and Coordination. GAO-12-151. Washington, D.C:  November 10, 2011.
Financial Regulation: A Framework for Crafting and Assessing Proposals  to Modernize the Outdated U.S. Financial Regulatory System.  GAO-09-216. Washington, D.C.: January 8, 2009.
section_title: Federal Role in Housing Finance
paragraphs: Federal Housing Finance Agency: Objectives Needed for the Future of  Fannie Mae and Freddie Mac After Conservatorships. GAO-17-92.  Washington, D.C.: November 17, 2016.
Nonbank Mortgage Servicers: Existing Regulatory Oversight Could Be  Strengthened. GAO-16-278. Washington, D.C.: March 10, 2016.
Mortgage Reforms: Actions Needed to Help Assess Effects of New  Regulations. GAO-15-185. Washington, D.C.: June 25, 2015.
Housing Finance System: A Framework for Assessing Potential Changes.  GAO-15-131. Washington, D.C.: October 7, 2014.
Mortgage Financing: FHA’s Fund Has Grown, but Options for Drawing on  the Fund Have Uncertain Outcomes. GAO-01-460. Washington, D.C.:  February 28, 2001.
section_title: Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability
subsections: section_title: Why Area Is High Risk
paragraphs: The U.S. Postal Service (USPS) faces a serious financial situation that is  putting its mission of providing prompt, reliable, and efficient universal  mail services at risk. It reported a net loss of $5.6 billion in fiscal year  2016—its 10th consecutive year of net losses. Additionally, it continues to  face unfunded liabilities that have grown from 99 percent of USPS  revenues in fiscal year 2007 to 169 percent of revenues in fiscal year  2016. These unfunded liabilities—totaling about $121 billion at the end of  fiscal year 2016—consist mostly of retiree health and pension benefit  obligations for which USPS has not set aside sufficient funds to cover.  For example, since September 2010, USPS has not made almost $34  billion in required prefunding retiree health payments, which has led to an  unfunded liability of about $52 billion. USPS’s ability to make payments  to cover its unfunded liabilities is challenged due to (1) continued  expected declines in mail volumes; (2) growing expenses; (3) expiration  of a temporary rate surcharge (which generated $4.6 billion in additional  revenue from its January 2014 inception to its April 2016 discontinuation);  and (4) no planned new major cost-savings initiatives. As a result, it is not  likely that USPS will be able to make all of its required health and pension  payments in fiscal year 2017. of USPS by not saddling it with bills after employees have retired. USPS  retirees participate in the same health and pension benefit programs as  other federal retirees. Thus, if USPS ultimately does not adequately fund  these benefits and if Congress wants these benefits to be maintained at  current levels, funding from the U.S. Treasury and hence the taxpayer  would be needed to continue the benefit at the same levels. Alternatively,  unfunded benefits could pressure USPS to reduce benefits or pay for  postal workers. In July 2009, we added USPS’s financial condition to the  list of high-risk areas needing attention by Congress and the executive  branch to achieve broad-based restructuring.
section_title: What GAO Found
paragraphs: USPS has partially met all five of the criteria for removal from the High- Risk List. Although USPS has taken some steps to improve its financial  situation, it has limited ability to resolve its financial difficulties, in part due  to statutorily defined requirements, such as requirements to maintain 6- day delivery and resistance from external groups. USPS has made efforts  to reduce its physical footprint, grow its shipping and package services,  raise revenue, and reduce the gap between expenses and revenue.  However, these initiatives are insufficient to restore USPS’s financial  viability. USPS has no plans to initiate new major initiatives that would  achieve necessary cost savings—USPS has previously faced resistance  to such efforts from customers and Congress.
USPS’s Five Year Strategic Plan for fiscal years 2017 to 2021 identified  specific legislative changes needed for USPS to return to long-term  financial health. Furthermore, USPS continued to monitor its situation  through public quarterly and annual financial reports that discuss its  financial status and performance, but has also reported that it cannot  secure its near- or long-term financial outlook without the passage of  targeted postal reform legislation. The House Committee on Oversight  and Government Reform approved a bill that addressed some of USPS’s  solvency challenges; however, the bill was not enacted and there  continues to be a lack of consensus about how to address the trade-offs  that are inherent with resolving USPS’s financial difficulties.
section_title: What Remains to Be Done
paragraphs: USPS needs to continue taking action to reduce costs related to its  operations, workforce, and facilities, and to increase revenues so that it  can reduce its net losses, fully make its required payments to fund  employee benefits, repay its debt, and generate capital for investments,  such as replacing its aging vehicle fleet.
Congress and USPS need to agree on a comprehensive package of  actions to improve USPS’s financial viability. These actions include (1)  modifying USPS’s retiree health benefit payments in a fiscally responsible  manner; (2) facilitating USPS’s ability to better align costs with revenues;  and (3) requiring any binding arbitration in the negotiation process for  USPS labor contracts to take USPS’s financial condition into account.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: While USPS’s leadership has been committed to increasing revenue and  reducing expenses in an effort to put USPS on a more stable financial  path, USPS has no plans to initiate new major initiatives that would  achieve necessary cost savings. Although USPS has previously faced  resistance to such efforts from customers and Congress, committing to  major cost-saving initiatives may serve to reiterate the need for broad- based restructuring. The efforts USPS has implemented thus far have  been insufficient to eliminate net losses. For example, a temporary 4.3  percent “exigent” surcharge was implemented to address losses from  decreased mail volume during the Great Recession, which occurred  between December 2007 and June 2009. The surcharge began in  January 2014 and was discontinued in April 2016, generating $4.6 billion  in additional revenue during this period—including $1.1 billion in fiscal  year 2016, $2.1 billion in fiscal year 2015, and $1.4 billion in fiscal year  2014. Furthermore, starting in fiscal year 2011, USPS established  Delivering Results, Innovation, Value, and Efficiency initiatives to reduce  the large gap between revenue and costs, and to implement strategic  initiatives with measurable outcomes.
subsections: section_title: Capacity
paragraphs: and its overall workforce increased in fiscal years 2015 and 2016 due, in  part, to significant volume-growth in shipping and packages (14.1 percent  in fiscal year 2015 and 13.8 percent in fiscal year 2016), which are more  labor intensive to process.
USPS reported that although the 15.8 percent growth in shipping and  packages revenue helped generate additional total revenue of $2.6 billion  (a 3.7 percent increase), package growth also contributed to an increase  of 18,000 employees in fiscal year 2016, and an increase in total  expenses of about $3.1 billion (about 4.2 percent). In addition, although it  experienced net losses, USPS’s compensation expenses increased by 2  percent in fiscal year 2016 due to salary increases and additional work  hours. Furthermore, as part of its efforts to reduce excess capacity, USPS  revised its standards for on-time mail delivery in January 2015 by  increasing the number of days for some mail to be delivered and still be  considered on time. Even with the revised standards, on-time delivery  performance declined significantly, particularly for the second quarter of  fiscal year 2015, a decline USPS attributed to operational changes  enacted in January 2015 and adverse winter weather. Performance has  rebounded since then, but with the rebound came increases in workforce  and mail transportation costs.
section_title: Action Plan
paragraphs: USPS’s Five-Year Strategic Plan for fiscal years 2017 to 2021 outlines its  strategy for achieving financial viability. USPS’s plan summarizes  changes that USPS has made or plans to make, and those that it would  like Congress to address in postal reform legislation. We continue to  believe that legislative action is needed to address USPS’s financial  challenges, and in the interim, as previously noted, USPS has no current  plans to undertake additional major initiatives to achieve significant cost  savings in its operations—USPS has previously faced resistance to such  efforts from customers and Congress.
section_title: Monitoring
paragraphs: USPS continued to monitor its situation through public quarterly and  annual financial reports that discuss its financial status and performance,  including trends USPS expects to become more pronounced and will  significantly impact its current business model. USPS, however, has also  reported that it cannot secure its near- or long-term financial outlook  without the enactment of targeted postal reform legislation.
section_title: Demonstrated Progress
paragraphs: USPS’s actions have demonstrated some progress in achieving cost  savings, as noted above. USPS has reported, however, that despite  these efforts, statutory restrictions on its business model have left it  unable to cover its total costs.
We have issued a number of reports that included strategies and options  for USPS to generate revenue, reduce costs, increase the efficiency of its  delivery operations, and restructure the funding of pension and retiree  health benefits. USPS has already acted on some of these strategies  and options. Nonetheless, we have also reported that USPS’s actions  alone under its existing authority will be insufficient to achieve sustainable  financial viability and that comprehensive legislation is urgently needed to  position USPS to be a sustainable entity.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: USPS improved the usefulness and transparency of its delivery  performance information. USPS updated its website in June 2016 to  include trend data for on-time delivery performance for all 67 postal  districts beginning in the second quarter of fiscal year 2015 to the  current quarter. While this accomplishment will not lead to financial  benefits, the updated website will lead to more transparent and  effective oversight of delivery performance to hold USPS accountable  for meeting its statutory mission to provide service in all areas of the  nation. As a result, USPS performance information is easily  accessible and Postal stakeholders can determine whether delivery  performance is a problem in rural areas.
Congress has taken limited action over the past year to address the  need for postal reform including the following:
A January 2016 hearing titled, “Laying out the Reality of the United  States Postal Service,” held by the Senate Committee on Homeland  Security and Governmental Affairs.
A May 2016 hearing regarding USPS’s ongoing financial challenges  held by the House Committee on Oversight and Government Reform.
The House Committee on Oversight and Government Reform  approved a bill that addressed some of USPS’s solvency challenges;  however, this bill was not enacted.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Lori Rectanus  at (202) 512-2834 or rectanusl@gao.gov.
section_title: Related GAO Products
paragraphs: U.S. Postal Service: Continuing Financial Challenges and the Need for  Postal Reform. GAO-16-651T. Washington, D.C.: May 11, 2016.
U.S. Postal Service: Post Office Changes Suggest Cost Savings, but  Improved Guidance, Data, and Analysis Can Inform Future Savings  Efforts. GAO-16-385. Washington, D.C.: April 29, 2016.
U.S. Postal Service: Financial Challenges Continue. GAO-16-268T.  Washington, D.C.: January 21, 2016.
U.S. Postal Service: Actions Needed to Make Delivery Performance  Information More Complete, Useful, and Transparent. GAO-15-756.  Washington, D.C.: September 30, 2015.
U.S. Postal Service: Status, Financial Outlook, and Alternative  Approaches to Fund Retiree Health Benefits. GAO-13-112. Washington,  D.C.: December 4, 2012.
U.S. Postal Service: Strategies and Options to Facilitate Progress toward  Financial Viability. GAO-10-455. Washington, D.C.: April 12, 2010.
section_title: Management of Federal Oil and Gas Resources
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of the Interior (Interior) has taken some steps to  strengthen how it manages federal oil and gas resources, but has not met  the criteria for removal from our High-Risk List. Interior has not  implemented four of our recommendations to improve the verification of  oil and gas produced from federal leases, and the reasonableness and  completeness of royalty data. Management of federal oil and gas  resources was added it to the High-Risk List in 2011. We identified  challenges in Interior’s management of oil and gas on leased federal  lands and waters. We found that Interior (1) lacked reasonable assurance  that it was collecting its share of revenue from oil and gas produced on  federal lands and waters; (2) continued to experience problems hiring,  training, and retaining sufficient staff to oversee and manage oil and gas  operations on federal lands and waters; and (3) was undertaking a major  reorganization of its oversight of offshore oil and gas management and  revenue collection functions. In 2013, after concluding that Interior had  fundamentally completed its reorganization, we narrowed the high-risk  area to Interior’s revenue collection and human capital challenges. For  this update, we are reopening the third segment based on our February  2016 report, in which we found that Interior’s restructuring of the Bureau  of Safety and Environmental Enforcement (BSEE) has made limited  progress addressing long-standing deficiencies in the bureau’s  investigative, environmental compliance, and enforcement capabilities.
Federal oil and gas resources provide an important source of energy for  the United States; create jobs in the oil and gas industry; and generate  billions of dollars annually in revenues that are shared between federal,  state, and tribal governments. Interior reported collecting over $49 billion  from fiscal years 2011 through 2015 from royalties and other payments.  This makes oil and gas resources one of the federal government’s largest  sources of nontax revenue. Moreover, the April 2010 explosion onboard  the Deepwater Horizon and subsequent oil spill in the Gulf of Mexico  highlighted the importance of Interior’s management of permitting and  inspection processes to ensure operational and environmental safety. oversight responsibilities to two new bureaus—the Bureau of Ocean  Energy Management (BOEM) and BSEE—and assigning the revenue  collection function to a new Office of Natural Resources Revenue  (ONRR). BLM did not restructure its management of onshore federal oil  and gas activities.
BSEE’s mission is to promote safety, protect the environment, and  conserve offshore resources through regulatory oversight and  enforcement. It oversees offshore operations, which includes the authority  to investigate incidents that occur on the outer continental shelf, monitor  operator compliance with environmental stipulations, and take  enforcement actions against operators that violate safety or  environmental standards. Yet more than 5 years after its creation, BSEE  continues to use investigative policies and procedures that predate the  Deepwater Horizon explosion. BSEE’s outdated policies and procedures  do not require planning investigations, gathering and documenting  evidence, and ensuring quality control, potentially undermining the  effectiveness of investigations. Moreover, BSEE’s ongoing restructuring  of its environmental compliance program reverses steps taken to address  post–Deepwater Horizon incident concerns, risking the bureau’s abilities  to oversee environmental compliance. Additionally, BSEE did not review  its maximum daily civil penalty as required by the Outer Continental Shelf  Lands Act.
section_title: What GAO Found
paragraphs: management, we are expanding the Management of Federal Oil and Gas  Resources high-risk area to again include a segment on Interior’s  restructuring of offshore oil and gas oversight.
section_title: What Remains to Be Done
paragraphs: Interior has partially met the criteria to address the revenue collection and  human capital challenges we identified, and has implemented some of  the recommendations we made. However, Interior needs to do more to  meet its responsibilities to manage federal oil and gas resources, and to  maintain leadership commitment in addressing the remaining four criteria.
Leadership Commitment: To address its human capital challenges,  Interior needs to evaluate the effectiveness of incentives such as special  salary rates, analyze hiring time data, and evaluate the bureaus’ training  programs. To enhance Interior’s oversight of oil and gas development,  and fully implement the bureau’s restructuring and effectively oversee  offshore oil and gas development, BSEE leadership needs to take several  steps, such as completing draft policies outlining the responsibilities of its  divisions, and updating and developing procedures to guide them. BSEE  leadership also needs to conduct a risk analysis of its environmental  compliance program.
Capacity: To address its revenue collection challenges, Interior will need  to identify the staffing resources necessary to consistently meet its annual  goals for inspecting and verifying oil and gas production. To address its  human capital challenges, Interior needs to evaluate whether its efforts to  increase compensation paid to key oil and gas staff were effective in  hiring and retaining staff. Interior also needs to fully evaluate the bureaus’  training programs and look for potential opportunities to share training  resources.
Action Plan: To address its revenue collection challenges, Interior needs  to continue its efforts related to its study on automating data collection  from production metering systems. To address its human capital  challenges, Interior needs to track, monitor, and analyze the effectiveness  of the incentives paid to key oil and gas staff. Interior also needs to  analyze data from its new human resources software system in order to  identify steps in the hiring process that may be causing delays. Regarding  training, Interior needs to review training and identify opportunities to  share training resources. measured, and that the federal government is collecting an appropriate  share of oil and gas revenues. To address its human capital challenges,  Interior needs to track and monitor performance metrics for incentive  payments and special salary rates, capture accurate data on hiring time  from a new human resources software system, and evaluate training  programs.
Demonstrated Progress: To address its revenue collection challenges,  Interior needs to continue to effectively implement our related  recommendations as outlined in the areas above. To address its human  capital challenges, Interior must continue to show progress in hiring,  retaining, and training its key oil and gas staff.
section_title: Additional Details on What GAO Found
paragraphs: Overall, Interior has partially met the criteria for leadership commitment,  capacity, action planning, monitoring, and demonstrated progress. All of  the 2017 ratings are the same as the 2015 ratings except for leadership  commitment, which dropped from met to partially met for the human  capital challenges segment, discussed below.
subsections: section_title: Royalty Determination and Collection
paragraphs: Interior has demonstrated leadership commitment to address revenue  collection weaknesses and partially met the remaining four criteria.
subsections: section_title: Leadership Commitment
paragraphs: Mining Services Group to help identify potentially erroneous data  submitted by companies paying royalties. ONRR is also studying whether  it can use automated data collection from metering systems to more  efficiently obtain oil and gas production data used to determine royalties  from companies.
section_title: Capacity
paragraphs: Interior’s capacity to address weaknesses in revenue collection is  uneven. In recent years, Interior has hired offshore inspection staff to  focus primarily on oil and gas measurement inspections. We found in  April 2015 that BSEE came close to meeting its annual inspection goals  for verifying oil and gas production in the Gulf of Mexico for fiscal years  2009 through 2013. On the other hand, for the same time frame, we  found that BLM did not meet its oil and gas production inspection goals,  which officials attributed, in part, to insufficient inspection staff.
section_title: Action Plan
paragraphs: Interior has plans in place to continue implementing our  recommendations aimed at correcting weaknesses in its revenue  collection policies and practices. In November 2014, Interior provided a  briefing document specifying goals and time frames for several areas  related to these weaknesses. For example, in December 2013, we  recommended that BLM issue revised regulations to provide it with  greater flexibility in setting royalty rates and better ensure that the public  receives a fair return from the oil and gas produced from federal leases.  In November 2014, Interior stated that it planned to begin addressing this  issue in fiscal year 2015 by issuing an advanced notice for proposed  rulemaking. In November 2016, Interior amended its regulations to,  among other things, allow for greater flexibility in setting royalty rates.  Interior’s briefing document also specified other goals and time frames for  completing a study on automating data collection from production  metering systems, and for establishing procedures on when to  periodically assess its fiscal system. Interior completed the latter of these  two actions in August 2016.
section_title: Monitoring
paragraphs: implemented the guidance. The new guidance outlines criteria for  approving “commingling” requests—requests to combine oil or gas from  public, state, or private leases prior to royalty measurement—and  identifies considerations for determining whether commingling is in the  public interest. This includes ensuring that BLM has the ability to verify  that production is accurately measured and properly reported. Because it  has not scheduled and completed a review of the effectiveness of the  new commingling guidance after its implementation, BLM does not have  reasonable assurance that its staff are consistently applying the new  guidance, and that staff are able to verify production.
section_title: Demonstrated Progress
paragraphs: Interior has demonstrated progress addressing weaknesses in its  revenue collection policies and practices. As of January 2017, we found  that Interior implemented 42 of 46 recommendations we had made since  September 2008 addressing revenue collection weaknesses, including  those related to oil and gas production verification and royalty data.  However, as mentioned above, Interior has not completed reviewing the  effectiveness of the new commingling guidance. Additionally, in March  2010, we found that Interior’s production accountability program did not  sufficiently address key factors that could affect gas measurement  accuracy, and recommended that Interior establish goals for particular  types of measurement inspections. Interior agreed with the  recommendation, but as of October 2016, it has not fully implemented it.  Without completing this action, Interior cannot be assured that oil and gas  are being reasonably measured and associated royalty payments are  correct.
section_title: Human Capital Challenges
paragraphs: Interior has partially met the five criteria below.
subsections: section_title: Leadership Commitment
paragraphs: The rating for leadership commitment dropped from ‘met’ in 2015 to  ‘partially met’ in 2017. In January 2014, we recommended that Interior  explore expanding its use of hiring incentives and systematically collect  and analyze hiring data. Interior agreed with our recommendations and  began to more systematically collect and analyze hiring data to identify  causes for delays and expedite the hiring process. In November 2014,  Interior senior officials briefed us on planned actions to address the  department’s human capital challenges. As of September 2016, however,  some of these planned actions had not yet been implemented or  completed, as we reported. For example, Interior senior officials told us  that they would implement a performance measure framework to evaluate  the effectiveness of incentives on a quarterly basis beginning in April  2015. However, as of July 2016, a senior official from the Office of Policy,  Management and Budget said these quarterly reviews had not yet begun. had provided limited leadership to facilitate the bureaus sharing training  resources. We also reported that BSEE has not implemented a  certification program for its inspectors, although the Outer Continental  Shelf Safety Oversight Board and Interior Inspector General  recommended it in 2010.
section_title: Capacity
paragraphs: Interior continues to partially meet this criterion. In 2010, we found that  Interior’s bureaus experienced high turnover rates in key oil and gas  inspection and engineering positions. In January 2014, we found that  Interior’s hiring and retention challenges were largely due to lower  salaries and a slow hiring process compared with similar positions in  industry. The fiscal year 2012 attrition rate for petroleum engineers at  BLM was more than 20 percent, or more than double the average federal  attrition rate of 9.1 percent. The attrition rate for other key oil and gas staff  was lower, but still a challenge because some field offices had only a few  employees in any given position, and a single separation could  significantly affect operations. According to Interior officials, these  challenges made it more difficult for some field offices to conduct  oversight activities, including inspecting production facilities.
Since fiscal year 2012, Interior has increased compensation for certain  key oil and gas staff by using special salary rates, incentive payments,  and student loan repayments. During fiscal years 2012 through 2016,  Interior had special salary rates—authorized by Congress in annual  appropriations acts—that allowed it to pay certain staff up to 25 percent  more than their basic pay. In addition, some of the bureaus increased  compensation through other tools, such as incentive payments and  student loan repayments. For example, for fiscal years 2012 through  2014, BLM and BSEE substantially increased the number of employees  receiving a retention incentive payment from 14 to 346 employees. During  the same period, BSEE and BOEM increased the number of staff  receiving a student loan repayment from 25 to 66 employees. Officials  from the three bureaus said that anecdotally they know that efforts to  increase the compensation paid to key oil and gas staff, along with an  industry downturn that reduced private sector hiring, had likely helped  them fill vacancies. Outside of these anecdotal observations, however,  Interior and the bureaus have not evaluated whether their efforts, and the  specific tools they used, were effective in hiring and retaining staff. them information about the overall effectiveness of their training efforts by  measuring the effect on staff’s job performance and comparing program  benefits to training costs.
section_title: Action Plan
paragraphs: Interior continues to partially meet this criterion. Interior does not have a  written action plan summarizing how it will address its human capital  challenges; however, agency officials have described some actions it  plans to take to address these challenges. To evaluate the effectiveness  of the agency’s efforts to increase compensation paid to key oil and gas  staff, such as the use of incentive payments and special salary rates,  officials said in September 2016, that they had developed initial  performance metrics and gathered data for the first three quarters of fiscal  year 2016. Officials said they would continue to track and monitor the  data on a quarterly basis.
To address the lengthy hiring process, officials from the three bureaus  said in June 2016 that they had started analyzing data extracted from a  new human resources software system in order to identify steps in the  hiring process that may be causing delays. Regarding training, a senior  Interior official we interviewed told us in January 2016, that their Interior  Training Directors Council—composed of senior training officials across  Interior—would begin reviewing training across the bureaus and seek to  identify opportunities to share training resources. However, as of June  2016, officials had not reported any progress made by the council, and it  is unclear what, if any, steps the office has taken to review training and  identify opportunities to share training resources. In addition, it is unclear  what, if any, actions the agency will take in response to the  recommendations we issued in September 2016 directing the agency to  develop technical competencies for all key oil and gas staff, and annually  evaluate the bureaus’ training programs and viability of a certification  program for BSEE inspectors.
section_title: Monitoring
paragraphs: Interior continues to partially meet this criterion. Interior and the three  bureaus have taken some steps to reduce hiring times, but did not have  complete and accurate data to identify the causes of delays in the hiring  process. Without reliable data, Interior’s bureaus cannot effectively  implement changes to expedite the hiring process. We recommended in  January 2014 that Interior systematically collect data on hiring times for  key oil and gas positions, ensure the accuracy of the data, and analyze  the data to identify the causes of delays and expedite the hiring process.  In June 2016, officials from the three bureaus said that they had started  analyzing data extracted from a new human resources software system in  order to identify steps in the hiring process that may be causing delays.
Once Interior has the systems in place to capture accurate data on hiring,  the department will be able to monitor hiring times and the causes of  delays in the hiring process.
In addition, Interior officials said in September 2016 that they had  developed initial performance metrics to track and monitor on a quarterly  basis the effectiveness of incentive payments and special salary rates  that the agency has used to try to increase compensation paid to its key  oil and gas staff. These officials also said they had gathered data for the  first three quarters of fiscal year 2016, and would continue to track and  monitor the data on a quarterly basis. However, the agency had not yet  used these data to evaluate the effectiveness of incentives. We  recommended that Interior regularly evaluate the effectiveness of  available incentives, such as special salary rates, the student loan  repayment program, and other incentives in hiring and retaining key oil  and gas staff.
In regards to training, we reported in September 2016 that Interior had not  evaluated training needs or effectiveness as required by law and  regulations, according to officials, and we recommended the agency  annually evaluate the bureaus’ training programs. We also reported that  Interior’s bureaus have not evaluated training needs or effectiveness as  directed by departmental policy. We recommended in September 2016  that the agency develop technical competencies for all key oil and gas  staff, and annually evaluate the bureaus’ training programs and the  viability of a certification program for BSEE inspectors. It is unclear what,  if any, actions the agency will take in response to these  recommendations.
section_title: Demonstrated Progress
paragraphs: Interior continues to partially meet this criterion. In 2015, we reported that  Interior and the three bureaus had taken some actions to address these  hiring and retention challenges, but had not fully used their existing  authorities to supplement salaries and provide other recruitment,  relocation, and retention incentives. staff up to 25 percent more than their basic pay. In September 2016,  Interior described its plans to collect data on the three incentives and  special salary rates in order to measure effectiveness.
Regarding their lengthy hiring process, in January 2014, we reported that  Interior records showed that the average time to hire petroleum engineers  and inspectors generally exceeded 120 calendar days—much longer than  OPM’s target of 80 calendar days. We also found in September 2016 that  each of the three bureaus has taken steps to begin to address their  lengthy hiring process. In 2015, the three bureaus adopted new human  resources software that officials said will provide them with better data to  track their hiring process. In June 2016, officials from the three bureaus  said that they had started analyzing data extracted from this new system  to identify steps in the hiring process that may be causing delays.
Regarding training, we found in March 2010 that Interior had not  consistently and appropriately trained offshore inspection and engineering  staff. In July 2012, we reported that Interior was creating a new training  program for its offshore inspection and engineering staff. However, in  September 2015, BSEE inspectors at four local offices told us that the  offshore training courses BSEE provided them, which were primarily led  by contractors, did not adequately prepare them to perform inspections  because the courses focused on how equipment operates, and did not  teach them how to inspect the equipment. More broadly, we found in  September 2016 that none of the three bureaus had evaluated training  needs or effectiveness as directed by departmental policy. Without  evaluating its bureaus’ training efforts, Interior may not be able to ensure  that its key oil and gas staff are being adequately trained to conduct  oversight, and may be ineffectively and inefficiently spending training  funds.
section_title: Restructuring of Offshore Oil and Gas Oversight
paragraphs: capabilities. Moreover, BSEE’s deficient oversight capabilities continue to  undermine its ability to effectively oversee offshore oil and gas  development.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In response to recommendations we made in April, 2015, Interior  issued updated onshore (1) gas measurement, (2) oil measurement,  and (3) oil and gas site security regulations. These new regulations  should help ensure that oil and gas produced from federal leases are  accurately measured. Accurate measurement is critical for calculating  the royalty payments operators pay the government.
In response to a recommendation we made in July 2012, Interior  reported that the two bureaus, BOEM and BSEE, jointly approved an  information technology plan. This plan, according to Interior  documents, is a roadmap that outlines a framework for deploying  technology resources throughout the organizations in support of  bureau missions, goals, and program priorities.
In response to a recommendation we made in July 2012, BSEE in  August 2013 and BOEM in September 2016 issued human capital  plans.
In response to a recommendation we made in January 2014, Interior  took several actions to bridge the salary gap for key oil and gas  oversight staff. Specifically, BLM, BSEE, and BOEM increased the  number of staff receiving retention, recruitment, or relocation incentive  payments in fiscal year 2014 and in fiscal year 2015 issued guidance  describing which staff should receive these incentives. In addition, in  September 2016, Interior outlined steps it will take to assess the  effectiveness of these incentives by tracking measures such as  turnover and acceptance rates.
Interior also implemented recommendations that we identified as priority  recommendations to the Secretary of Interior.
In response to a recommendation we made in December 2013,  Interior took steps within its authority to revise BLM’s regulations to  provide for flexibility to the bureau to make changes to onshore royalty  rates, similar to that which is already available for offshore leases, to  enhance Interior’s ability to make timely adjustments to the terms for  federal onshore leases. fiscal system. These procedures identified generally when such an  assessment should be done or what changes in the market or industry  would signal that such an assessment should be done.
In response to a recommendation we made in December 2013, the  Secretary of the Interior established documented procedures for  determining whether and how to adjust lease terms for new offshore  leases, including documenting the justification and analysis supporting  any adjustments.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Frank Rusco  at (202) 512-3841 or ruscof@gao.gov.
section_title: Related GAO Products
paragraphs: Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring,  Retention, and Training but Needs a More Evaluative and Collaborative  Approach. GAO-16-742. Washington, D.C.: September 29, 2016.
Oil and Gas Management: Interior’s Bureau of Safety and Environmental  Enforcement has Not Addressed Long-Standing Oversight Deficiencies.  GAO-16-245. Washington, D.C.: February 10, 2016.
Oil and Gas Resources: Interior’s Production Verification Efforts and  Royalty Data Have Improved, but Further Actions Needed. GAO-15-39.  Washington, D.C.: April 7, 2015.
Oil and Gas: Updated Guidance, Increased Coordination, and  Comprehensive Data Could Improve BLM’s Management and Oversight.  GAO-14-238. Washington, D.C.: May 5, 2014.
Oil and Gas Management: Continued Attention to Interior’s Human  Capital Challenges Is Needed. GAO-14-394T. Washington, D.C.:  February 27, 2014.
Oil and Gas: Interior Has Begun to Address Hiring and Retention  Challenges but Needs to Do More. GAO-14-205. Washington, D.C.:  January 31, 2014.
Oil and Gas Resources: Actions Needed for Interior to Better Ensure a  Fair Return. GAO-14-50. Washington, D.C.: December 6, 2013.
Oil and Gas Management: Interior’s Reorganization Complete, but  Challenges Remain in Implementing New Requirements. GAO-12-423.  Washington, D.C.: July 30, 2012.
section_title: Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks
subsections: section_title: Why Area Is High Risk
paragraphs: Climate change is considered by many to be a complex, crosscutting  issue that poses risks to many environmental and economic systems and  presents a significant financial risk to the federal government. According  to the National Research Council (NRC), although the exact details  cannot be predicted with certainty, there is clear scientific understanding  that climate change poses serious risks to human society and many of  the physical and ecological systems upon which society depends.  According to the United States Global Change Research Program  (USGCRP), among other reported impacts, climate change could  threaten coastal areas with rising sea levels, alter agricultural productivity,  and increase the costs of severe weather events as these once “rare”  events potentially become more common and intense due to climate  change. appropriations by the Congressional Research Service, the amount of  inflation-adjusted disaster relief per fiscal year increased from a median of  $6.2 billion for the years 2000 to 2006, to a median of $9.1 billion for the  years 2007 to 2013 (46 percent).
These impacts call attention to areas where government-wide action is  needed to reduce fiscal exposure, because, among other roles, the  federal government (1) leads a strategic plan that coordinates federal  efforts and also informs state, local, and private-sector action; (2) owns or  operates extensive infrastructure vulnerable to climate impacts, such as  defense facilities and federal property; (3) insures property and crops  vulnerable to climate effects; (4) provides data and technical assistance  to federal, state, local, and private-sector decision makers responsible for  managing the impacts of climate change on their activities; and (5)  provides disaster relief aid. As a result, we added Limiting the Federal  Government’s Fiscal Exposure by Better Managing Climate Change  Risks to the High-Risk List in 2013. climate can be viewed as an insurance policy against climate change  risks.
Furthermore, according to NRC and USGCRP, the nation can reduce its  vulnerability by limiting the magnitude of climate change through actions  to limit greenhouse gas emissions. We recognize that (1) the federal  government has a number of efforts underway to decrease domestic  greenhouse gas emissions, and (2) the success of efforts to reduce  greenhouse gas emissions depends in large part on cooperative  international efforts. However, limiting the federal government’s fiscal  exposure to climate change risks will be challenging no matter the  outcome of efforts to reduce emissions, in part because greenhouse  gases already in the atmosphere will continue altering the climate system  for many decades, according to NRC and USGCRP.
section_title: What GAO Found
paragraphs: As of December 2016, the federal government has taken additional steps  since our 2015 update and partially met four of the five criteria for removal  from our High-Risk List—leadership commitment, capacity, action plan,  and monitoring. Specifically, the federal government partially met the  monitoring criterion, which had been rated not met in the 2015 report, and  has taken further action in three criteria that remain partially met— leadership commitment, capacity, and action plan. However, the  demonstrated progress criterion remains not met because it is too early to  determine whether the federal government has made progress.
Various executive orders (E.O.), task forces, and strategic planning  documents identify climate change as a priority and demonstrate  leadership commitment. This leadership commitment needs to be  sustained and enhanced to address all aspects of the federal fiscal  exposure to climate change in a cohesive manner. As we reported in  2015, the federal government has some capacity to address the federal  fiscal exposure to climate change. However, across its actions and  strategies, the federal government has yet to clearly define the roles,  responsibilities, and working relationships among federal, state, local, and  private-sector entities, or how these efforts will be funded, staffed, and  sustained over time. The federal government has taken further action by  establishing a monitoring mechanism to review certain federal agencies’  efforts to reduce some aspects of their fiscal exposure to climate change,  such as building efficiency. However, it is too early to determine the new  mechanism’s effectiveness at demonstrating progress in implementing  corrective measures, or whether the federal government will apply a  similar mechanism across all areas of federal fiscal exposure to climate  change.
section_title: What Remains to Be Done
paragraphs: strategic climate change priorities and develop roles, responsibilities, and  working relationships among federal, state, and local entities.
The federal government has had many climate-related strategic planning  activities that demonstrated leadership commitment, such as the  President’s June 2013 Climate Action Plan and the March 2015  E.O.13693 Planning for Federal Sustainability in the Next Decade.  However, it was unclear how the various planning efforts related to each  other or whether they amounted to a government-wide approach for  reducing federal fiscal exposures. Accordingly, leadership commitment  needs to be enhanced, with increased focus on developing a cohesive  strategy to reduce fiscal exposure across the full range of related federal  activities. Further, the federal government will need to focus on  implementing this strategy—by developing measurable goals; identifying  the roles, responsibilities, and working relationships among federal, state,  and local entities; identifying how such efforts will be funded and staffed  over time; and establishing mechanisms to track and monitor progress.
2017 and 2018 budget requests; and (4) actions to achieve the  government-wide goals for improving the climate resilience of federal  facilities established by E.O. 13693.
Federal flood and crop insurance programs: This entails building  climate resilience into the requirements for federal crop and flood  insurance programs. Although the Federal Emergency Management  Agency (FEMA) has plans to provide updated hazard products and  tools that incorporate climate science on an advisory basis, and the  U.S. Department of Agriculture (USDA) provides information on  voluntary resilience-building actions for producers—policyholders are  not required to use the information to improve their resilience and  reduce federal fiscal exposure. As such, the federal government  needs to address our October 2014 recommendations to incorporate,  as appropriate, forward-looking standards into required minimum flood  elevation standards for insured properties and long-term agricultural  resilience into the allowable agricultural practices required for crop  insurance by the federal government.
Technical assistance to federal, state, local, and private-sector  decision makers: This involves the Executive Office of the President  (EOP) helping federal, state, local, and private sector decision makers  access and use the best available climate information by designating  a federal entity to (1) develop and periodically update a set of  authoritative climate observations and projections for use in federal  decision making, which state, local, and private sector decision  makers could also access to obtain the best available climate  information; and (2) create a national climate information system with  defined roles for federal agencies and nonfederal entities, such as  academic institutions, with existing statutory authority. Additionally, to  assist standards-developing organizations incorporate forward-looking  climate information into building codes and other standards, we  recommended in November 2016 that the Secretary of Commerce  should direct the National Institute of Standards and Technology  (NIST) to convene federal agencies for an ongoing effort to provide  the best available forward-looking climate information to these  standards-developing organizations.
Disaster aid: This involves implementing adequate budgeting and  forecasting procedures to account for the costs of disasters.  Additionally, the federal government has not yet defined the resources  and government-wide structure to implement existing plans for  reducing the federal fiscal exposure to disaster relief by improving  resilience—with clear roles, responsibilities, and working relationships  among federal, state, local, and private-sector entities.
Recognizing that each department and agency operates under its own  authorities and responsibilities—and can therefore be expected to  address climate change in different ways relevant to its own mission— federal efforts have encouraged a decentralized approach, with federal  agencies incorporating climate-related information into their planning,  operations, policies, and programs. While individual agency actions are  necessary, a centralized national strategy driven by a government-wide  plan is also needed to reduce the federal fiscal exposure to climate  change, maximize investments, achieve efficiencies, and better position  the government for success. Even then, such approaches will not be  sufficient unless also coordinated with state, local, and private-sector  decisions that drive much of the federal government’s fiscal exposure.  The challenge is to develop a cohesive approach at the federal level that  also informs state, local, and private-sector action.
The interagency Council on Climate Preparedness and Resilience  (Resilience Council) established by E.O. 13653 recommended many of  the same actions to future administrations in its October 2016 report  Opportunities to Enhance the Nation’s Resilience to Climate Change.  Among other actions, the Resilience Council called on the federal  government to strengthen resilience coordination across federal agencies  and increase the capacity for climate resilience efforts government-wide,  expand incentives and requirements to increase resilience of  infrastructure and buildings, improve awareness and dissemination of  climate information, and enhance the usability of climate tools for decision  making. Importantly, the Resilience Council recognized the need to  coordinate resilience among multiple stakeholders—including all levels of  government, academic institutions, and the private sector—through  partnerships, shared knowledge and resources, and coordinated  strategies, and to evaluate government-wide progress and performance  of resilience investments. These are key elements of our criteria for  removal from the High-Risk List.
section_title: Additional Details on What GAO Found
subsections: section_title: Federal Government as Leader of National Climate Strategic Plan
paragraphs: For its climate strategic planning efforts, the federal government partially  met four of the five criteria—leadership commitment, capacity, action  plan, and monitoring—and received a not met rating for the  demonstrating progress criterion. The federal government is not well  organized to address the fiscal risks to which climate change exposes it,  partly because of the inherently complicated, crosscutting nature of the  issue. The federal government would be better positioned to respond to  the risks posed by climate change if federal efforts were more  coordinated and were directed toward common goals.
As we reported in our 2015 update, the federal government had partially  met our leadership commitment, capacity, and action plan criteria through  several climate-related strategic planning activities, such as the  President’s June 2013 Climate Action Plan and agency adaptation plans,  but it was unclear how the various planning efforts related to each other  or what they amount to as a government-wide approach for reducing  federal fiscal exposures. Additionally, existing planning activities partially  met our capacity criterion because they did not clearly define the roles  and responsibilities among federal, state, and local entities, or the  resources needed to implement these plans. Furthermore, we reported  that the federal government had not met our monitoring and  demonstrated progress criteria because there were no programs to  monitor the effectiveness of strategic planning efforts. among other things, address resilience planning in coordination with  state, local, and tribal communities. Additionally, in April 2016, CEQ and  OMB issued a joint memo that expands their annual review of agency  adaptation plans, to include agency self-assessments and annual, in- person discussions with OMB and CEQ to evaluate certain agencies’  progress implementing their adaptation plans. Furthermore, the October  2016 report Opportunities to Enhance the Nation’s Resilience to Climate  Change from the interagency Resilience Council identified a set of key  opportunities to guide sustained and coordinated action among federal  agencies and invited stakeholders to work with these agencies on a  shared climate resilience agenda.
For its strategic planning efforts, the federal government’s ratings are as  follows.
subsections: section_title: Leadership Commitment
paragraphs: The federal government has partially met this criterion and has taken  additional steps since our last high-risk update. Specifically, E.O. 13693  continues to demonstrate leadership commitment by establishing a  government-wide approach and long-term goals for reducing some  aspects of federal fiscal exposure to climate change. Further, the October  2016 Resilience Council report identified key opportunities to guide  sustained and coordinated action among federal agencies and invited  stakeholders to advance a shared climate resilience agenda. However,  the EOP has yet to implement our May 2011 recommendation to clearly  establish federal strategic climate change priorities that take into  consideration the full range of climate-related activities within the federal  government. Additionally, because of the potential long-term effects of  climate change, leadership needs to be sustained well into the future.
section_title: Capacity
paragraphs: specified federal agencies to convene regional interagency working  groups to, among other things, address resilience planning in  coordination with state, local, and tribal communities. Further, the October  2016 Resilience Council report identifies opportunities to enhance  capacity within the federal government and in local communities, among  others. However, neither the October 2016 Resilience Council report nor  the July 2015 E.O. 13693 implementing guidance specifically addresses  the roles and responsibilities among federal, state, and local entities.  Furthermore, neither the Resilience Council report nor the E.O. 13693  implementing guidance indicates how these efforts will be funded, staffed,  and sustained over time.
section_title: Action Plan
paragraphs: The federal government has partially met this criterion and has taken  additional steps since our last high-risk update. In particular, the  implementing guidance for E.O. 13693 directs agencies to annually  measure and report their progress on, among other things, reducing  greenhouse gas emissions and incorporating climate-resilient design into  new agency buildings in their strategic sustainability performance plans,  starting in June 2016. Additionally, the October 2016 Resilience Council  report identified key opportunities that future administrations could take to  improve climate resilience across three themes: (1) advancing and  applying science-based information, technology, and tools to address  climate risk; (2) integrating climate resilience into federal agency  missions, operations, and culture; and (3) supporting community efforts to  enhance climate resilience. However, it is too early to determine how  effective agency strategic sustainability performance plans under E.O.  13693 will be at reducing aspects of the federal fiscal exposure to climate  change. Moreover, the October 2016 Resilience Council report provides a  broad overview of key opportunities to improve climate resilience, but  does not require implementation of specific actions to address these  opportunities. As a result, it is unclear to what extent the Resilience  Council report will help the government substantially complete actions to  reduce federal fiscal exposure to climate change across the entire range  of related federal activities.
section_title: Monitoring
paragraphs: responsible for implementing E.O. 13693 to advise OMB and CEQ on  agencies’ performance of their E.O. responsibilities. Furthermore, the  April 2016 joint CEQ and OMB memo established a monitoring  mechanism to evaluate agencies’ progress on implementing their  adaptation plans. However, it is too early to determine the effectiveness  of the monitoring mechanisms. Additionally, the federal government has  yet to establish a monitoring mechanism that addresses reducing federal  fiscal exposure to climate change across the entire range of related  federal activities.
section_title: Demonstrated Progress
paragraphs: The federal government has not met the criterion for demonstrating  progress. Fiscal year 2016 is the first year agencies will include  addressing aspects of fiscal exposure to climate change as part of the  annual strategic sustainability performance plan process under E.O.  13693. Therefore, it is too early to determine whether the federal  government has demonstrated progress. Additionally, E.O. 13693 does  not address reducing federal fiscal exposure to climate change across the  entire range of related federal activities, such as federal disaster aid  programs.
section_title: Federal Government as Property Owner
paragraphs: For its role as property owner, the federal government partially met four of  the five criteria—leadership commitment, capacity, action plan, and  monitoring—and received a not met rating for the demonstrating progress  criterion. The federal government owns and operates hundreds of  thousands of facilities and manages millions of acres of land that could be  affected by climate change. For example, DOD oversees more than  555,000 defense facilities and 28 million acres of land, with a replacement  value DOD estimates at close to $850 billion. Federally funded and  managed energy and water infrastructure, and federally managed land— about 650 million acres—are also vulnerable to changes in the climate,  including more frequent and severe droughts and wildfires. For example,  in a November 2016 assessment of federal fiscal risks related to climate  change, OMB and the Council of Economic Advisers (CEA) reported that  18,000 facilities and structures with a replacement value of about $83  billion were in the 100-year floodplain and susceptible to future changes  in flood risk. Further, OMB and CEA reported that annual federal  wildland fire suppression expenditures could increase by about $2.3  billion by 2090.
As of our 2015 update, the federal government had partially met the  criteria for leadership commitment, capacity, and action plan through  various directives for agencies to develop climate change adaptation  plans to integrate consideration of climate change into agency operations  and missions, but leadership needed to be sustained over time and most  agencies had yet to identify specific actions and the resources necessary  to implement these plans. Additionally, we reported that the federal  government had not met our monitoring and demonstrated progress  criteria because there were no programs to monitor the effectiveness and  sustainability of agency adaptation plans. federal projects. Moreover, DOD had yet to implement our May 2014  recommendations to develop a plan for completing climate change  vulnerability assessments and clarifying how to account for climate  change in planning as well as when comparing construction projects for  funding.
Since our 2015 update, the federal government has made progress on  our April 2013 NEPA recommendation, the May 2014 DOD  recommendations, and in other areas. Specifically, in August 2016, CEQ  issued final guidance for agencies on how to consider the effects of  climate change when implementing NEPA. Also, among other actions  responsive to our May 2014 recommendations, DOD issued a January  2016 directive on climate change adaptation and resilience that calls for  DOD components to assess and manage climate change risks to build  DOD’s resilience, when developing plans and implementing procedures.
In addition, the March 2015 E.O.13693 directed certain agencies to  develop and annually update agency strategic sustainability performance  plans, which, among other things, evaluate past performance toward  achieving certain government wide sustainability performance goals— including incorporating climate-resilient design and management  elements into the operation, repair, and renovation of existing agency  buildings and the design of new agency buildings. Finally, the April 2016  joint CEQ and OMB memo expanded their annual review of agency  adaptation plans to include agency self-assessments and annual, in- person discussions with OMB and CEQ to evaluate agencies’ progress  implementing their adaptation plans.
Further, in July 2015, we reported that the January 2015 E.O. 13690,  Establishing a Federal Flood Risk Management Standard and a Process  for Further Soliciting and Considering Stakeholder Input requires all future  federal investments in, and affecting, floodplains to meet a certain  elevation level, as established by the standard. According to E.O.
13690, implementing the standard will ensure that agencies address  current and future flood risk and ensure that projects funded with taxpayer  dollars last as long as intended. Furthermore, since June 2015, OMB  Circular A-11—government-wide guidance to agencies for developing  their annual budgets—has directed agencies to include funding for  resilience in construction and renovation of federal facilities in their fiscal  year 2017 and 2018 budget requests, although the 2018 budget requests  have not been finalized.
For its role as property owner, the federal government’s ratings are as  follows.
subsections: section_title: Leadership Commitment
paragraphs: The rating for this criterion remains at partially met, but the federal  government has taken additional steps since our 2015 update. E.O.  13693 and E.O.13690 reflect continued leadership commitment by  establishing a government-wide approach for reducing fiscal exposure to  climate change for federal facilities and federally-funded infrastructure in  and affecting floodplains. However, because of the potential long-term  effects of climate change, leadership needs to be sustained well into the  future.
section_title: Capacity
paragraphs: The rating for this criterion remains at partially met, but the federal  government has taken additional steps since our 2015 update. Under  E.O. 13693 agencies must, where life-cycle cost effective, incorporate  climate-resilient design and management elements into agency building  operation, renovation, and design of new buildings. Furthermore, OMB’s  revised Circular A-11 directs agencies to include funding for resilience in  construction and renovation of federal facilities in their fiscal year 2017  and 2018 budget requests—although the budget requests for fiscal year  2018 have not been finalized. Moreover, the August 2016 CEQ final  guidance for agencies on how to consider climate change when  implementing NEPA may increase the consistency with which agencies  address climate change in implementing the law. However, it is too early  to determine whether these efforts will effectively build the capacity of the  federal government to reduce its fiscal exposure as a property owner.
section_title: Action Plan
paragraphs: Standard. Moreover, DOD fully implemented one of our May 2014  recommendations by developing a plan and milestones for completing  climate change vulnerability assessments. DOD has also made  progress implementing components of our other recommendations for  considering climate change impacts when planning installations and  comparing construction projects for funding. However, it is too early to  determine whether these plans will effectively reduce federal facilities’  fiscal exposure to climate change.
section_title: Monitoring
paragraphs: The rating for this criterion was upgraded from not met in our 2015 update  to partially met. E.O. 13693 establishes a mechanism for OMB and an  interagency steering committee to monitor agency progress toward  sustainability goals—which include incorporation of climate-resilient  design and management elements into the operation, repair and  renovation of existing agency buildings. Additionally, the April 2016 joint  CEQ and OMB memo to federal agencies established a monitoring  mechanism to evaluate agencies’ efforts to implement their adaptation  plans as part of their annual reviews of the plans. However, it is too early  to determine the effectiveness of these monitoring mechanisms.
section_title: Demonstrated Progress
paragraphs: The federal government has not met the criterion for demonstrating  progress. Fiscal year 2016 is the first year agencies will include  “incorporating climate resilient design and management elements” as a  measurable goal within their annual strategic sustainability performance  plan under E.O. 13693. In addition, fiscal year 2017 is the first year of  agencies’ implementation plans for the Federal Flood Risk Management  Standard. Therefore, it is too early to determine whether the federal  government has demonstrated progress.
section_title: Federal Insurance Programs
paragraphs: As the insurer of crops and property, the federal government partially met  three of the five criteria—leadership commitment, capacity, and action  plan—and received a not met rating for the monitoring and demonstrating  progress criteria. Two important federal insurance efforts— the FEMA  National Flood Insurance Program (NFIP) and USDA’s Federal Crop  Insurance Corporation (FCIC)—face climate change and other challenges  that increase federal fiscal exposure and send inaccurate price signals  about risk to policyholders. For example, a November 2016 OMB and  CEA report found that total annual premium subsidies for crop insurance  could increase by about $4.2 billion in 2080 due to the effects of  unmitigated climate change.
In our 2015 update, we reported that the federal government had partially  met our leadership commitment criterion by commissioning climate  change studies and incorporating climate change adaptation into their  planning, which recognized climate change risks to federal insurers, but  needed to sustain top leadership support and enhance it over time. We  also reported that the federal government had not met the other four  criteria because federal insurers had yet to identify specific actions and  the resources necessary to address challenges inherent to federal  insurance programs—such as how to encourage policyholders to reduce  their long-term exposure to climate change given the short-term nature of  insurance contracts—that may impede the ability of these programs to  minimize long-term federal fiscal exposure to climate change. climate change. USDA did not specify its agreement or disagreement  with our recommendation.
Since our 2015 update, FEMA and USDA have taken additional actions to  understand and respond to climate change risks. For flood insurance, in  February 2016, FEMA publicly released the 2015 Future Conditions Risk  Assessment and Modeling report by the Technical Mapping Advisory  Council (TMAC)—an advisory body created to review the national flood  mapping program and make recommendations to FEMA. The report,  which was required by law, has several recommendations on how FEMA  could incorporate the best-available climate science to assess flood risk  and incorporate such information into its advisory hazard products, tools,  and information for local decision makers. For crop insurance, in May  2016, USDA publicly issued Building Blocks for Climate Smart Agriculture  and Forestry: Implementation Plan and Progress Report for USDA’s  framework for helping farmers, ranchers, and forestland owners respond  to climate change, through voluntary and incentive-based actions.
For its role as the insurer of crops and property, the federal government’s  ratings are as follows.
subsections: section_title: Leadership Commitment
paragraphs: Blocks for Climate Smart Agriculture and Forestry implementation plan  continues leadership commitment by establishing long-term goals for  reducing agricultural GHG emissions by improving producers’ soil health,  nitrogen management, and land management practices, among others— practices that may also reduce federal fiscal exposure for insured crops  by improving agricultural resilience to climate change. However, because  of the potential long-term effects of climate change, leadership needs to  be sustained well into the future.
section_title: Capacity
paragraphs: The rating for this criterion was upgraded from not met in our 2015 update  to partially met. For flood insurance, a senior FEMA official has publicly  stated that the agency will engage with stakeholders and partners to  implement the recommendations of the TMAC report on incorporating  climate science into its products and tools for decision makers.  Additionally, the agency has begun conducting sea level rise pilot studies  and work to identify related research gaps for additional pilot studies,  according to the FEMA official. If FEMA implements the TMAC  recommendations, it could improve climate change–related decision  making capacity at federal, state, and local levels. For crop insurance,  through its 2016 implementation plan, USDA has identified lead agencies  and potential partnerships with public and private sector organizations to  implement certain actions that could also improve agriculture’s resilience  to climate change. Additionally, the USDA Regional Climate Hubs—which  deliver science-based knowledge, practical information, and program  support to farmers, ranchers, and forest landowners—may help improve  producers’ capacity to understand and respond to climate change  impacts. However, neither FEMA nor USDA has identified the resources  necessary to implement the actions outlined in the TMAC report or  USDA’s implementation plan. Additionally FEMA has not identified the  roles, responsibilities, and working relationships among federal, state,  and local entities for its effort to incorporate climate science into its  products and tools.
section_title: Action Plan
paragraphs: actions to address aspects of climate change in federal insurance  programs and have made these actions publicly available. In particular,  for flood insurance, the publicly available TMAC report identified short-  and long-term actions to incorporate climate change science into its  products and tools for decision makers. However, FEMA has yet to  establish milestones and metrics for implementing the  recommendations—although a senior FEMA official stated that the  agency plans to do so. For crop insurance, in its 2016 publicly available  report, USDA has developed clear milestones and metrics to assess its  progress implementing certain actions that could also improve agricultural  resilience to climate change. However, neither federal insurance program  has taken action to implement our October 2014 recommendations to  improve the long-term resiliency of insured structures and crops—through  changes to flood insurance standards or allowable growing practices for  crop insurance.
section_title: Monitoring
paragraphs: The rating for this criterion remains at not met, but the federal government  has taken some steps since our 2015 update. For crop insurance, USDA  established milestones for certain actions from 2016 to 2018 in its 2016  implementation plan, and the plan indicates that USDA is developing a  framework to estimate the adoption of conservation practices and  technologies. However, it is unclear from the plan what mechanisms are  in place for USDA to assess its overall progress toward the department- wide goals, or the frequency of assessment. For flood insurance, FEMA  has yet to establish metrics and milestones within an action plan to  monitor its progress implementing the TMAC recommendations for  addressing climate change in flood insurance.
section_title: Demonstrated Progress
paragraphs: The federal government has not met the criterion for demonstrating  progress. Without clear monitoring mechanisms for FEMA and USDA to  assess their overall progress addressing aspects of climate change in  federal insurance programs, it is unclear how either agency will be able to  demonstrate progress. Additionally, FEMA has indicated that—consistent  with the TMAC recommendations—it should provide its updated hazard  products and tools that incorporate climate science on an advisory—not  regulatory—basis. USDA has also framed its resilience-building actions  for producers as voluntary. As a result, it is unclear to what extent  policyholders in either federal insurance program will use the information  provided to improve their resilience and reduce federal fiscal exposure.
section_title: Technical Assistance to Federal, State, Local, and Private-Sector Decision Makers
paragraphs: As the provider of technical assistance, the federal government partially  met two of the five criteria—leadership commitment and action plan—and  received a not met rating for the capacity, monitoring, and demonstrating  progress criteria. Climate change has the potential to directly affect a  wide range of federal services, operations, programs, and assets, as well  as national security, increasing federal fiscal exposure in many ways.  State, local, and private-sector decision makers can also drive federal  climate-related fiscal exposures because they are responsible for  planning, constructing, and maintaining certain types of vulnerable  infrastructure paid for with federal funds, insured by federal programs, or  eligible for federal disaster assistance. To reduce fiscal exposure, the  federal government has a role to play in providing information to these  decision makers so they can make more informed choices about how to  manage the risks posed by climate change.
As reported in our 2015 update, the federal government had partially met  our leadership commitment and action plan criteria through various  strategic plans and E.O.s that directed certain federal agencies to work  together to provide authoritative and readily accessible climate-related  information, but the roles, responsibilities, and working relationships  among federal, state, local, and private-sector entities were still unclear.  We also reported that the federal government had not met our criteria for  capacity, monitoring, and demonstrated progress because the resources  and government-wide structure necessary to implement plans were not  yet defined, and that because no monitoring programs existed, the ability  to demonstrate progress was limited. to identify the best available climate-related information for state and local  infrastructure planning.
Since our 2015 update, we have completed work related to federal  climate-related technical assistance across several areas—including  federal supply chain climate risk; government-wide options to provide  climate information to federal, state, local, and private sector decision  makers; fisheries management; and private sector use of climate  information in design standards and building codes—and found that  although the federal government had taken some steps, additional efforts  are needed to address the High-Risk List criteria. As a result, the federal  government’s ratings for the High-Risk List criteria under technical  assistance have not changed. of such effects for specific fish stocks. Lastly, in November 2016, we  reported on the use of climate information in design standards and  building codes and found that standards-developing organizations such  as professional engineering societies generally use historical data to  develop standards and face institutional and technical challenges to using  forward-looking climate information, including difficulty identifying the best  available climate information. We found that government-wide  coordination to help address these challenges could present a benefit by  reducing the federal fiscal exposure to the effects of climate change.
For its efforts to provide technical assistance, the federal government’s  ratings are as follows.
subsections: section_title: Leadership Commitment
paragraphs: The rating for this criterion remains at partially met. Top leadership  support for providing climate-related technical assistance has continued  since 2009 through various E.O.s and planning documents, such as the  President’s June 2013 Climate Action Plan, the U.S. Global Change  Research Program’s 2012-2021 strategic plan for climate change  science, and, more recently, the October 2016 Resilience Council report.  However, because of the potential long-term effects of climate change,  leadership needs to be sustained well into the future.
section_title: Capacity
paragraphs: agencies and nonfederal entities with existing statutory authority. The  EOP did not agree or disagree with this recommendation.
We also recently recommended that the EOP and other agencies provide  guidance to help federal agencies and others use climate information.  Specifically, in October 2015, we recommended that, within the EOP, the  CEQ clarify the guidance to federal agencies on developing adaptation  plans, to better assist agencies to include climate-related risks to their  supply chains in their plans. CEQ agreed with this recommendation and  implemented it in April 2016 by issuing a joint memo with OMB which,  among other things, clarified the guidance to federal agencies for the  November 2013 E.O. 13653 on Preparing the United States for the  Impacts of Climate Change. Specifically, the joint memo directs agencies  to include climate-related risks to supply chains in agency adaptation  plans. In September 2016, we recommended that the Secretary of  Commerce direct the National Marine Fisheries Service to develop  guidance on how fisheries managers should incorporate climate  information into different parts of the fisheries management process, such  as fish stock assessments. Commerce agreed with this  recommendation, but has yet to implement it. Lastly, in November 2016,  we reported on using climate information in design standards and building  codes. We found that standards-developing organizations, such as  professional engineering societies, do not generally use forward-looking  climate information and that they face institutional and technical  challenges to doing so, including difficulty identifying the best available  climate information. We also found that government-wide coordination to  help address these challenges could present a benefit by reducing the  federal fiscal exposure to the effects of climate change, and  recommended that the Department of Commerce’s NIST convene federal  agencies for an ongoing effort to provide the best available forward- looking climate information to standards-developing organizations. The  Department of Commerce neither agreed nor disagreed with our  recommendation. Implementing these recommendations would improve  the federal government’s capacity as a provider of technical assistance.
section_title: Action Plan
paragraphs: plans and an E.O. that directed certain federal agencies to work together  to develop and provide authoritative, easily accessible and useable  information on climate preparedness and resilience. Additionally, the  October 2016 Resilience Council report identified several opportunities to  improve aspects of federal technical assistance government-wide, such  as making climate tools easier for decision makers to use. However,  existing plans and reports do not amount to a government-wide plan with  clear milestones and metrics to address the challenges we’ve identified  related to the federal government’s role in providing climate-related  technical assistance, and government and private sector decision makers  accessing and using such information.
section_title: Monitoring
paragraphs: The rating for this criterion remains at not met. The April 2016 joint memo  by CEQ and OMB clarifies the process to monitor progress for certain  agencies on several areas, including technical assistance. However,  there are still no programs or mechanisms to monitor government-wide  progress in addressing the challenges we’ve identified related to the  federal government’s role in providing climate-related technical  assistance. These challenges include clarifying the roles, responsibilities,  and working relationships among federal, state, local, and private-sector  entities; identifying the necessary resources and establishing the  government-wide structure necessary to implement plans; and  addressing the fragmentation of federal climate information across  individual agencies that use the information in different ways to meet their  missions.
section_title: Demonstrated Progress
paragraphs: The rating for this criterion remains at not met. Without a program or  mechanism to monitor government-wide action addressing relevant  challenges, it is unclear how the federal government can demonstrate  progress.
section_title: Disaster Aid and Resilience
paragraphs: As the provider of disaster aid, the federal government partially met two of  the five criteria—leadership commitment, and capacity—and received a  not met rating for the action plan, monitoring, and demonstrating progress  criteria. Multiple factors, including increased disaster declarations, climate  change effects, and changing development patterns increase federal  fiscal exposure to severe weather events, which have cost the nation  hundreds of billions of dollars over the past decade. For example, from  fiscal years 2005 through 2014, the federal government obligated at least  $277.6 billion across 17 federal department and agencies for disaster  assistance programs and activities. Such federal disaster aid functions  as the insurance of last resort in certain circumstances because whatever  is not covered by insurance or built to be resilient to extreme weather  increases the federal government’s implicit fiscal exposure through  disaster relief programs. For example, a November 2016 OMB and CEA  report found that total annual expected disaster relief for hurricane  damage could increase by about $50 billion by 2075. the risk of facing a large fiscal exposure at any time. Moreover, fiscal  constraints would make it more difficult for the federal government to  respond effectively in the future and such expenses could affect  resources available for other key government programs.
Since our 2015 update, the federal government has made some progress  addressing its federal fiscal exposure to disaster relief by improving  resilience. Specifically, in our July 2015 report that examined disaster  resilience efforts following Hurricane Sandy, we found that the President  and Congress had taken multiple steps to enhance the federal  government’s focus on disaster resilience through E.O.s, presidential  policy directives, and enacted legislation. For example, we reported that  E.O. 13690, Establishing a Federal Flood Risk Management Standard  and a Process for Further Soliciting and Considering Stakeholder Input  requires all future federal investments in, and affecting, floodplains to  meet a certain elevation level, as established by the standard.  Specifically, the standard provides 3 approaches that federal agencies  can now use to establish the flood elevation and floodplain for  consideration in their decision making: (1) climate-informed science  approach, (2) adding 2-3 feet of elevation to the 100-year floodplain, and  (3) using the 500-year floodplain. lifelines—such as communications, energy, transportation, and water  management systems. As a result, we recommended that the Mitigation  Framework Leadership Group (MitFLG)—an intergovernmental body to  help coordinate hazard mitigation efforts of relevant local, state, tribal,  and federal organizations—establish an investment strategy to identify,  prioritize, and implement federal investments in disaster resilience.
As part of its response to this priority recommendation, FEMA developed  a high-level work plan to guide MitFLG’s development of a disaster  resilience investment strategy. Additionally, in May 2016, MitFLG solicited  stakeholder input on its design of a new Federal Mitigation Investment  Strategy. According to MitFLG, the strategy will identify, prioritize, and  guide federal investments in disaster resilience and hazard mitigation- related activities and include recommendations to the President and  Congress on how the nation should prioritize future investments.  Additionally, the October 2016 Resilience Council report identified several  opportunities to further integrate climate resilience into federal agency  missions and improve federal support for communities’ resilience-building  efforts, such as expanding incentives and requirements to increase the  resilience of infrastructure and building communities’ capacity for climate  resilience efforts.
For its role as the provider of disaster aid, the federal government’s  ratings are as follows.
subsections: section_title: Leadership Commitment
paragraphs: The rating for this criterion remains at partially met. Top leadership has  sustained support since 2009 through various E.O.s, such as E.O. 13690,  and other documents, such as the October 2016 report on opportunities  to enhance the nation’s resilience. However, because of the potential  long-term effects of climate change, leadership needs to be sustained  well into the future.
section_title: Capacity
paragraphs: identified three potential options for determining how a state, territory, or  tribal government qualifies for federal disaster assistance. Additionally, in  January 2016, FEMA solicited comments on implementing individualized  deductibles for states, territories, and Indian tribes to qualify for disaster  assistance under its Public Assistance program. FEMA is considering  requiring states, territories, and Indian tribes to demonstrate satisfaction  of a predetermined level of financial or other commitment before FEMA  would provide financial assistance to them through this program. As of  October 2016, FEMA was considering comments received on its  proposal. Further, in March 2015, FEMA updated its guidance for state  hazard mitigation plans to include a summary of the likelihood of future  hazard events and changing future conditions, such as climate change,  as a condition for receiving certain types of non-emergency disaster  assistance. However, the federal government has yet to implement  adequate budgeting and forecasting procedures to account for the costs  of disasters. Additionally, the federal government has not yet defined the  resources and government-wide structure to implement existing plans for  reducing the federal fiscal exposure by improving resilience—with clear  roles, responsibilities, and working relationships among federal, state,  local, and private-sector entities.
section_title: Action Plan
paragraphs: The rating for this criterion remains at not met. As we mentioned  previously, the federal government has taken steps to develop an action  plan for improving resilience through developing the Federal Mitigation  Investment Strategy. However, because a draft of this strategy is not yet  available, it is too soon to evaluate it as an action plan to address federal  fiscal exposure through disaster aid. Additionally, although the October  2016 Resilience Council report identifies several opportunities to improve  federal and local climate resilience, it does not meet several action plan  characteristics from our high-risk criterion, such as establishing goals and  performance measures, developing a plan with clear milestones and  metrics, and ensuring there are processes for reporting results, among  others. As a result, it is unclear to what extent the October 2016 report  will help the government substantially complete actions to reduce federal  fiscal exposure to climate change as the provider of disaster aid.
section_title: Monitoring
paragraphs: The rating for this criterion remains at not met. The federal government  has yet to implement programs or mechanisms to monitor the  effectiveness of the measures identified across existing plans and  standards.
section_title: Demonstrated Progress
paragraphs: plans and standards, the federal government cannot demonstrate  progress in implementing corrective measures.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In response to a recommendation we made in May 2014, the Office of  the Secretary of Defense (OSD) and the services took a number of  actions from September 2014 to July 2015 to develop a project plan  and milestones for completing DOD’s screening-level climate change  vulnerability assessment. OSD also took action to direct the services  to develop plans and milestones that describe how they intend to use  the data collected through the assessment to support climate change  adaptation planning. By implementing our recommendation, OSD and  the services can now inform the department’s decision makers about  the vulnerabilities of DOD facilities and missions to the potential  impacts of climate change. (GAO-14-446)
In response to a recommendation we made in October 2015, CEQ  and OMB issued an April 2016 joint memo on climate adaptation  planning that clarified the guidance for E.O. 13653 to include climate- related risks to supply chains in agency adaptation plans, among  other things. (GAO-16-32)
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Alfredo  Gómez Director, Natural Resources and Environment, (202)512-3841 or  gomezj@gao.gov.
section_title: Related GAO Products
paragraphs: Climate Change: Improved Federal Coordination Could Facilitate Use of  Forward-Looking Climate Information in Design Standards, Building  Codes, and Certification. GAO-17-3. Washington, D.C.: November 30,  2016.
Federal Fisheries Management: Additional Actions Could Advance Efforts  to Incorporate Climate Information into Management Decisions.  GAO-16-827. Washington, D.C.: September 28, 2016.
Federal Disaster Assistance: Federal Departments and Agencies  Obligated at Least $277.6 Billion during Fiscal Years 2005 through 2014.  GAO-16-797. Washington, D.C.: September 22, 2016.
Polar Weather Satellites: NOAA Is Working to Ensure Continuity but  Needs to Quickly Address Information Security Weaknesses and Future  Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.
Climate Information: A National System Could Help Federal, State, Local,  and Private Sector Decision Makers Use Climate Information.  GAO-16-37. Washington, D.C.: December 8, 2015.
Federal Supply Chains: Opportunities to Improve the Management of  Climate-Related Risks. GAO-16-32. Washington, D.C.: October 27, 2015.
Hurricane Sandy: An Investment Strategy Could Help the Federal  Government Enhance National Resilience for Future Disasters.  GAO-15-515. Washington, D.C.: July 30, 2015.
Climate Change: Better Management of Exposure to Potential Future  Losses Is Needed for Federal Flood and Crop Insurance. GAO-15-28.  Washington, D.C.: November 20, 2014.
Climate Change Adaptation: DOD Can Improve Infrastructure Planning  and Processes to Better Account for Potential Impacts, GAO-14-446.  Washington, D.C.: May 30, 2014.
section_title: Improving the Management of IT Acquisitions and Operations
subsections: section_title: Why Area Is High Risk
paragraphs: Although the executive branch has undertaken numerous initiatives to  better manage the more than $80 billion that is annually invested in  information technology (IT), federal IT investments too frequently fail or  incur cost overruns and schedule slippages while contributing little to  mission-related outcomes. We have previously testified that the federal  government has spent billions of dollars on failed IT investments. These  investments often suffered from a lack of disciplined and effective  management, such as project planning, requirements definition, and  program oversight and governance. In many instances, agencies have  not consistently applied best practices that are critical to successfully  acquiring IT. In this regard, we have identified nine critical factors  underlying successful major acquisitions, such as program officials  actively engaging with stakeholders and staff having the necessary  knowledge and skills.
Nonetheless, agencies continue to have IT projects that perform poorly.  Such projects have often used a “big bang” approach—that is, projects  are broadly scoped and aim to deliver functionality several years after  initiation. According to the Defense Science Board, this approach is often  too long, ineffective, and unaccommodating of the rapid evolution of IT.  Further, it is inconsistent with Office of Management and Budget (OMB)  guidance directing that IT investments deliver functionality in 6-month  increments. In August 2016, we reported that approximately half of the  software projects across selected agencies were following this guidance.
Federal IT projects have also failed due to a lack of oversight and  governance. Executive-level governance and oversight across the  government has often been ineffective, specifically from chief information  officers (CIO). However, we have reported that some CIOs’ authority is  limited in that not all CIOs have the authority to review and approve the  entire agency IT portfolio.
Recognizing the severity of issues related to the government-wide  management of IT, in December 2014, Congress enacted IT acquisition  reform provisions (commonly referred to as the Federal Information  Technology Acquisition Reform Act or FITARA) as part of the Carl Levin  and Howard P. ‘Buck’ McKeon National Defense Authorization Act for  Fiscal Year 2015. Among other things, the law requires action to: (1)  consolidate federal data centers, (2) enhance transparency and improve  risk management, (3) enhance agency CIO authority, (4) review IT  investment portfolios, (5) expand training and use of IT acquisition  cadres, (6) purchase software government-wide, and (7) maximize the  benefit of federal strategic sourcing.
section_title: What GAO Found
paragraphs: OMB and federal agencies’ efforts to improve the management of IT  acquisitions and operations have resulted in meeting one of the five  criteria for removal from our High-Risk List—leadership commitment— and partially meeting the remaining four criteria—capacity, action plan,  monitoring, and demonstrated progress. Specifically, OMB, in its  leadership role in addressing this high-risk area, has demonstrated its  commitment by issuing guidance for agencies implementing FITARA,  optimizing federal data centers, and acquiring and managing software  licenses. investments by fully implementing the CIO authorities described in  FITARA and ensuring that program staff have the necessary knowledge  and skills to acquire IT. Further work is also needed to establish action  plans to modernize or replace obsolete IT investments. Regarding  monitoring of IT investments, agencies need to improve how their CIOs  assess investment risk and how they report incremental development  status. Finally, additional demonstrated progress is needed by OMB and  agencies to (1) address our open recommendations related to IT  acquisitions and operations, (2) deliver functionality every 12 months on  major acquisitions, and (3) achieve planned IT portfolio and data center  consolidation savings.
section_title: What Remains to Be Done
paragraphs: To help address the management of IT investments, OMB and federal  agencies should continue to expeditiously implement the requirements of  FITARA. While OMB’s June 2015 FITARA implementation guidance  provides a solid foundation for implementing the law and addresses the  actions agencies are to take in regard to several initiatives that we have  identified as high risk, OMB will need to provide consistent oversight to  ensure that agency actions are completed and the desired results are  achieved. Doing so should continue to improve the transparency and  management of IT acquisitions and operations, as well as increase the  authority of CIOs to provide needed direction and oversight.
Beyond implementing FITARA and OMB’s guidance to improve the  capacity to address our high-risk area, selected agencies will also need to  implement our recent recommendations related to improving their IT  workforce planning practices. When fully implemented, these key  practices should better position agencies to efficiently make decisions  that cross lines of expertise and improve their ability to assess and  address gaps in knowledge and skills that are critical to the success of  major IT acquisitions.
Further, agencies will need to establish action plans to modernize or  replace obsolete IT investments. By establishing such plans, agencies  can reduce the risk of continuing to maintain investments that have  outlived their effectiveness and are consuming resources that outweigh  their benefits.
To improve how they monitor the acquisition and operations of IT  investments, federal agencies will need to implement our  recommendations to address weaknesses in their reporting of investment  risk and incremental development implementation on the IT Dashboard.  Doing so will provide OMB and agencies with increased transparency and  oversight of the government’s billions of dollars in IT investments.
Finally, initial progress has been made in addressing this high-risk area,  including implementation of 46 percent of our prior recommendations.  However, the remaining recommendations include 17 priority  recommendations to agencies to, among other things, report all data  center consolidation cost savings to OMB, address weaknesses in their  management of software licenses, and improve their implementation of  PortfolioStat. OMB and agencies need to take additional actions to (1)  implement at least 80 percent of our recommendations related to the  management of IT acquisitions and operations, (2) ensure that a  minimum of 80 percent of the government’s major acquisitions deliver  functionality every 12 months, and (3) achieve at least 80 percent of the  over $6 billion in planned PortfolioStat savings and 80 percent of the  more than $5 billion in savings planned for data center consolidation. It  will be important for OMB and agencies to continue to make  demonstrated progress against these metrics in order to more effectively  and efficiently invest in IT, reduce the risk of major acquisitions, and  achieve additional cost savings.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: OMB and the Federal CIO have demonstrated leadership commitment.  Specifically, OMB’s June 2015 guidance for implementing FITARA  addresses actions for agencies to take in several IT management areas  we have identified as high risk, such as reviewing of poorly performing  investments, reporting on investment risk, consolidating data centers,  managing agencies’ IT portfolios, and purchasing government-wide  software licenses. For example, OMB’s guidance reiterates the  requirement for agencies to hold TechStat sessions—face-to-face  meetings between OMB and agency leadership to terminate or turn  around IT investments that are failing or are not producing results—and  also requires agencies to report quarterly on the root causes of  performance issues, to develop corrective action plans, and to establish a  timeline for implementing the corrective actions.
OMB also released more specific guidance on acquiring and managing  software licenses and operating federal data centers—two areas that we  identified in our 2015 high-risk report as needing attention. Specifically, in  June 2016, OMB issued guidance that requires agencies to maintain and  analyze an agency-wide inventory of software licenses to ensure  compliance with software licensing agreements, consolidate redundant  applications, and identify other cost savings opportunities. Regarding  federal data centers, in August 2016, OMB issued a memorandum that  established the Data Center Optimization Initiative, noting that this new  initiative would supersede the Federal Data Center Consolidation  Initiative started in 2010. Among other things, OMB’s guidance requires  agencies to develop and report on data center strategies to consolidate  inefficient infrastructure, optimize existing facilities, improve security  posture, save money, and transition to more efficient infrastructure.  OMB’s memorandum also establishes metrics for data center optimization  and targets to be achieved by the end of fiscal year 2018.
In addition, the Federal CIO and OMB senior staff members have  routinely met with us over the last 2 years to discuss their plans and  progress in addressing this high-risk area. According to these officials,  and as indicated through its actions, OMB is committed to demonstrating  sustained progress in addressing this high-risk area. Going forward, it will  be important for OMB to maintain its current level of top leadership  support and commitment to ensure that agencies continue to successfully  execute OMB’s guidance on implementing FITARA and related IT  initiatives.
section_title: Capacity
paragraphs: OMB and federal agencies partially met the criterion for having the  capacity to improve the management of IT acquisitions and operations.  Specifically, OMB’s June 2015 guidance addresses how agencies are to  implement FITARA’s provisions related to enhancing the authority of  federal CIOs. Among other things, OMB provided direction on enabling the CIOs’ role to integrate IT with the capabilities they  support wherever IT may affect functions, missions, or operations;  strengthening agency CIOs’ accountability for IT cost, schedule,  performance, and security; and  strengthening the relationship between agency CIOs and bureau  CIOs.
Further, OMB’s guidance includes several actions that agencies are to  take to establish a basic set of roles and responsibilities (referred to as  the “common baseline”) for CIOs and other senior agency officials that  are needed to implement the authorities described in the law. For  example, agencies are to conduct a self-assessment to identify where  they conform to the common baseline and where they deviate. OMB  guidance also requires agencies to annually update their self-assessment  and report their progress reaching FITARA implementation milestones.  Agencies’ first updates were due by April 30, 2016, and additional  updates are due on an annual basis thereafter. As of December 2016, 19  of 24 major federal agencies had made their FITARA milestone status  information publicly available, as required by OMB; however, all 19  agencies had milestones that were still in progress or not yet started.
In addition, another area where agencies can improve their capacity to  acquire IT investments is in assessing IT workforce skills gaps.
Specifically, in November 2016, we reported that five selected agencies  had not consistently applied key workforce planning steps and activities  that help to ensure that program staff members have the knowledge and  skills critical to successfully acquire IT investments. For example, four  agencies had not demonstrated an established IT workforce planning  process. The weaknesses identified were due, in part, to agencies lacking  comprehensive policies that required such activities, or failing to apply the  policies to IT workforce planning. We concluded that, until these  weaknesses are addressed, the agencies risk not adequately assessing  and addressing gaps in knowledge and skills that are critical to the  success of major acquisitions. Accordingly, we recommended that the five  selected agencies address the IT workforce planning practices that we  identified as having weaknesses.
section_title: Action Plan
paragraphs: OMB and federal agencies have partially met the criterion for establishing  an action plan to address this high-risk area. In addition to requiring  agencies to conduct self-assessments, OMB’s June 2015 FITARA  implementation guidance required agencies to submit a plan describing  the changes they will make to ensure that common baseline  responsibilities are implemented. These plans are to address the areas of  IT management that we have identified as high risk, such as reviewing  poorly performing investments, managing agencies’ IT portfolios, and  implementing incremental development. For example, according to  OMB’s June 2015 guidance, agencies’ plans are required to define IT  processes and policies which ensure that the CIO certifies that IT  investments are adequately implementing incremental development. consistently meet OMB’s FITARA implementation deadlines going  forward. Further, effectively implementing these plans will be critical to  ensuring that agencies are able to effectively manage their IT investments  and that CIOs have the authorities required under FITARA. We have  ongoing work reviewing agency self-assessments and FITARA  implementation plans, including the extent to which agencies have  defined the role of the CIO in accordance with federal law and guidance.
Significant work also remains for federal agencies to establish action  plans to modernize or replace obsolete IT investments. Specifically, in  May 2016, we reported that many agencies were using systems which  had components that were, in some cases, at least 50 years old.  For  example, we determined that the Department of Defense (DOD) was  using 8-inch floppy disks in a legacy system that coordinates the  operational functions of the nation’s nuclear forces. In addition, the  Department of the Treasury was using assembly language code—a  computer language initially used in the 1950s and typically tied to the  hardware for which it was developed. Table 5 provides examples of  legacy systems across the federal government that agencies report are  30 years old or older and use obsolete software or hardware, and  identifies those that do not have specific plans with time frames to  modernize or replace these investments.
To address this issue, we recommended that 12 agencies identify and  plan to modernize or replace legacy systems, including establishing time  frames, activities to be performed, and functions to be replaced or  enhanced.  Most agencies agreed with our recommendations or had no  comment.
section_title: Monitoring
paragraphs: OMB and federal agencies have partially met the criterion for monitoring  efforts to address this high-risk area. Specifically, OMB took action to  improve its use of TechStat sessions, which are intended to increase  accountability and transparency and to improve investment performance.  We previously reported that the number of TechStats that OMB and  selected agencies had performed represented only a small percentage  (33 percent) of the number of IT investments with a medium- or high-risk  CIO rating.  OMB’s June 2015 FITARA implementation guidance  strengthened the TechStat process by requiring agencies to hold a  TechStat session on any investment that has a high-risk CIO rating for 3  consecutive months, beginning on July 1, 2015. As a result, OMB and  agencies will be able to more quickly intervene to turn around, halt, or  terminate troubled IT projects. government-wide and agency-specific progress towards meeting  applicable optimization targets, and  cumulative cost savings and cost avoidance realized.
OMB’s efforts to expand the IT Dashboard should continue to increase  transparency into government-wide and agency-specific progress on this  important IT initiative.
However, significant work still remains for federal agencies to improve  their monitoring of IT investments through their CIO risk assessments on  the IT Dashboard. Specifically, in June 2016, we reported that our  assessments of the risk ratings showed more risk than did the associated  CIO ratings.  In particular, of the 95 investments reviewed, our  assessments matched the CIO ratings 22 times, showed more risk 60  times, and showed less risk 13 times. Figure 10 summarizes how our  assessments compared to the select investments’ CIO ratings. in IT are not receiving the appropriate levels of oversight. Accordingly, we  made 25 recommendations to 15 agencies to improve the quality and  frequency of their CIO ratings. Most agencies agreed with our  recommendations or had no comment.
Another area of concern regarding the monitoring of IT acquisitions is  agencies’ reported use of incremental development. In August 2016, we  reported on 7 selected agencies’ software development projects and  determined that the percentage delivering functionality every 6 months  was reported at 45 percent for fiscal year 2015 and planned for 54  percent in fiscal year 2016.  However, significant differences existed  between the delivery rates that the agencies reported to us and what they  reported on the IT Dashboard. For example, the percentage of software  projects delivering every 6 months that was reported to us by the  Department of Commerce was about a 42 percentage point decrease  from what was reported on the IT Dashboard. In contrast, DOD reported  to us a 55 percentage point increase from what was reported on the IT  Dashboard. Figure 11 compares what the 7 agencies reported on the IT  Dashboard and what numbers they reported to us.
Improving the Management of IT Acquisitions  and Operations The Department of Defense did not provide requested information in time to verify the information  reported for a sample of projects.
We reported that the significant differences in delivery rates were due, in  part, to agencies having different interpretations of OMB’s guidance on  reporting software development projects and because the information  reported to us was generally more current than the information reported  on the IT Dashboard. We concluded that, until the inconsistences in the  information reported to us versus the information provided on the IT  Dashboard are addressed, the seven agencies we reviewed are at risk  that OMB and key stakeholders may make decisions regarding agency  investments without the most current and accurate information.  Accordingly, we made 12 recommendations to 8 agencies to improve  their reporting of incremental data on the IT Dashboard, among other  things. Most agencies agreed with our recommendations or did not  comment.
section_title: Demonstrated Progress
paragraphs: OMB and federal agencies partially met the criterion for demonstrating  progress in improving the management of IT acquisitions and operations.  In our 2015 high-risk report, we noted that OMB and agencies would  need to demonstrate government-wide progress in the following key  areas:
OMB and agencies should, within 4 years, implement at least 80  percent of our recommendations related to managing IT acquisitions  and operations.
Agencies should ensure that a minimum of 80 percent of the  government’s major acquisitions deliver functionality every 12 months.
Agencies should achieve no less than 80 percent of the over $6 billion  in planned IT portfolio savings and 80 percent of the more than $5  billion in savings planned for data center consolidation.
Between fiscal years 2010 and 2015, we made 803 recommendations to  OMB and federal agencies to address shortcomings in IT acquisitions and  operations, including many to improve the implementation of the recent  initiatives and other government-wide, cross-cutting efforts. As of  December 2016, about 46 percent of these recommendations had been  fully implemented. This is an additional 23 percent compared to the  percentage we reported in our 2015 high-risk report. For example, in  August 2016, the National Aeronautics and Space Administration (NASA)  addressed our priority recommendation to report its data center  consolidation cost savings and avoidances—totaling approximately $42  million between fiscal years 2012 through 2016—to OMB. In fiscal year  2016, we made 202 new recommendations, thus further reinforcing the  need for OMB and agencies to address the shortcomings in IT  acquisitions and operations. Table 6 summarizes OMB’s and agencies’  implementation of our recommendations. Following the table, figure 12  summarizes OMB’s and agencies’ implementation of our  recommendations against the 80 percent target. functions. In November 2013, we reported that agencies continued  to identify duplicative spending as part of PortfolioStat; however,  weaknesses existed in agencies’ implementation of the initiative, such  as limitations in the CIOs’ authority. In April 2015, we reported that,  although agencies had achieved approximately $1.1 billion in  PortfolioStat savings, inconsistencies in OMB’s and agencies’  reporting made it difficult to reliably measure progress in achieving  savings. In total, our 2 reports made 69 recommendations to  improve OMB and agencies’ implementation of PortfolioStat; and as  of December 2016, 7 of our recommendations had been  implemented.
In addition, while agencies have made progress on efforts to ensure that  the government’s major acquisitions deliver functionality every 12 months,  additional work is needed. Specifically, in August 2016, we determined  that 7 selected agencies reported delivering functionality at least every  12 months on 77 percent of their projects for fiscal year 2015. However,  as previously stated, there were also inconsistencies with the selected  agencies’ reporting of their incremental development status and we made  recommendations to the agencies to address these issues. It will be  critical for agencies to continue to improve their use of incremental  development in order to reduce the risk that their projects will not meet  cost, schedule, and performance goals and improve their reporting to  better ensure that project decision making is based on current and  accurate information. operational IT investments. Regarding the $6 billion in planned  PortfolioStat savings identified in our 2015 high-risk report, agencies  reported achieving approximately $1.4 billion in savings from fiscal years  2012 through 2015, or approximately 24 percent of planned PortfolioStat  savings. Further, in March 2016, we reported that agencies had  achieved an estimated $2.8 billion in cost savings and avoidances related  to their data center consolidation efforts from fiscal years 2011 to 2015.  This is approximately 51 percent of the $5.3 billion planned savings  identified in our 2015 high-risk report.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In July 2016, Congress enacted the MEGABYTE Act of 2016, which  contained provisions to improve the management of software licenses.  The act requires OMB to direct agency CIOs to, among other things,  establish a comprehensive inventory of software license agreements and  analyze software usage and other data to make cost-effective decisions.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact David A.  Powner at (202) 512-9286 or pownerd@gao.gov or Carol Harris at (202)  512-4456 or harrisc@gao.gov.
section_title: Related GAO Products
paragraphs: IT Workforce: Key Practices Help Ensure Strong Integrated Program  Teams; Selected Departments Need to Assess Skill Gaps. GAO-17-8.  Washington, D.C.: November 30, 2016.
Information Technology: Agencies Need to Improve Their Application  Inventories to Achieve Additional Savings. GAO-16-511. Washington,  D.C.: September 29, 2016.
Information Technology Reform: Agencies Need to Increase Their Use of  Incremental Development Practices. GAO-16-469. Washington, D.C.:  August 16, 2016.
Digital Service Programs: Assessing Results and Coordinating with Chief  Information Officers Can Improve Delivery of Federal Projects.  GAO-16-602. Washington, D.C.: August 15, 2016.
Information Technology: Better Management of Interdependencies  between Programs Supporting 2020 Census Is Needed. GAO-16-623.  Washington, D.C.: August 9, 2016.
IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their  Major Investments. GAO-16-494. Washington, D.C.: June 2, 2016.
Information Technology: Federal Agencies Need to Address Aging  Legacy Systems, GAO-16-468. Washington, D.C.: May 25, 2016.
DOD Major Automated Information Systems: Improvements Can Be  Made in Reporting Critical Changes and Clarifying Leadership  Responsibility. GAO-16-336. Washington, D.C.: March 30, 2016.
Data Center Consolidation: Agencies Making Progress, but Planned  Savings Goals Need to Be Established .  GAO-16-323. Washington, D.C.: March 3, 2016.
Information Technology Reform: Billions of Dollars in Savings Have Been  Realized, but Agencies Need to Complete Reinvestment Plans.  GAO-15-617. Washington, D.C.: September 15, 2015.
section_title: Improving Federal Management of Programs that Serve Tribes and Their Members
subsections: section_title: Why Area Is High Risk
paragraphs: For nearly a decade, we, along with inspectors general, special  commissions, and others, have reported that federal agencies have  ineffectively administered Indian education and health care programs and  inefficiently fulfilled their responsibilities for managing the development of  Indian energy resources. In particular, we have found numerous  challenges facing the Department of the Interior’s (Interior) Bureau of  Indian Education (BIE) and Bureau of Indian Affairs (BIA)—both under the  Office of the Assistant Secretary for Indian Affairs (Indian Affairs)—and  the Department of Health and Human Services’ (HHS) Indian Health  Service (IHS), in administering education and health care services, which  put the health and safety of American Indians served by these programs  at risk. These challenges included poor conditions at BIE school facilities  that endangered students and inadequate oversight of health care that  hindered IHS’s ability to ensure quality care to Indian communities. In  addition, we have reported that BIA mismanages Indian energy resources  held in trust and thereby limits opportunities for tribes and their members  to use those resources to create economic benefits and improve the well- being of their communities.
Congress recently noted, “through treaties, statutes, and historical  relations with Indian tribes, the United States has undertaken a unique  trust responsibility to protect and support Indian tribes and Indians.” In  light of this unique trust responsibility and concerns about the federal  government ineffectively administering Indian education and health care  programs and mismanaging Indian energy resources, we are adding  these programs as a high-risk issue because they uniquely affect tribal  nations and their members.
section_title: What GAO Found
paragraphs: Federal agencies have ineffectively administered and implemented Indian  education and health care programs and mismanaged Indian energy  resources in the following broad areas: (1) oversight of federal activities;  (2) collaboration and communication; (3) federal workforce planning; (4)  equipment, technology, and infrastructure; and (5) federal agencies’ data.  Although federal agencies have taken some actions to address the 41  recommendations we made related to Indian programs, there are  currently 39 that have yet to be fully resolved.
section_title: What Remains to Be Done
paragraphs: We plan to continue monitoring federal efforts to address the 39  recommendations that have yet to be fully resolved. To this end, we have  ongoing work focusing on accountability for safe schools and school  construction and tribal control of energy delivery, management, and  resource development.
subsections: section_title: Education
paragraphs: In the past 3 years, we issued 3 reports on challenges with Indian Affairs’  management of BIE schools in which we made 13 recommendations.  Eleven recommendations below remain open.
To help ensure that BIE schools provide safe and healthy facilities for  students and staff, we made 4 recommendations which remain open,  including that Indian Affairs ensure the inspection information it  collects on BIE schools is complete and accurate; develop a plan to  build schools’ capacity to promptly address safety and health  deficiencies; and consistently monitor whether BIE schools have  established required safety committees.
To help ensure that BIE conducts more effective oversight of school  spending, we made 4 recommendations which remain open, including  that Indian Affairs develop a workforce plan to ensure that BIE has the  staff to effectively oversee school spending; put in place written  procedures and a risk-based approach to guide BIE in overseeing  school spending; and improve information sharing to support the  oversight of BIE school spending.
To help ensure that Indian Affairs improves how it manages Indian  education, we made 5 recommendations. Three recommendations  remain open, including that Indian Affairs develop a strategic plan for  BIE that includes goals and performance measures for how its offices  are fulfilling their responsibilities to provide BIE with support; revise  Indian Affairs’ strategic workforce plan to ensure that BIA regional  offices have an appropriate number of staff with the right skills to  support BIE schools in their regions; and develop and implement  decision-making procedures for BIE to improve accountability for BIE  schools.
section_title: Health Care
paragraphs: IHS beneficiaries through the Patient Protection and Affordable  Care Act (PPACA) have on PRC funds, we recommend that IHS  concurrently develop potential options to streamline requirements  for program eligibility.
To help ensure successful outreach efforts regarding PPACA  coverage expansions, we recommend that IHS realign current  resources and personnel to increase capacity to deal with enrollment  in Medicaid and the exchanges and prepare for increased billing to  these payers.
If payments for physician and other nonhospital services are capped,  we recommend that IHS monitor patient access to these services.
To help ensure a more equitable allocation of funds per capita across  areas, we recommended that Congress consider requiring IHS to  develop and use a new method for allocating PRC funds. To make  IHS’s allocation of PRC program funds more equitable, we  recommended that IHS develop (1) written policies and procedures to  require area offices to notify IHS when changes are made to the  allocation of funds to PRC programs; (2) use actual counts of PRC  users in any formula allocating PRC funds that relies on the number of  active users; and (3) use variations in levels of available hospital  services, rather than just the existence of a qualifying hospital, in any  formula for allocating PRC funds that contain a hospital access  component.
To develop more accurate data for estimating the funds needed for  the PRC program and improve IHS oversight, we recommended that  IHS develop a written policy documenting how it evaluates need for  the PRC program, and disseminate it to area offices so they  understand how unfunded services data are used to estimate overall  program needs. We also recommend that IHS develop written  guidance for PRC programs outlining a process to use when funds  are depleted but recipients continue to need services.
section_title: Energy
paragraphs: In the past 2 years, we issued 3 reports on developing Indian energy  resources in which we made 14 recommendations to BIA. All  recommendations remain open.
To help ensure BIA can verify ownership in a timely manner and  identify resources available for development, we made 2  recommendations, including that Interior take steps to improve its  geographic information system mapping capabilities.
To help ensure BIA’s review process is efficient and transparent, we  made 2 recommendations, including that Interior take steps to  develop a documented process to track review and response times for  energy-related documents that must be approved before tribes can  develop energy resources.
To help improve clarity of tribal energy resource agreement  regulations, we recommended BIA provide additional guidance to  tribes on provisions that tribes have identified to Interior as unclear.
To help ensure that BIA’s effort to streamline the review and approval  process for revenue-sharing agreements achieves its objectives, we  made 3 recommendations, including that Interior establish time  frames for the review and approval of Indian revenue-sharing  agreements for oil and gas, and establish a system for tracking and  monitoring the review and approval process to determine whether  time frames are met.
To help improve efficiencies in the federal regulatory process, we  made 4 recommendations, including that BIA take steps to coordinate  with other regulatory agencies so the Indian Energy Service Center  can serve as a single point of contact or lead agency to navigate the  regulatory process.
To help ensure that it has a workforce with the right skills,  appropriately aligned to meet the agency’s goals and tribal priorities,  we made 2 recommendations, including that BIA establish a  documented process for assessing BIA’s workforce composition at  agency offices.
section_title: Congressional Actions Needed
paragraphs: It is critical that Congress maintain its focus on improving the  effectiveness with which federal agencies meet their responsibilities to  serve tribes and their members. Since 2013, we testified at 6 hearings to  address significant weaknesses we found in the federal management of  programs that serve tribes and their members. Sustained congressional  attention to these issues will highlight the challenges discussed here and  could facilitate federal actions to improve Indian education and health  care programs and the development of Indian energy resources.
section_title: Additional Details on What GAO Found
subsections: section_title: Indian Education
paragraphs: Indian Affairs, through BIE, is responsible for providing quality education  opportunities to Indian students and oversees 185 elementary and  secondary schools that serve approximately 41,000 students on or near  Indian reservations in 23 states, often in rural areas and small towns.  About two-thirds of these schools are operated by tribes, primarily  through federal grants, and about one-third are operated directly by BIE.  BIE’s Indian education programs originate from the federal government’s  trust responsibility to Indian tribes, a responsibility established in federal  statutes, treaties, court decisions, and executive actions. It is the policy of  the United States to fulfill this trust responsibility for educating Indian  children by working with tribes to ensure that education programs are of  the highest quality and that children are provided a safe and healthy  environment in which to learn.
Students attending BIE schools generally must be members of federally  recognized Indian tribes, or descendants of members of such tribes, and  reside on or near federal Indian reservations. All BIE schools—both  tribally- and BIE-operated—receive almost all of their operational funding  from federal sources, namely, Interior and the Department of Education,  totaling about $1.2 billion in 2016. Indian Affairs considers many BIE  schools to be in poor condition.
BIE is primarily responsible for its schools’ educational functions, while  their administrative functions—such as safety, facilities, and property  management—are divided mainly between two other Indian Affairs’  offices, BIA and the Office of the Deputy Assistant Secretary of  Management. However, frequent turnover of leadership in these offices  has hampered efforts to improve Indian education over the years. For  example, in September 2013, we reported that from 2000 through 2013  there were repeated changes in the tenure of acting and permanent  assistant secretaries of Indian Affairs as well as acting and permanent  directors of BIE. Since that time, leadership turnover has continued in  these offices. For example, in March 2016, the previous BIE director was  removed for violating federal hiring practices. ensure that its regional offices annually inspect the safety and health of all  BIE school campuses, as required, or that the information it collects  through inspections is complete and accurate, and we recommended that  it take such actions. Specifically, we found that Indian Affairs did not  conduct annual inspections at about 1 in 3 BIE schools from fiscal years  2012 through 2015. Further, 4 out of 10 regions did not conduct any  inspections during this period. We also found that Indian Affairs did not  systematically evaluate the thoroughness of the school safety inspections  it conducted or monitor the extent to which inspection procedures varied  within and across regions. Without Indian Affairs monitoring whether  safety inspectors in each of its regions are consistently following  appropriate procedures and guidance, inspections in different regions  may continue to vary in completeness and miss important safety and  health deficiencies at schools that could pose dangers to students and  staff. In September 2016, Indian Affairs provided documentation that it  had conducted fiscal year 2016 annual safety inspections at all BIE  schools, but it did not include evidence that it had taken steps to ensure  that its inspection information was complete and accurate. As of January  2017, we had not received further updates from Indian Affairs. We will  continue to monitor its efforts in this area.
In a February 2015 testimony, we reported that Indian Affairs did not  consistently oversee some BIE school construction projects. For example,  we found that at 1 BIE school Indian Affairs managed a $3.5 million  project to replace roofs, but the new roofs had leaked continually since  they were installed, causing mold and ceiling damage in classrooms,  according to agency documents. At another school, Indian Affairs funded  construction of a $1.5 million building for school bus maintenance and  bus storage, but the size of the building did not allow a large school bus  to fit on the lift when the exterior door was closed. documentation demonstrating it has developed a system for overseeing  Department of Education formula grants provided to BIE schools to  provide services for children with special needs and to expand and  improve educational programs for students from low-income families.  However, Indian Affairs was unable to provide documentation showing  that it has developed written procedures to oversee funds BIE schools  receive from their largest funding source— Interior’s Indian School  Equalization Program. Further, as of late September 2016, BIE still had  not hired additional staff to oversee school spending, among other duties.
Indian Affairs also reported that it developed a risk-based approach to  oversee BIE school expenditures, but we found it has not taken steps to  fully implement this approach. Specifically, Interior reported that its risk- based approach was to post schools’ single audits on a website to enable  officials responsible for fiscal monitoring to be able to target those at  greatest risk of misusing federal funds. However, in reviewing the site,  we found that audits for fewer than half of the schools had been posted  on the site during each of the past 2 fiscal years. Access to all or at least  the vast majority of these audits is critical for Indian Affairs to be able to  conduct risk-based fiscal monitoring activities.
Limited federal workforce planning. We have found limited workforce  planning in several key areas related to BIE schools. In a February 2015  testimony, we noted that the capacity of Indian Affairs and BIE school  staff to address school facility needs is limited due to gaps in expertise,  steady declines in staffing levels, and limited institutional knowledge. that the agency develop a comprehensive workforce plan to ensure that  BIE has an adequate number of staff with the requisite knowledge and  skills to effectively oversee BIE school expenditures. Interior agreed to  implement this recommendation, but as of January 2017, it had not  provided documentation that it had done so.
In a September 2013 report, we found that Indian Affairs could not ensure  that staffing levels at Indian Affairs’ regional offices were adjusted to meet  the needs of BIE schools in regions with varying numbers of schools,  ranging from 2 to 65, because it had not updated its strategic workforce  plan. We recommended that Indian Affairs revise its strategic workforce  plan to ensure that its employees providing administrative support to BIE  are placed in the appropriate offices to ensure that regions with a large  number of schools have sufficient support. Indian Affairs agreed to  implement this recommendation. In September 2016, Interior provided us  with a revised workforce plan for Indian Affairs. However, this plan did not  include information about the workforce needs related to the Indian Affairs  offices that provide administrative support to BIE and its schools and  therefore did not address the recommendation. As of January 2017, we  had not received further updates from Indian Affairs. We will continue to  monitor its efforts in this area.
Outdated and deteriorating equipment, technology, and  infrastructure. Aging BIE school facilities and equipment contribute to  degraded and unsafe conditions for students and staff. In a March 2016  report, we found at one school 7 boilers that failed inspection because of  multiple high-risk safety deficiencies, including elevated levels of carbon  monoxide and a natural gas leak. Four of the boilers were located in a  student dormitory, and 3 were located in classroom buildings. All but one  of the boilers were about 50 years old. While the poor condition of the  boilers posed an imminent danger to the safety of students and staff,  most of the boilers were not repaired until about 8 months after failing  their inspection, prolonging safety risks to students and staff.
In a February 2015 testimony, we reported that BIE schools face a variety  of challenges with their facilities, such as aging buildings and problems  that result from years of deferred maintenance. For example, at one  school built in 1959 we observed extensive cracks in concrete block walls  and supports, which a BIA official said resulted from a shifting foundation. report, we found that Indian Affairs lacks sound information on safety and  health conditions of all BIE schools. Specifically, we found that its  nationwide information on safety and health deficiencies at schools is not  complete and accurate because of key weaknesses in its inspection  program. Without inspection information that is complete and accurate,  Indian Affairs cannot effectively determine the magnitude and severity of  safety and health deficiencies at schools. As a result, it cannot ensure  BIE school facilities are safe for students and staff and currently meet  safety and health requirements. We recommended that Indian Affairs take  steps to ensure that the inspection information it collects on BIE schools  is complete and accurate, among other things. As of January 2017, the  agency had not provided documentation that it had done so.
In a February 2015 testimony, we reported that issues with the quality of  data on BIE school conditions—such as inconsistent data entry by  schools and insufficient quality controls—makes it difficult to determine  the actual number of schools in poor condition and undermines Indian  Affairs’ ability to effectively track and address problems at school  facilities.
section_title: Indian Health Care
paragraphs: The Indian Health Service (IHS), an agency within HHS, is charged with  providing health care to approximately 2.2 million Indians. In fiscal year  2016, IHS allocated about $1.9 billion for health services provided by  federally and tribally operated hospitals, health centers, and health  stations. Federally operated facilities provide mostly primary and  emergency care, in addition to some ancillary or specialty services. The  federally operated system consists of 26 hospitals, 56 health centers, and  32 health stations. IHS hospitals range in size from 4 to 133 beds. exacerbate the severity of a patient’s condition and necessitate more  intensive treatment.
PPACA expanded or created new health care coverage options that may  benefit Indians, including a state option to expand Medicaid eligibility to  individuals with incomes at or below 138 percent of the federal poverty  level (FPL), federal premium tax credits for individuals obtaining  insurance through health insurance exchanges with incomes between  100 and 400 percent of the FPL, and cost sharing exemptions for Indians  who are members of federally recognized tribes with incomes at or below  300 percent of the FPL who purchase insurance through the exchanges.  In September 2013, we estimated that PPACA’s new coverage options  may allow hundreds of thousands of Indians to obtain health care benefits  for which they were not previously eligible, assuming all states expanded  their Medicaid programs. We reported that, if Indians enroll in one of  these options and choose to receive care through IHS, increased revenue  from third party payers such as Medicaid could free up IHS resources and  help alleviate pressure on the IHS budget.
Inadequate oversight of federal activities. IHS provides inadequate  oversight of health care, both of its federally operated facilities and  through the PRC program. In January 2017, we reported that IHS  provided limited and inconsistent oversight of the quality of care provided  in its federally operated facilities. As a result, the agency cannot ensure  that patients receive quality care. IHS has recently finalized a quality  framework designed to address these deficiencies and improve its  oversight. We recommended that, as part of implementing the quality  framework, IHS ensure that agency-wide standards for the quality of care  provided in its federally operated facilities are developed, and that facility  performance in meeting these standards is systematically monitored over  time. HHS agreed with our recommendation and cited steps it already has  underway to improve the quality of care in IHS’s federally-operated  facilities.  HHS described the development of the IHS Quality Framework  and Implementation Plan released in November 2016. However, as of  January 2017, IHS has not developed agency-wide standards for the  quality of care provided in its federally operated facilities. weeks for an initial exam with a family medicine physician, and new  patients in internal medicine may wait 3 to 4 months for an initial exam.
IHS has delegated this responsibility to its area offices and has not  conducted any systematic, agency-wide oversight of the timeliness of  primary care. Without these standards, IHS cannot know whether it is  providing sufficient primary care to meet the needs of its patients. We  recommended that IHS develop and communicate specific agency-wide  standards for patient wait times in federally operated facilities, monitor  patient wait times, and take corrective actions when standards are not  met. HHS stated that it agreed with the need to improve patient wait times  at IHS federally-operated facilities to ensure that primary care is available  and accessible to Indians. HHS described its plan to establish an Office of  Quality Health Care at IHS Headquarters to provide for national policy  and oversight of critical quality improvement strategies and ensure their  success and accountability. As of January 2017, IHS has not established  the Office of Quality Health Care, and has not developed agency-wide  standards for patient wait times in federally operated facilities. specified allocation formula that may vary across areas. Neither bill  became law.
Ineffective collaboration and limited communication. In a June 2012  report, we found that IHS does not require its area offices to inform IHS  headquarters if they distribute program increase funds to local PRC  programs using different criteria than the PRC allocation formula  suggested by headquarters. As a result, IHS may be unaware of  additional funding variation across areas. We recommended that IHS  develop written policies and procedures to require area offices to notify  IHS when they diverge from the formula for allocating funds to PRC  programs. HHS concurred with this recommendation and noted that  guidance requiring area offices to report these changes to IHS  headquarters would be added to the PRC manual, but did not specify a  date for doing so. As of January 2017, IHS has not added this guidance  to the manual.
Limited federal workforce planning. In a March 2016 report, we  reported that IHS officials told us that an insufficient workforce was the  biggest impediment to ensuring patients could access timely primary  care. According to IHS’s 2016 budget justification, there were over 1,550  vacancies for health care professionals throughout the IHS health care  system including: physicians, dentists, nurses, pharmacists, physician  assistants, and nurse practitioners. According to IHS officials, staffing  vacancies have created obstacles for facilities working to provide primary  care.
In September 2013, we found that IHS did not have an effective plan in  place to ensure that sufficient staff would be in place to assist with  increased enrollment and third party billing under expanded Medicaid or  the exchanges beginning in 2014 under PPACA. Without a plan, IHS may  not be able to ensure that a sufficient number of staff are available to  assist with enrollment and to process increased third-party payments. We  recommended that IHS realign current resources and personnel to  increase capacity to assist with these efforts. HHS neither agreed nor  disagreed with this recommendation. As of January 2017, IHS has not  implemented this recommendation. facility, and some PRC program officials noted that their number of staff  was below these standards, contributing to delays in determining eligibility  for the program and processing payments to providers. We  recommended that IHS use available PRC funds to pay for PRC program  staff. HHS disagreed with this recommendation, stating its intent to use  PRC funds to pay only for services, not staff, since PRC funding was not  sufficient to pay for all needed services. We acknowledged the difficult  challenges and choices faced by PRC programs when program funds are  not available to pay for all needed services, but maintained that without  using funds to pay for staff, some PRC programs would continue to have  staffing levels below IHS’s staffing standards model, which contributes to  delays in administering the program. As of January 2017, IHS has not  implemented this recommendation.
Outdated and deteriorating equipment, technology, and  infrastructure. In March 2016, we reported that IHS officials told us that  access to timely primary care at some health care facilities serving Indian  communities is hindered by outdated medical and telecommunications  equipment, such as analog mammography machines and telephones with  an insufficient number of lines for scheduling patient appointments.
Incomplete and inaccurate data. In a June 2012 report, we found that  IHS officials do not believe that its PRC program data are complete or  that areas collect these data in the same manner. Without accurate data,  IHS cannot know if the proportion of actual PRC users is consistent  across areas. We made three recommendations to improve the accuracy  of the PRC data for future allocations, including using actual counts of  PRC users, using variation in levels of available hospital services in the  funding formula, and, as mentioned above, requiring area offices to notify  headquarters when they diverge from the formula for allocating funds to  PRC programs. HHS did not concur with our recommendation to use  actual counts of PRC users, rather than all IHS users, in any formula for  allocating PRC funds that relies on the number of active users, stating  that IHS’s combined count of all users is intended to reflect the health  care needs of PRC users. HHS concurred with our recommendation that  IHS use variations in levels of available hospital services to allocate PRC  funds. As of January 2017, IHS has not implemented these  recommendations. that IHS take steps to improve its ability to measure timeliness by  modifying its claims data system to distinguish between two types of  referrals and establish separate timeframe targets for each type. HHS  concurred with this recommendation, but as of January 2017, IHS has not  implemented it.
section_title: Indian Energy Resources
paragraphs: Developing energy resources is vital for the livelihood and long-term  economic wellbeing of some Indian tribes and their members. More  specifically, energy development provides opportunities to improve poor  living conditions and decrease high levels of poverty. Tribes and their  members determine how to use Indian energy resources to meet the  needs of the community. However, if the resources are held in trust or  restricted status, BIA—through its 12 regional offices, 85 agency offices,  and other supporting offices—generally must review and approve leases,  permits, and other documents required to develop the resources. In  2014, in response to tribal requests for increased coordination and  efficient management of their resources from the numerous federal  regulatory agencies involved with Indian energy development, Interior  took initial steps to form a new office, the Indian Energy Service Center  (Service Center)—with BIA as the lead agency. According to Interior’s  fiscal year 2016 budget justification, the Service Center is intended to,  among other things, help expedite the leasing and permitting processes  associated with Indian energy development. we reviewed identified that BIA’s review and approval process can be  lengthy and increase development costs and project development times,  resulting in missed development opportunities, lost revenue, and  jeopardized viability of projects. For example, according to a tribal official,  BIA took as long as 8 years to review some of its energy-related  documents. In the meantime, the tribe estimates it lost $95 million in  revenues it could have earned from tribal permitting fees, oil and gas  severance taxes, and royalties. In another example, one lease for a  proposed utility-scale wind project took BIA more than 3 years to review  and approve. According to a tribal official, the long review time has  contributed to uncertainty about the continued viability of the project  because data used to support the economic feasibility and environmental  impact of the project became too old to accurately reflect current  conditions. We recommended that Interior direct BIA to develop a  documented process to track its review and response times. In response,  Interior stated it would try to implement a tracking and monitoring  mechanism by the end of fiscal year 2017 for oil and gas leases.  However, it did not indicate whether it intends to track and monitor its  review of other energy-related documents that must be approved before  tribes can develop resources. Without comprehensively tracking and  monitoring its review process, BIA cannot ensure that documents are  moving forward in a timely manner, and lengthy review times may  continue to contribute to lost revenue and missed development  opportunities for Indian tribes.
In a June 2016 report, we found that BIA took steps to improve its  process for reviewing revenue-sharing agreements, but still had not  established a systematic mechanism for monitoring or tracking. With  respect to revenue sharing agreements, we recommended, among other  things, that BIA develop a systematic mechanism for tracking these  agreements through the review and approval process. Interior concurred  with these recommendations and stated that BIA will develop such a  mechanism and in the meantime use a centralized tracking spreadsheet. serve as a single point of contact for permitting requirements. Without  serving in these capacities, the Service Center will be limited in its ability  to improve efficiencies in the federal regulatory process. We also found  that in forming the Service Center, BIA did not involve key stakeholders,  such as the Department of Energy—an agency with significant energy  expertise—and BIA employees from agency offices. By not involving key  stakeholders, BIA has missed an opportunity to incorporate their  expertise into its efforts. We recommended that BIA include other  regulatory agencies in the Service Center so that it can act as a single  point of contact or a lead agency to coordinate and navigate the  regulatory process. We also recommended BIA establish formal  agreements with key stakeholders, such as DOE, that identify the  advisory or support role of the office, and establish a process for seeking  and obtaining input from key stakeholders, such as BIA employees, on  the Service Center activities. Interior agreed with our recommendations  and described plans to address them.
In 2005, Congress provided an option for tribes to enter into an  agreement with the Secretary of the Interior that allows the tribe, at its  discretion, to enter into leases, business agreements, and rights-of-way  agreements for energy resource development on tribal lands without  review and approval by the Secretary. However, in a June 2015 report,  we found that uncertainties about Interior’s regulations for implementing  this option have contributed to deter a tribe from pursuing an agreement.  We recommended that Interior provide clarifying guidance. In August  2015, Interior stated the agency is considering further guidance. As of  December 2016, Interior had not provided additional guidance.
Limited federal workforce planning. In November 2016, we found BIA  had high vacancy rates at some agency offices and that the agency had  not conducted key workforce planning activities, such as identifying the  key workforce skills needed to achieve agency goals, and assessing any  skill gaps. These workforce issues contribute to BIA’s management  shortcomings that have hindered Indian energy development. Until BIA  undertakes necessary workforce planning activities, it cannot ensure that  it has a workforce with the right skills, appropriately aligned to meet the  agency’s goals and tribal priorities. We recommended that BIA assess  critical skills and competencies needed to fulfill its responsibilities related  to energy development and identify potential gaps. We also  recommended BIA establish a documented process for assessing BIA’s  workforce composition at agency offices taking into account BIA’s  mission, goals, and tribal priorities. Interior agreed with our  recommendations and stated it is taking steps to implement them.
Outdated and deteriorating equipment, technology, and infrastructure. In  June 2015, we found that BIA does not have the necessary geographic  information system (GIS) mapping data for identifying who owns and uses  resources, such as existing leases. Interior guidance states that efficient  management of oil and gas resources relies, in part, on GIS mapping  technology because it allows managers to easily identify resources  available for lease and where leases are in effect. According to a BIA  official, without GIS data, the process of identifying transactions, such as  leases and access agreements for Indian land and resources, can take  significant time and staff resources to search paper records stored in  multiple locations. We recommended BIA should take steps to improve its  GIS capabilities to ensure it can verify ownership in a timely manner.  Interior stated it will enhance mapping capabilities by developing a  national dataset composed of all Indian land tracts and boundaries in the  next 4 years.
Incomplete and inaccurate data. In June 2015, we found that BIA did  not have the data it needs to verify who owns some Indian oil and gas  resources or identify where leases are in effect. In some cases, BIA  cannot verify ownership because federal cadastral surveys—the means  by which land is defined, divided, traced, and recorded—cannot be found  or are outdated. The ability to account for Indian resources would assist  BIA in fulfilling its federal trust responsibility, and determining ownership  is a necessary step for BIA to approve leases and other energy-related  documents. We recommended that Interior direct BIA to identify land  survey needs. Interior stated it will develop a data collection tool to  identify the extent of its survey needs in fiscal year 2016. As of December  2016, Interior had not provided information on the status of its efforts to  develop a data collection tool.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area related to our Indian  Education work, contact Melissa Emrey-Arras at (617) 788-0534 or  EmreyArrasM@gao.gov. For additional information about this high-risk  area related to our Indian Health work, contact Kathleen King at (202)  512-7114 or KingK@gao.gov. For additional information about this high- risk area related to our Indian Energy work, contact Frank Rusco at (202)  512-3841 or RuscoF@gao.gov.
section_title: Related GAO Products
subsections: section_title: Education
paragraphs: Indian Affairs: Key Actions Needed to Ensure Safety and Health at Indian  School Facilities. GAO-16-313. Washington, D.C.: March 10, 2016.
Indian Affairs: Preliminary Results Show Continued Challenges to the  Oversight and Support of Education Facilities. GAO-15-389T.  Washington, D.C.: February 27, 2015.
Indian Affairs: Bureau of Indian Education Needs to Improve Oversight of  School Spending. GAO-15-121. Washington, D.C.: November 13, 2014.
Indian Affairs: Better Management and Accountability Needed to Improve  Indian Education. GAO-13-774. Washington, D.C.: September 24, 2013.
section_title: Health Care
paragraphs: Indian Health Service: Actions Needed to Improve Oversight of Quality of  Care. GAO-17-181. Washington, D.C.: January 9, 2017.
Indian Health Service: Actions Needed to Improve Oversight of Patient  Wait Times. GAO-16-333. Washington, D.C.: March 29, 2016.
Indian Health Service: Opportunities May Exist to Improve the Contract  Health Services Program. GAO-14-57. Washington, D.C.: December 11,  2013.
Indian Health Service: Most American Indians and Alaska Natives  Potentially Eligible for Expanded Health Coverage, but Action Needed to  Increase Enrollment. GAO-13-553. Washington, D.C.: September 5,  2013.
Indian Health Service: Capping Payment Rates for Nonhospital Services  Could Save Millions of Dollars for Contract Health Services. GAO-13-272.  Washington, D.C.: April 11, 2013.
Indian Health Service: Action Needed to Ensure Equitable Allocation of  Resources for the Contract Health Services Program. GAO-12-446.  Washington, D.C.: June 15, 2012.
Indian Health Service: Increased Oversight Needed to Ensure Accuracy  of Data for Estimating Contract Health Service Need. GAO-11-767.  Washington, D.C.: September 23, 2011.
section_title: Energy
paragraphs: Indian Energy Development: Additional Actions by Federal Agencies Are  Needed to Overcome Factors Hindering Development. GAO-17-43.  Washington, D.C.: November 10, 2016.
Indian Energy Development: Interior Could Do More to Improve Its  Process for Approving Revenue-Sharing Agreements. GAO-16-553.  Washington, D.C.: June 13, 2016.
Indian Energy Development: Poor Management by BIA Has Hindered  Energy Development on Indian Lands. GAO-15-502. Washington, D.C.:  June 8, 2015.
section_title: 2020 Decennial Census
subsections: section_title: Why Area Is High Risk
paragraphs: One of the most important functions of the U.S. Census Bureau (Bureau)  is conducting the decennial census of the U.S. population, which is  mandated by the Constitution and provides vital data for the nation. This  information is used to apportion the seats of the U.S. House of  Representatives; realign the boundaries of the legislative districts of each  state; allocate billions of dollars in federal financial assistance; and  provide social, demographic, and economic profiles of the nation’s people  to guide policy decisions at each level of government. A complete count  of the nation’s population is an enormous challenge as the Bureau seeks  to control the cost of the census while it implements several new  innovations and manages the processes of acquiring and developing new  and modified information technology (IT) systems supporting them. Over  the past 3 years, we have made 30 recommendations to help the Bureau  design and implement a more cost-effective census for 2020; however,  only 6 of them had been fully implemented as of January 2017.
The cost of the census, in terms of cost for counting each housing unit,  has been escalating over the last several decennials. The 2010 Census  was the costliest U.S. Census in history at about $12.3 billion, and was  about 31 percent more costly than the $9.4 billion 2000 Census (in 2020  dollars). The average cost for counting a housing unit increased from  about $16 in 1970 to around $92 in 2010 (in 2020 constant dollars).  Meanwhile, the return of census questionnaires by mail (the primary  mode of data collection) declined over this period from 78 percent in 1970  to 63 percent in 2010. Declining mail response rates—a key indicator of a  cost-effective census—are significant and lead to higher costs. This is  because the Bureau sends enumerators to each non-responding  household to obtain census data. As a result, non-response follow-up  (NRFU) is the Bureau’s largest and most costly field operation. In many  ways, the Bureau has had to invest substantially more resources each  decade to match the results of prior enumerations.
section_title: What Remains to Be Done
paragraphs: The Bureau plans to implement several new innovations in its design of  the 2020 Census. In response to our recommendations regarding past  decennial efforts and other assessments, the Bureau has fundamentally  reexamined its approach for conducting the 2020 Census. Its plan for  2020 includes four broad innovation areas that it believes will save it over  $5 billion (2020 constant dollars) when compared to what it estimates  conducting the census with traditional methods would cost. The Bureau’s  innovations include (1) using the Internet as a self-response option, which  the Bureau has never done on a large scale before; (2) verifying most  addresses using “in-office” procedures and on-screen imagery rather than  street-by-street field canvassing; (3) re-engineering data collection  methods such as by relying on an automated case management system;  and (4) in certain instances, replacing enumerator collection of data with  administrative records (information already provided to federal and state  governments as they administer other programs). These innovations  show promise for a more cost-effective head count. However, they also  introduce new risks, in part, because they include new procedures and  technology that have not been used extensively in earlier decennials, if at  all.
The Bureau is also managing the acquisition and development of new  and modified IT systems, which add complexity to the design of the  census. To help control census costs, the Bureau plans to significantly  change the methods and technology it uses to count the population, such  as offering an option for households to respond to the survey via the  Internet or phone, providing mobile devices for field enumerators to  collect survey data from households, and automating the management of  field operations. This redesign relies on acquiring and developing many  new and modified IT systems, which could add complexity to the design.
These cost risks, new innovations, and the acquisition and development  of IT systems for the 2020 Census, along with other challenges we have  identified in recent years, raise serious concerns about the Bureau’s  ability to conduct a cost-effective enumeration. Based on these concerns,  we have concluded that the 2020 Census is a high-risk area and have  added it to the High-Risk List in 2017.
To help the Bureau mitigate the risks associated with its fundamentally  new and complex innovations for the 2020 Census, the commitment of  top leadership is needed to ensure the Bureau’s management, culture,  and business practices align with a cost-effective enumeration. For  example, the Bureau needs to continue strategic workforce planning  efforts to ensure it has the skills and competencies needed to support  planning and executing the census. It must also rigorously test individual  census-taking activities to provide information on their feasibility and  performance, their potential for achieving desired results, and the extent  to which they are able to function together under full operational  conditions. We have recommended that the Bureau also ensure that its  scheduling adheres to leading practices and be able to support a  quantitative schedule risk assessment, such as by having all activities  associated with the levels of resources and effort needed to complete  them. The Bureau has stated that it has begun maturing project  schedules to ensure that the logical relationships are in place and plans  to conduct a quantitative risk assessment. We will continue to monitor the  Bureau’s efforts.
The Bureau must also improve its ability to manage, develop, and secure  its IT systems. For example, the Bureau needs to prioritize its IT  decisions and determine what information it needs in order to make those  decisions. In addition, the Bureau needs to make key IT decisions for the  2020 Census in order to ensure they have enough time to have the  production systems in place to support the end-to-end system test. To  this end, we recommended the Bureau ensure that the methodologies for  answering the Internet response rate and IT infrastructure research  questions are determined and documented in time to inform key design  decisions. Further, given the numerous and critical dependencies  between the Census Enterprise Data Collection and Processing  (CEDCaP) program—a large and complex modernization program within  the IT Directorate—and 2020 Census programs, their parallel  implementation tracks, and the 2020 Census’s immovable deadline, we  recommended that the Bureau establish a comprehensive and integrated  list of all interdependent risks facing the two programs, and clearly identify  roles and responsibilities for managing this list. The Bureau stated that it  plans to take actions to address our recommendations.
It is also critical for the Bureau to have better oversight and control over  its cost estimation process and we have recommended that the Bureau  ensure its cost estimate is consistent with our leading practices. For  example, the Bureau will need to, among other practices, document all  cost-influencing assumptions; describe estimating methodologies used for  each cost element; ensure that variances between planned and actual  cost are documented, explained, and reviewed; and include a  comprehensive sensitivity analysis, so that it can better estimate costs.  We also recommended that the Bureau implement and institutionalize  processes or methods for ensuring control over how risk and uncertainty  are accounted for and communicated within its cost estimation process.  The Bureau agreed with our recommendations, and we are currently  conducting a follow-up audit of the Bureau’s most recent cost estimate  and will determine whether the Bureau has implemented them.
Sustained congressional oversight will be essential as well. In 2015 and  2016, congressional committees held five hearings focusing on the  progress of the Bureau’s preparations for the decennial. Going forward,  active oversight will be needed to ensure these efforts stay on track, the  Bureau has needed resources, and Bureau officials are held accountable  for implementing the enumeration as planned.
We will continue monitoring the Bureau’s efforts to conduct a cost- effective enumeration. To this end, we have ongoing work focusing on  such topics as the Bureau’s updated life-cycle cost estimate and the  readiness of IT systems for the 2018 End-to-End Test, which is  essentially a dress rehearsal for the decennial.
section_title: Additional Details on What GAO Found
subsections: section_title: Challenges Implementing Innovations
paragraphs: The Bureau is planning many previously unused innovations for the  2020 Census: The decennial census is an inherently challenging  undertaking, requiring many moving parts to come together in a short  time and be completed according to a prescribed schedule. To help  control costs and maintain accuracy, the Bureau is introducing significant  change to how it conducts the decennial census in 2020. Its planned  innovations include (1) making greater use of local data, imagery, and  other office procedures to build its address list; (2) improving self- response by encouraging respondents to use the Internet and telephone;  (3) using administrative records to reduce field work; and (4)  reengineering field operations using technology to reduce manual effort  and improve productivity. While the census is under way, the tolerance for  any breakdowns is quite small. As a result, given the new four innovation  areas for the 2020 Census, it will be imperative that the Bureau have  systems and operations in place for the 2018 End-to-End Test.
Using administrative records is promising but introduces  challenges: Although administrative records—information already  provided to the government as it administers other programs—have been  discussed and used for the decennial census since the 1970s, the Bureau  plans a more significant role for them to reduce the amount of data  collection fieldwork, which has the potential to help significantly limit the  cost increases of the 2020 Census. The Bureau has estimated that using  these records could save up to $1.4 billion compared to traditional census  methods. In 2015, we found that while the Bureau has already  demonstrated the feasibility of using administrative records, it still faces  challenges with using them for the 2020 Census. For example, although  the Bureau has no control over the accuracy of data provided to it by  other agencies, it is responsible for ensuring that data it uses for 2020  Census are of sufficient quality for their planned uses.
Another challenge we identified is the extent to which the public will  accept government agencies sharing personal data for the purposes of  the census. Related concerns involve trust in the government and  perceptions about burden on respondents as well the social benefits of  agencies sharing data. Moreover, in addition to using administrative  records to reduce fieldwork, the Bureau is considering several additional  opportunities to leverage administrative records to help improve the cost  and quality of the 2020 Census. It will be important for the Bureau to set  deadlines for deciding which records it will use and for which purpose to  help the Bureau monitor its progress and prioritize which activities—or  records—to continue pursuing, or to abandon, if time becomes a  constraint.
The Bureau needs to identify and analyze root causes of non- interviews during testing: When households do not respond to the  census and when the Bureau does not obtain information about the  household while knocking on doors during its NRFU operation, the  Bureau may have to impute attributes of the household based on the  demographic characteristics of surrounding housing units as well as on  administrative records. We reported in 2016 that during the Bureau’s  2016 Census Site Test, the Bureau experienced about 20 and 30 percent  of its test workload as non-interviews at its two test sites in Harris County,  Texas, and Los Angeles County, California, respectively. According to  the Bureau, non-interviews are cases where no data or insufficient data  are collected, either because enumerators make six attempted visits  without success (the maximum number the Bureau allows), or are not  completed due to, for example, language barriers or dangerous  situations. Identifying root causes of problems is something we look for  when determining progress within a high-risk area. Accordingly, while the  2016 Census Test non-interview rate is not necessarily a precursor to the  2020 non-interview rate, because of its relationship to the cost and quality  of the census, it will be important for the Bureau to better understand the  factors contributing to it.
Bureau cancelled field tests for 2017: The Bureau plans to conduct  additional research through 2018 in order to further refine the design of  the 2020 Census, but recently had to alter its approach. On October 18,  2016, the Bureau decided to stop two field test operations planned for  fiscal year 2017 in order to mitigate risks from funding uncertainty.  Specifically, the Bureau said it would stop all planned field activity,  including local outreach and hiring, at its test sites in Puerto Rico, North  and South Dakota, and Washington State. The Bureau will not carry out  planned field tests of its mail-out strategy and follow up for non-response  in Puerto Rico or its door-to-door enumeration. The Bureau also  cancelled plans to update its address list in the Indian lands and  surrounding areas in the three states.
However, the Bureau will continue with other planned testing in fiscal year  2017, such as those focusing on systems readiness and Internet  response. Further, the Bureau said it would consider incorporating the  cancelled field activities elements within the 2018 End-to-End Test. The  Bureau maintains that stopping the 2017 Field Test will help prioritize  readiness for the 2018 End-to-End Test, and mitigate risk. Nevertheless,  as we reported in November 2016, it also represents a lost opportunity to  test, refine, and integrate operations and systems, and it puts more  pressure on the 2018 Test to demonstrate that enumeration activities will  function as needed for 2020.
section_title: Critical IT Uncertainties
paragraphs: The Bureau needs to strengthen the management and oversight of  all IT programs, systems, and contractors supporting the decennial:  The redesign of the 2020 Census relies on many new and modified IT  systems. In addition to those systems that are being managed and  developed within the 2020 Census Directorate, the 2020 program is also  heavily dependent upon 11 systems that are being delivered by the  CEDCaP program—a large and complex modernization program within  the IT Directorate. Importantly, as a result of the Bureau’s challenges in  key IT internal controls and its rapidly approaching deadline, we identified  CEDCaP as an IT investment in need of attention in the February 2015  high-risk report. In addition, in August 2016, we reported that the 2020  program and CEDCaP program lacked effective processes for managing  their schedule, risk, and requirements interdependencies.
For example, among tens of thousands of schedule activities, the two  programs were expected to manually identify activities that are dependent  on each other, and rather than establishing one integrated dependency  schedule, the programs maintained two separate dependency schedules.  We reported that this contributed to misaligning milestones between the  programs. We stated that until the two programs establish schedules that  are completely aligned, develop an integrated list of all interdependent  risks, and finalize processes for managing requirements, both programs  are at risk of not delivering their programs as expected.
The Bureau is also relying on contractor support in many key areas,  including technically integrating all of the key systems and infrastructure,  and developing many of the key data collection systems. Specifically, in  August 2016, the Bureau hired a contractor to technically integrate the  2020 Census systems and infrastructure, to include evaluating the  systems and infrastructure, developing the infrastructure (e.g., cloud or  data center) to meet the Bureau’s scalability and performance needs,  integrating all of the systems, and supporting testing activities.
In addition, the Bureau is relying on contractors to develop a number of  key systems and infrastructure; these activities include (1) developing the  IT platform that will be used to collect data from a majority of  respondents—by using the Internet, telephone, and NRFU activities; (2)  procuring the mobile devices and cellular service to be used for NRFU;  and (3) developing the IT infrastructure in the field offices. A greater  reliance on contractors for these key components of the 2020 Census  requires the Bureau to focus on sound management and oversight of the  key contracts, projects, and systems.
Key IT decisions need to be prioritized and made in time for full end- to-end testing in 2017: We have issued a series of reports and  testimonies that have discussed the Bureau’s challenges in prioritizing  and making IT decisions. In April 2014, we reported that the Bureau had  not prioritized key IT research and testing needed for its 2020 Census  design decisions. In February 2015, we reported that the Bureau had  not determined how key IT research questions would be answered—such  as the expected rate of respondents using its Internet response option or  the IT infrastructure that would be needed to support this option.
Further, we testified, in November 2015, that key IT decisions needed to  be made soon because the Bureau was less than 2 years away from  preparing for end-to-end testing of all systems and operations, and there was limited time to implement them. We emphasized that the Bureau  had deferred key IT-related decisions, and that it was running out of time  to develop, acquire, and implement the systems it will need to deliver the  redesign.
In October 2016, Bureau officials stated that they had 16 IT-related and  32 partially IT-related decisions left to make, including the uses of cloud- based solutions, the tools and test materials to be used during integration  testing, and the expected scale of the system workload for those  respondents who do not use the Bureau-provided Census ID. It will be  important to make these decisions in enough time to develop solutions  before the End-to-End Test begins in August 2017.
Information security risks and challenges need to be addressed to  secure the Bureau’s systems and data: In August 2016, we described  the significant challenges that the Bureau faces in securing systems and  data, such as developing policies and procedures to minimize the threat  of phishing aimed at stealing personal information and ensuring that  individuals gain only limited and appropriate access to 2020 Census data.  Because many of the systems to be used in the 2018 End-to-End Test  are not yet fully developed, the Bureau has not finalized all of the controls  to be implemented, completed an assessment of those controls,  developed plans to remediate any control weaknesses, and determined  whether there is time to fully remediate any weaknesses before the  system test.
section_title: Unreliable 2020 Cost Estimate
paragraphs: Estimation does not conform to best practices: We reviewed the  Bureau’s October 2015 estimated comprehensive life-cycle cost for the  2020 Census and reported in 2016 that it did not conform to best  practices, and, as a result, the estimate was unreliable. Cost estimates  that appropriately account for risks facing an agency can help an agency  manage large, complex activities like the 2020 Census, as well as help  Congress make funding decisions and provide oversight. Cost estimates  are also necessary to inform decisions to fund one program over another,  to develop annual budget requests, to determine what resources are  needed, and to develop baselines for measuring performance.
We found that although the Bureau had taken significant steps to improve  its capacity to carry out an effective cost estimate, its estimate for the  2020 Census partially met the characteristics of two best practices  (comprehensive and accurate) and minimally met the other two (well- documented and credible), where all four need to be substantially met in  order for an estimate to be deemed high-quality.
According to best practices, to be comprehensive an estimate has to  have enough detail to ensure that cost elements are neither omitted nor  double-counted, and all cost-influencing assumptions are detailed in the  estimate’s documentation, among other things. While Bureau officials  were able to provide us with several documents that included projections  and assumptions that were used in the cost estimate, we found the  estimate to be partially comprehensive because it is unclear if all life-cycle  costs are included in the estimate or if the cost estimate completely  defines the program.
Credible cost estimates clearly identify limitations due to uncertainty or  bias surrounding the data or assumptions, according to best practices.  We found the estimate minimally met best practices for this characteristic  in part because the Bureau carried out its risk and uncertainty analysis  only for about $4.6 billion (37 percent) of the $12.5 billion total estimated  life-cycle cost, excluding, for example, consideration of uncertainty over  what the decennial census’s estimated part will be of the total cost of  CEDCaP.
Accurate estimates are unbiased and contain few mathematical mistakes.  We found the estimate partially met best practices for this characteristic,  in part because we could not independently verify the calculations the  Bureau used within its cost model, which the Bureau did not have  documented or explained outside its limited access cost estimation  software.
Finally, the Bureau’s cost-estimate was not well-documented. Improving  cost estimation practices will increase the reliability of the Bureau’s cost  estimate, which will, among other things, help improve decision making,  budget formulation, progress measurement, and accountability for results.
The Bureau’s cost estimate had other shortcomings as well. For example,  in 2016 we found that the Bureau’s cost estimation team did not record  how and why it changed assumptions that were provided to it, and the  Bureau lacked written guidance and procedures for the cost estimation  team to follow. Moreover, key risks were not accounted for in the cost  estimate although this is an important best practice.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Robert  Goldenkoff at (202) 512-2757 or GoldenkoffR@gao.gov; or David Powner  at (202) 512-9286 or PownerD@gao.gov.
section_title: Related GAO Products
paragraphs: 2020 Census: Additional Actions Could Strengthen Field Data Collection  Efforts. GAO-17-191. Washington, D.C.: January 26, 2017.
Information Technology: Better Management of Interdependencies  between Programs Supporting 2020 Census Is Needed. GAO-16-623.  Washington, D.C.: August 9, 2016.  2020 Census: Census Bureau Needs to Improve Its Life-Cycle Cost  Estimating Process. GAO-16-628. Washington, D.C.: June 30, 2016.  2020 Census: Additional Actions Would Help the Bureau Realize  Potential Administrative Records Cost Savings. GAO-16-48. Washington,  D.C.: October 20, 2015.  2020 Census: Key Challenges Need to Be Addressed to Successfully  Enable Internet Response. GAO-15-225. Washington, D.C.: February 5,  2015.  2020 Census: Census Bureau Can Improve Use of Leading Practices  When Choosing Address and Mapping Sources. GAO-15-21.  Washington, D.C.: October 2, 2014.  2020 Census: Bureau Needs to Improve Scheduling Practices to  Enhance Ability to Meet Address List Development Deadlines.  GAO-14-59. Washington, D.C.: November 21, 2013.  2020 Census: Additional Steps Are Needed to Build on Early Planning.  GAO-12-626. Washington, D.C.: May 17, 2012.
Decennial Census: Additional Actions Could Improve the Census  Bureau’s Ability to Control Costs for the 2020 Census. GAO-12-80.  Washington, D.C.: January 24, 2012.  2010 Census: Census Bureau Has Made Progress on Schedule and  Operational Control Tools, but Needs to Prioritize Remaining System  Requirements. GAO-10-59. Washington, D.C.: November 13, 2009.
section_title: U.S. Government’s Environmental Liability
subsections: section_title: Why Area Is High Risk
paragraphs: The federal government’s environmental liability has been growing for the  past 20 years and is likely to continue to increase. For fiscal year 2016,  the federal government’s estimated environmental liability was $447  billion—up from $212 billion for fiscal year 1997. However, this estimate  does not reflect all of the future cleanup responsibilities federal agencies  may face. Because of the lack of complete information and the often  inconsistent approach to making cleanup decisions, federal agencies  cannot always address their environmental liabilities in ways that  maximize the reduction of health and safety risks to the public and the  environment in a cost effective manner.
The federal government is financially liable for cleaning up areas where  federal activities have contaminated the environment. Various federal  laws, agreements with states, and court decisions require the federal  government to clean up environmental hazards at federal sites and  facilities—such as nuclear weapons production facilities and military  installations. Such sites are contaminated by many types of waste. numerous site-specific factors, stakeholder agreements, and legal  provisions.
We have also found that some agencies do not take a holistic, risk- informed approach to environmental cleanup that aligns limited funds with  the greatest risks to human health and the environment. Since 1994, we  have made at least 28 recommendations related to addressing the federal  government’s environmental liability. These include 22 recommendations  to the Department of Energy (DOE) or the Department of Defense (DOD),  1 recommendation to the Office of Management and Budget to consult  with Congress on agencies’ environmental cleanup costs, 1  recommendation to the Department of Agriculture (USDA), and 4  recommendations to Congress to change the law governing cleanup  activities. Of these, 13 recommendations remain unimplemented. If  implemented, these steps would improve the completeness and reliability  of the estimated costs of future cleanup responsibilities and lead to more  risk-based management of the cleanup work.
section_title: What Remains to Be Done
paragraphs: Future progress in addressing the U.S. government’s environmental  liabilities depends, among other things, on how effectively federal  departments and agencies set priorities, under increasingly restrictive  budgets, that maximize the risk reduction and cost-effectiveness of  cleanup approaches. As a first step, some departments and agencies  may need to improve the completeness of information about long-term  cleanup responsibilities and their associated costs so that decision  makers, including Congress, can consider the full scope of the federal  government’s cleanup obligations. As a next step, certain departments,  such as DOE, may need to change how they establish cleanup priorities.  For example, DOE’s current practice of negotiating agreements with  individual sites without considering other sites’ agreements or available  resources may not ensure that limited resources will be allocated to  reducing the greatest environmental risks, and costs will be minimized.
We have recommended actions to federal agencies that, if implemented,  would improve the completeness and reliability of the estimated costs of  future cleanup responsibilities and lead to more risk-based management  of the cleanup work.
subsections: section_title: Completeness of Environmental Liability Estimates
paragraphs: In 1994, we recommended that Congress amend certain legislation to  require agencies to report annually on progress in implementing plans  for completing site inventories, estimates of the total costs to clean up  their potential hazardous waste sites, and agencies’ progress toward  completing their site inventories and on their latest estimates of total  cleanup costs. We believe these recommendations are as relevant, if  not more so, today.
In 2015, we recommended that the USDA develop plans and  procedures for completing their inventories of potentially contaminated  sites. USDA disagreed with this recommendation. However, we  continue to believe that USDA’s inventory of contaminated and  potentially contaminated sites—in particular, abandoned mines,  primarily on Forest Service land—is insufficient for effectively  managing USDA’s overall cleanup program. Interior is also faced with  an incomplete inventory of abandoned mines that they are working to  improve.
section_title: Reliability of Environmental Liability Estimates
paragraphs: In 2006, we recommended that DOD develop, document, and  implement a program for financial management review, assessment,  and monitoring of the processes for estimating and reporting  environmental liabilities. This recommendation has not been  implemented.
section_title: Risk-Based Decision- Making
paragraphs: We have found in the past that DOE’s cleanup strategy is not risk- based and should be re-evaluated. DOE’s decisions are often driven  by local stakeholders and certain requirements in federal facilities  agreements and consent decrees. In 1995, we recommended that  DOE set national priorities for cleaning up its contaminated sites using  data gathered during ongoing risk evaluations. This recommendation  has not been implemented.
In 2003, we recommended that DOE ask Congress to clarify its  authority for designating certain waste with relatively low levels of  radioactivity as waste incidental to reprocessing, and therefore not  managed as high-level waste. In 2004, DOE received this specific  authority from Congress for the Savannah River and Idaho Sites,  thereby allowing DOE to save billions of dollars in waste treatment  costs. The law, however, excluded the Hanford Site.
More recently, in 2015 we found that DOE is not comprehensively  integrating risks posed by National Nuclear Security Administration’s  (NNSA) nonoperational contaminated facilities with EM’s portfolio of  cleanup work. By not integrating nonoperational facilities from NNSA,  EM is not providing Congress with complete information about EM’s  current and future cleanup obligations as Congress deliberates annually  about appropriating funds for cleanup activities. We recommended that  DOE integrate its lists of facilities prioritized for disposition with all NNSA  facilities that meet EM’s transfer requirements, and that EM should  include this integrated list as part of the Congressional Budget  Justification for DOE. DOE neither agreed nor disagreed with this  recommendation.
section_title: Additional Details on What GAO Found
paragraphs: Of the federal government’s estimated $447 billion environmental  liability—up from $212 billion for fiscal year 1997—DOE is responsible  for by far the largest share of the liability and DOD is responsible for the  second largest share. The rest of the federal government makes up the  remaining 3 percent of the liability with agencies such as the National  Aeronautics and Space Administration (NASA) and the Departments of  Transportation, Veterans Affairs, USDA, and Interior holding large  liabilities (see figure 13).
subsections: section_title: Department of Energy
paragraphs: DOE was responsible for over 80 percent ($372 billion) of the U.S.  government’s fiscal year 2016 reported environmental liability, mostly  related to nuclear waste cleanup. DOE’s total reported environmental  liability has generally increased since fiscal year 2000 (see figure 14).  According to audit documentation related to DOE’s fiscal year 2016  financial statements, 50 percent of the DOE’s environmental liability  resides at two cleanup sites: the Hanford Site in Washington State and  the Savannah River Site in South Carolina. program —and delays and scope changes for major construction projects  at the Hanford and Savannah River sites.
We testified in February 2016 that DOE’s estimated liability does not  include billions in expected costs. According to government accounting  standards, environmental liability estimates include costs that are  probable and reasonably estimable, meaning that costs that cannot yet  be reasonably estimated are not included in total environmental liability.  Examples of costs that DOE cannot yet estimate include the following:
DOE has not yet developed a cleanup plan or cost estimate for the  Nevada National Security Site and, as a result, the cost of future  cleanup of this site was not included in DOE’s fiscal year 2015  reported environmental liability. The nearly 1,400-square-mile site has  been used for hundreds of nuclear weapons tests since 1951. These  activities have resulted in more than 45 million cubic feet of  radioactive waste at the site. According to DOE’s financial statement,  since DOE is not yet required to establish a plan to clean up the site,  the costs for this work are excluded from DOE’s annually reported  environmental liability.
DOE’s reported environmental liability includes an estimate for the  cost of a permanent nuclear waste repository, but these estimates are  highly uncertain and likely to increase. In response to the termination  of the Yucca Mountain repository program, DOE proposed separate  repositories for defense high-level and commercial waste in March  2015. In January 2017, we reported that the cost estimate for DOE’s  new approach excluded the costs and time frames for key activities.
As a result, the full cost of these activities is likely more than what is  reflected in DOE’s environmental liability.
There are several possible causes for the large and growing amount of  money that DOE will need to meet its cleanup responsibilities. First, as  our and other organizations’ reports issued over the last 2 decades have  found, DOE’s environmental cleanup decisions are not risk-based and its  risk-based decision making is sometimes impeded by selection of  cleanup remedies that are not appropriately tailored to the risks  presented, and inconsistencies in the regulatory approaches followed at  different sites. We and others have pointed out that DOE needs to take a  nation-wide, risk-based approach to cleaning up these sites, which could  reduce costs while also reducing environmental risks more quickly.  Examples include the following:  In 1995, we found that DOE’s cleanup strategy had been shaped by  site-specific environmental agreements whose priorities and  requirements had not always been consistent with technical or fiscal  realities and that, under severe budgetary constraints, using many  separately-negotiated agreements is not well suited to setting  priorities among sites. We recommended that DOE set national  priorities for cleaning up its contaminated sites. DOE responded at  that time that because of limitations on the science of risk  assessment, it had no intention of developing national, risk-based  priorities for its cleanup work. In a later report, we found that DOE’s  compliance agreements did not provide a means of prioritizing among  sites and, therefore, DOE had not developed a comprehensive,  relative ranking of the risks that it faces across its sites. DOE has  been unsuccessful in its attempts to develop such a methodology in  the past and, as a result, DOE has no systematic way to make  cleanup decisions among sites based on risk. the waste’s origins rather than on its actual radiological risks. The  Academy concluded that by working with regulators, public  authorities, and local citizens to implement risk-informed practices,  waste cleanup efforts can be done more cost-effectively. The report  also suggested that statutory changes were likely needed. In 2011,  the Academy also reported that DOE could realize significant benefits  by providing more realistic safety- and risk-informed analyses.
In 2015, a review organized by the Consortium for Risk Evaluation  with Stakeholder Participation reported that DOE is not optimally  using available resources to reduce risk. According to the report,  factors such as inconsistent regulatory approaches and certain  requirements in federal facility agreements cause disproportionate  resources to be directed at lower priority risks. The report called for a  more systematic effort to assess and rank risks within and among  sites, including through headquarters guidance to sites, and to  allocate federal taxpayer monies to remedy the highest priority risks  through the most efficient means.
Second, DOE’s cleanup approach is based primarily on a series of  compliance agreements and consent orders between DOE, the  Environmental Protection Agency (EPA), and state regulators. According  to one DOE official, 40 such agreements establish the requirements for  DOE’s cleanup work. We have reported in the past that these agreements  include thousands of associated milestones. Some of the 40 agreements  were made decades ago and may be based on outdated information  about the effectiveness of certain cleanup technologies.
Third, DOE may have insufficient controls in place to accurately account  for its environmental liabilities. In January 2017, the DOE Inspector  General reported a significant deficiency in internal control related to the  reconciliation of environmental liabilities.
section_title: Department of Defense
paragraphs: its sites. In July 2010, we reported that DOD spent almost $30 billion from  1986 to 2008 across its environmental cleanup and restoration activities  at its installations. More recently, in its July 2016 annual report to  Congress on environmental cleanup, DOD reported spending an average  of about $1.8 billion each year for its environmental cleanup activities  from fiscal years 2011 to 2016.
DOD’s inability to estimate with assurance key components of its  environmental liabilities was a material weakness. We reported in  January 2017 that this weakness still exists. Examples of uncertainties in  DOD reported environmental liabilities include the following:
DOD’s current environmental liability estimate does not include  additional costs that will likely be needed for DOD to complete the  cleanup for BRAC activities. We reported in January 2017 that DOD  estimates it will need about $3.4 billion in addition to the $11.5 billion it  has already spent to manage and complete environmental cleanup of  BRAC installations. We also found that DOD’s annual report on its  environmental cleanup program does not include significant costs  associated with cleanup of contaminants at its installations, including  those closed under BRAC.
DOD’s estimate does not include the total costs associated with  cleaning up weapons sites. According to DOD’s fiscal year 2015  Agency Financial Report (AFR), DOD is unable to estimate and report  a liability for the environmental restoration that is needed to clean up  buried chemical munitions and agents at certain sites, among other  things, because the extent of the buried chemical munitions and  agents is unknown.
DOD may also incur costs not currently included in its environmental  liability estimate for restoration initiatives in conjunction with returning  overseas DOD facilities to host nations. According to DOD’s fiscal  year 2015 AFR, DOD is unable to provide a reasonable estimate  because the extent of required restoration is unknown.
section_title: Other Federal Agencies
paragraphs: The remainder of the U.S. government’s estimated environmental liability  (about $12 billion in fiscal year 2016) was managed by numerous  departments and agencies and, similar to the DOE and DOD portions, is  likely to increase. Federal agencies with large reported environmental  liabilities in fiscal year 2016 included NASA, USDA, and the Departments  of Transportation, Veterans Affairs, and Interior. Since 2000, the reported  environmental liability for these agencies has also increased (see figure  17). which the federal government will pay cleanup costs may depend on  whether or not financially viable responsible parties, including current and  former mine owners and operators, can be identified. Additionally, neither  department has a complete inventory of its cleanup responsibilities. For  example,
USDA: For fiscal year 2016, USDA reported an environmental liability  of $196 million. As of April 2014, USDA had identified 1,491  contaminated sites but this list is incomplete as many more potentially  contaminated sites, including abandoned mines, have not yet been  identified. In 2015, we found that USDA does not have a reliable,  centralized site inventory or plans and procedures for completing one,  in particular for abandoned mines. For example, in fiscal year 2013,  USDA reported $3 million for the Forest Service’s environmental  liability. In 2015, we found that this figure did not include any cleanup  costs for abandoned mines. The Forest Service estimates that there  could be from 27,000 to 39,000 abandoned mines on its lands— approximately 20 percent of which may pose some level of risk to  human health or the environment—and the federal government may  have to pay for cleanup of some of these mines. USDA’s Forest  Service has not developed a complete, consistent, or usable inventory  of abandoned mines and had no plans and procedures for developing  such an inventory. Without a reliable inventory, USDA cannot  effectively estimate its ultimate cost to cleanup these sites.
Interior: For fiscal year 2016, Interior reported an environmental  liability of about $830 million. We found in 2015 that Interior had an  inventory of 4,722 sites, including 85 abandoned mines, with  confirmed or likely contamination. However, Interior may have future  cleanup responsibilities and, as a result, ultimate cleanup costs may  exceed the currently reported environmental liability. Specifically,  Interior’s Bureau of Land Management (BLM) has identified over  30,000 abandoned mines—some of which will the federal government  may have to pay to clean up—that have not yet been assessed for  contamination. Furthermore, this inventory is not complete as BLM  estimated that there are at least 100,000 abandoned mines that have  not yet been inventoried. While cost estimates for addressing these  mines are not currently included in Interior’s liability, information for  certain types of mines indicates that the ultimate cost of Interior’s  future cleanup responsibilities are greater than what is reflected in the  reported environmental liability. BLM is working to improve the  completeness and accuracy of its inventory.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact David  Trimble, Director, Natural Resources and Environment, 202-512-3841 or  trimbled@gao.gov.
section_title: Related GAO Products
paragraphs: Military Base Realignments and Closures: DOD Has Improved  Environmental Cleanup Reporting but Should Obtain and Share More  Information. GAO-17-151. Washington, D.C.: January 19, 2017.
Department of Energy: Observations on Efforts by NNSA and the Office  of Environmental Management to Manage and Oversee the Nuclear  Security Enterprise. GAO-16-422T. Washington, D.C.: February 23, 2016.
DOE Facilities: Better Prioritization and Life Cycle Cost Analysis Would  Improve Disposition Planning. GAO-15-272. Washington, D.C.: March 19,  2015.
Hazardous Waste: Agencies Should Take Steps to Improve Information  on USDA’s and Interior’s Potentially Contaminated Sites. GAO-15-35.  Washington, D.C.: January 16, 2015.
DOD Financial Management: Effect of Continuing Weaknesses on  Management and Operations and Status of Key Challenges.  GAO-14-576T. Washington, D.C.: May 13, 2014.
Uranium Mining: Opportunities Exist to Improve Oversight of Financial  Assurances. GAO-12-544. Washington, D.C.: May 17, 2012.
Superfund: Interagency Agreements and Improved Project Management  Needed to Achieve Cleanup Progress at Key Defense Installations.  GAO-10-348. Washington, D.C.: July 15, 2010.
Military Base Closures: Opportunities Exist to Improve Environmental  Cleanup Cost Reporting and to Expedite Transfer of Unneeded Property.  GAO-07-166. Washington, D.C.: January 30, 2007.
Environmental Liabilities: Long-Term Fiscal Planning Hampered by  Control Weaknesses and Uncertainties in the Federal Government’s  Estimates. GAO-06-427. Washington, D.C.: March 31, 2006.
Nuclear Waste: Challenges to Achieving Potential Savings in DOE’s  High-Level Waste Cleanup Program. GAO-03-593. Washington, D.C.:  June 17, 2003.
Long-Term Commitments: Improving the Budgetary Focus on  Environmental Liabilities. GAO-03-219. Washington, D.C.: January 24,  2003.
Environmental Liabilities: Cleanup Costs From Certain DOD Operations  Are Not Being Reported. GAO-02-117. Washington, D.C.: December 14,  2001.
Environmental Liabilities: DOD Training Range Cleanup Cost Estimates  Are Likely Understated. GAO-01-479. Washington, D.C.: April 11, 2001.
Department of Energy: National Priorities Needed for Meeting  Environmental Agreements. GAO/RCED-95-1. Washington, D.C.: March  3, 1995.
Federal Facilities: Agencies Slow to Define the Scope and Cost of  Hazardous Waste Site Cleanups. GAO/RCED-94-73. Washington, D.C.:  April 15, 1994.
section_title: DOD Supply Chain Management
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of Defense (DOD) manages about 4.9 million secondary  inventory items, such as spare parts, with a reported value of $91.7 billion  as of September 2015. Effective and efficient supply chain management  is critical for supporting the readiness and capabilities of the force and for  helping to ensure that DOD avoids spending resources on unneeded  inventory that could be better applied to other defense and national  priorities. However, DOD has experienced weaknesses in the  management of its supply chain, particularly in the following areas:  Inventory management. DOD’s inventory management practices  and procedures have been ineffective and inefficient. DOD has  experienced high levels of inventory that were in excess of  requirements and weaknesses in accurately forecasting the demand  for inventory items.
Materiel distribution. DOD has faced challenges in delivering  supplies and equipment, including not meeting delivery standards and  timelines for cargo shipments as well as not maintaining complete  delivery data for surface shipments.
Asset visibility. DOD has had weaknesses in maintaining visibility of  supplies, such as problems with inadequate radio-frequency  identification information to track all cargo movements.
We added supply chain management to the High-Risk List in 1990. In our  February 2015 update, we reported that DOD had made moderate  progress in addressing weaknesses in supply chain management, but  had not resolved several long-standing problems. For example, DOD had  not developed a corrective action plan to address materiel distribution  weaknesses or performance metrics based on reliable data to assess  performance across the entire distribution pipeline. With respect to asset  visibility, DOD had not fully developed performance measures that will  effectively ensure that the department’s initiatives improve asset visibility.
section_title: What GAO Found
paragraphs: Since our February 2015 high-risk update, DOD has made progress in  addressing all three dimensions of its supply chain management:  inventory management, materiel distribution, and asset visibility. For  inventory management, DOD has met all five high-risk criteria. For this  reason, we are removing inventory management from the supply chain  management high-risk area. For materiel distribution, DOD has continued  to demonstrate leadership commitment and capacity and has developed  a corrective action plan to guide and direct the department’s efforts to  improve materiel distribution support to the warfighter. However, work  remains to fully meet the monitoring and demonstrated progress high-risk  criteria. For asset visibility, DOD has continued to meet the leadership  commitment criteria and has met the capacity and corrective action plan  criteria—the latter in fiscal year 2015 by updating and implementing the  Strategy for Improving DOD Asset Visibility (Strategy). However,  additional actions are needed to fully meet the remaining two criteria— monitoring and demonstrated progress. In a December 2016 letter from  the Under Secretary of Defense for Acquisition, Technology, and  Logistics to the Chairman of the Committee on Oversight and  Government Reform, U.S. House of Representatives, the department  generally agreed with our assessment of progress made and outlined  ongoing and planned actions to address the remaining issues.
section_title: What Remains to Be Done
subsections: section_title: Materiel Distribution
paragraphs: In October 2014, we provided DOD with a letter that outlined six actions  and outcomes that we believe it should address in order to mitigate or  resolve long-standing weaknesses in materiel distribution and address  the criteria for removal from the High-Risk List. Based on discussions with  DOD officials and recent efforts across the department as of November  2016, we believe that DOD has addressed three of the six actions and  outcomes. Specifically, DOD has addressed the actions and outcomes  associated with the action plan criterion by developing the Materiel  Distribution Improvement Plan (Improvement Plan) that contains  implementation goals and timelines that will guide its effort to identify  gaps and root causes with respect to the performance of the entire  distribution pipeline. However, DOD still needs to address the three  remaining actions and outcomes from the October 2014 letter that are  related to monitoring and demonstrating progress. Additionally, based on  our review of DOD’s efforts to improve materiel distribution, we are  adding an additional action focused on ensuring DOD refines and  updates its actions in the Improvement Plan based on interim progress  and results, which results in four remaining actions and outcomes that  need to be addressed for removal of materiel distribution from the High- Risk List. Going forward, DOD needs to show measureable and sustained  positive outcomes addressing the remaining four actions and outcomes.
subsections: section_title: Monitoring
paragraphs: make progress in developing its suite of distribution performance  metrics, improving the quality of data underlying those metrics, and  sharing metrics information among stakeholders;  integrate distribution metrics data, including cost data, from the  combatant commands and other DOD components, as appropriate,  on the performance of all legs of the distribution system, including the  tactical leg; and  refine existing actions in the Improvement Plan or incorporate  additional actions based on interim progress and results, and update  the Improvement Plan accordingly.
section_title: Demonstrated Progress
paragraphs: demonstrate that the actions implemented under its Improvement  Plan improve its capability to comprehensively measure distribution  performance, identify distribution problems and root causes, and  identify and implement solutions.
section_title: Asset Visibility
paragraphs: Our October 2014 letter to DOD outlined seven actions and outcomes  that we believe it should address in order to mitigate or resolve long- standing weaknesses in asset visibility and address the criteria for  removal from the High-Risk List. Based on discussions with DOD officials  and recent efforts across the department as of January 2017, we believe  that DOD has addressed five of the seven actions and outcomes.  Specifically, DOD has addressed the actions and outcomes associated  with the capacity and action plan criteria by the department providing  additional direction to the components on formulating cost estimates and  the components implementing that direction in developing its cost  estimates for the asset visibility initiatives.
Additionally, DOD linked the goals and objectives of the Strategy with the  specific initiatives intended to implement the Strategy, established a  mechanism for periodically assessing the initiatives, and implemented  numerous initiatives. Based on our review of DOD’s efforts to improve  asset visibility, we are adding an additional action aimed at improving the  monitoring of the individual improvement initiatives, which results in three  remaining actions and outcomes that need to be addressed for removal of  asset visibility from the High-Risk List. Going forward, DOD needs to  show measureable and sustained positive outcomes in addressing these  remaining three actions and outcomes.
subsections: section_title: Monitoring
paragraphs: assess, and refine as appropriate, performance measures by, for  example, incorporating the attributes (e.g., clear, quantifiable,  objective, and reliable) of successful performance measures; and  take steps to incorporate into after-action reports information relating  to performance measures for the asset visibility initiatives.
section_title: Demonstrated Progress
paragraphs: DOD should demonstrate sustained progress in having implemented the  initiatives that result in measurable outcomes and progress towards  realizing the goals and objectives in the Strategy.
section_title: Additional Details on What GAO Found
subsections: section_title: Inventory Management
paragraphs: Senior officials, such as the Deputy Assistant Secretary of Defense for  Supply Chain Integration (DASD(SCI)), have continued to demonstrate  commitment and top leadership support for addressing the department’s  inventory management challenges. These officials have taken actions,  such as establishing a performance management framework to monitor  and implement its corrective action plan since 2010 and revising inventory  management policy and guidance, to institutionalize this commitment to  help ensure the long-term success of the department’s efforts. In addition,  senior DOD officials have met with us to discuss the department’s plans  and progress in addressing inventory management challenges, and we  have provided feedback on the department’s efforts.
subsections: section_title: Capacity
paragraphs: DOD has continued to demonstrate that it has the capacity—personnel  and resources—to strengthen inventory management. DOD has  continued to use structured working groups, which include  representatives from each of the military services and the Defense  Logistics Agency (DLA), to address inventory management weaknesses.  Furthermore, DOD has dedicated financial resources to evaluating  aspects of inventory management that need improvement, such as  commissioning studies designed to improve forecasting for spare parts.
section_title: Action Plan
paragraphs: DOD has continued to implement its corrective action plan, established in  fiscal year 2010, that had actions and goals scheduled through fiscal year  2016, and has developed a follow-on improvement plan to guide efforts  through 2020. As noted in our February 2015 update, DOD established  overarching goals to reduce “on-order excess inventory” (i.e., items that  have already been purchased but may be excess due to changes in  requirements) and “on-hand excess inventory” (i.e., items that have been  categorized for potential reuse or disposal). Additionally, DOD’s actions in  its original and follow-up plans address key root causes of weaknesses in  its inventory management, such as excess inventory and demand  forecasting for spare parts. Since our February 2015 update, DOD has  continued to implement actions associated with the plan across a number  of areas of inventory management, such as demand forecasting, and has  developed and begun implementing a follow-on improvement plan with  actions and milestones intended to guide the department’s improvement  efforts through 2020.
section_title: Monitoring
paragraphs: DOD has continued to use a performance management framework,  including metrics and milestones, to track the implementation and  effectiveness of the areas of inventory management included in the  corrective action plan. The DASD(SCI) oversees implementing the  corrective action plan and monitors performance on the associated  metrics through progress review meetings with representatives from the  military services and DLA. The meetings are held about monthly.
section_title: Demonstrated Progress
paragraphs: Since fiscal year 2010, DOD has demonstrated sustained progress  sufficient to remove the inventory management area from the supply  chain management high-risk category. Specifically, DOD has  demonstrated progress in the following four key areas of inventory  management, and used our findings and implemented our  recommendations to improve the department’s management of inventory:
Reducing excess inventory: Since fiscal year 2009, DOD has  reduced the percentage and value of its on-order excess inventory— items already purchased that may be excess due to subsequent  changes in requirements—and its on-hand excess inventory—items  categorized for potential reuse or disposal. DOD’s data show that the  proportion of on-order excess inventory to the total amount of on- order inventory decreased from 9.5 percent at the end of fiscal year  2009 to 7.0 percent at the end of fiscal year 2015, the most recent  fiscal year for which data is available. During these years, the value of  on-order excess inventory also decreased from $1.3 billion to $701  million. DOD’s data show that the proportion of on-hand excess  inventory to the total amount of on-hand inventory dropped from 9.4  percent at the end of fiscal year 2009 to 7.3 percent at the end of  fiscal year 2015. The value of on-hand excess inventory also  decreased during these years from $8.8 billion to $6.8 billion. DOD  plans to continue to monitor the amount of excess inventory in its  follow-on improvement plan.
Revising policy and guidance: DOD has made key revisions to its  inventory management policy and guidance. Based on analysis  conducted as part of its corrective action plan, the department  updated its main supply chain management policy in February 2014.  The update strengthened its guidance for on-order excess inventory,  the management of “retention stock” (i.e., inventory calculated to be  more economical to keep than to dispose of and repurchase because  it will likely be needed in the future or inventory retained to support  specific contingencies), and demand forecasting. DOD subsequently  continued to update aspects of the guidance, such as adding  requirements associated with overseeing contractor-managed  inventory in August 2015. DOD also developed and implemented, in  March 2016, a guide that standardizes inventory management metrics  across the services and DLA. Lastly, DOD developed and began  implementing plans to update its policy and guidance as it continues  to oversee inventory management through its follow-on improvement  plan.
Addressing demand forecasting weaknesses: As we noted in our  February 2015 update, DOD has taken actions to improve the  accuracy of its demand forecasting for spare parts in an effort to  address a key root cause of both excess inventory and parts  shortages. First, in fiscal years 2010 through 2014, DOD reviewed its  demand forecasting methods, which led to a number of changes in  DOD’s guidance to the services and DLA aimed at improving the  accuracy of demand forecasting.
Second, DOD established department-wide forecasting accuracy  metrics in 2013. Its key metric helped department officials determine  that their forecast accuracy has improved from 46.7 percent in fiscal  year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for  which complete data are available. As of August 2016, since our  February 2015 update, DOD has been working to establish  procedures, including statistical techniques, for setting appropriate  targets to continue to guide improvement in the accuracy of  forecasting the demand for spare parts.
Third, DOD and DLA, in fiscal year 2013, modified approaches for  setting inventory levels for over 495,000 consumable items with low or  highly variable demand, and continue to monitor the effect of these  changes through a suite of performance metrics. The Air Force also is  in the process of implementing a similar method for setting levels for  reparable items with low demand and is refining an approach for  reparable items with variable demand and conducting additional  analysis before deciding to implement it.
Fourth, DOD has made progress improving its collaborative  forecasting (i.e., using customer input to forecast demand versus  relying solely on statistical forecasting methods) for spare parts.  Specifically, we found in June 2016 that DLA partnered with the  services to improve collaborative forecasting efforts through an  analytical, results-oriented approach, such as regularly monitoring key  performance metrics. The approach is tailored for each service, and  DOD identified in its follow-on improvement plan that it will analyze  these different approaches and assess areas for improvement in an  effort to further reduce excess inventory and shortages. DLA also  designed an additional metric for its collaborative forecasting program  to more accurately assess and manage the program and plans to fully  implement the metric by July 2017. DOD also is in the process of  designing and adopting metrics to assess the accuracy of inventory  planning factors, such as the accuracy of part lists that are used to  determine the type and quantity of parts to buy for depot maintenance  activities, and plans to implement these metrics by the end of fiscal  year 2018.
Enhancing the management and oversight of retention stock:  DOD has continued to take actions to improve the management of  retention stock across the department. For example, since fiscal year  2009, DOD has monitored the amount of its retention stock relative to  on-hand inventory, reviewed and updated its policy and guidance for  retention stock, and taken steps to ensure retention stock is managed  consistently across the department. Further, in response to our June  2014 recommendation for the DLA Director to dispose of retention  stock based on the results of an economic analysis, the Director  changed DLA’s on-hand inventory reduction goal, which was leading  DLA to dispose of items that the department’s guidance and DLA’s  analysis showed were more economical to keep. With respect to  “contingency retention stock” (i.e., items retained to support specific  contingencies, such as disaster relief or civil emergencies), the  department independently assessed its management in March 2011  and implemented resulting recommendations, such as establishing  categories and tracking the reasons for retaining contingency  retention stock.
Lastly, DOD has used our findings and implemented our  recommendations to improve how it manages inventory. Since May 2006,  we have made 63 recommendations aimed at improving the efficiency  and effectiveness of the department’s inventory management. As of  January 2017, DOD has implemented 42 of those recommendations and  was in the process of taking actions to implement an additional 13  recommendations, which are focused generally on re-assessing inventory  goals, improving collaborative forecasting, and making changes to  information technology systems used to manage inventory. The  remaining eight recommendations were made in fiscal years 2007 and  2009 and focused on improving the management of acquisition lead times  for spare parts and oversight of Army and Navy inventory management,  respectively. However, these recommendations are no longer relevant  given the department’s efforts since 2010.
section_title: Materiel Distribution
subsections: section_title: Leadership Commitment
paragraphs: Senior leaders have continued to demonstrate commitment and support  for addressing the department’s materiel distribution challenges. In April  2015, DOD established a distribution working group to draft a plan of  actions and milestones for improving materiel distribution. The working  group is co-chaired by the Office of the Deputy Assistant Secretary of  Defense for Supply Chain Integration and the U.S. Transportation  Command (USTRANSCOM). Other stakeholders include the Office of the  Deputy Assistant Secretary of Defense for Transportation Policy, the  military services, the Joint Staff, and DLA. As a result of the working  group’s efforts, DOD completed its Materiel Distribution Improvement  Plan (Improvement Plan), and the Acting Assistant Secretary of Defense  for Logistics and Materiel Readiness signed it in September 2016.
According to the Improvement Plan, the Supply Chain Executive Steering  Committee will receive regular updates on the progress of the  Improvement Plan’s implementation. The steering committee is chaired  by the Deputy Assistant Secretary for Supply Chain Integration and  includes senior-level supply chain stakeholders from across DOD. Under  its charter, the steering committee oversees implementation of initiatives  designed to improve logistics.
section_title: Capacity
paragraphs: DOD has continued to demonstrate that it has the capacity—personnel  and resources—to improve materiel distribution. Key organizations in  DOD’s global distribution system and its associated governance structure  are USTRANSCOM, its military components, and DLA. Although the  Improvement Plan does not quantify the level of resources required to  accomplish corrective actions, it recognizes that some additional  resources will likely be needed. With regard to developing a new  distribution cost metric, for example, the Improvement Plan states that the  metric would require a majority of its data inputs from two principal  stakeholders—DLA and USTRANSCOM —and that many inputs can be  pulled from existing data sources. However, there are likely other sources  of information that must be identified or developed, some of which will  require additional resources or processes to capture and validate relevant  information that is not currently gathered.
According to the Improvement Plan, the distribution governance structure  is expected to provide the resources and staff to complete each  recommended action in the Improvement Plan and close any identified  performance gaps within the time frame specified. The governance  structure includes senior DOD officials. At the top of this structure is the  Distribution Process Owner Executive Board, which is chaired by the  Commander, USTRANSCOM, and whose members are at the 3-Star or  Senior Executive Service (SES) equivalent level. The next most senior  body, the Distribution Oversight Council, is chaired by the Deputy  Commander, USTRANSCOM, and has members at the 1- and 2-Star and  SES equivalent level. The Council is tasked with ensuring that high- priority initiatives and enterprise improvements are pursued,  commensurate with authorized resources.
section_title: Action Plan
paragraphs: Since our February 2015 high-risk update, DOD has taken steps that  meet our high-risk criteria for developing a corrective action plan to  address the department’s materiel distribution challenges. The Acting  Assistant Secretary of Defense for Logistics and Materiel Readiness  signed the Improvement Plan in September 2016. According to the Acting  Assistant Secretary, the Improvement Plan will guide and direct the  department’s efforts to improve materiel distribution support to the  warfighter by detailing specific goals and actions to better measure the  end-to-end distribution process, ensure the accuracy of underlying data  used to measure that process, and strengthen and integrate distribution  policies and the governance structure.
The Improvement Plan lists 18 actions divided among 3 lines of effort: (1)  metrics and performance, (2) data accuracy, and (3) policy and  governance. The intent of these lines of effort and actions is to improve  DOD’s capability for measuring the performance of its materiel distribution  system, enabling continuous process improvement. According to the  Improvement Plan, DOD “must be able to measure performance with  certainty across the enterprise before it can affect  meaningful  improvements in the distribution function.” In addition, the Acting  Assistant Secretary of Defense for Logistics and Materiel Readiness  states in the Improvement Plan that a robust policy and governance  structure ensures that DOD can form, implement, and monitor corrective  actions that address root causes and close distribution performance gaps  once they are identified.
The Improvement Plan provides time frames for completing each of the  18 actions. It calls for 11 of the actions to be completed within 1 year of  the Improvement Plan’s approval, 4 additional actions to be completed  within 2 years of the Improvement Plan’s approval, and the remaining 3  actions to be completed within 3 years of the Improvement Plan’s  approval. Going forward, DOD’s Distribution Steering Group will assume  responsibility for executing the Improvement Plan. The Distribution  Steering Group, part of the distribution governance structure, is co- chaired by staff within USTRANSCOM and DLA.
section_title: Monitoring
paragraphs: DOD has partially met this criterion. Through its Improvement Plan, DOD  aims to improve its capability to measure the performance of the  distribution system by developing a suite of distribution performance  metrics, improving the quality of data underlying those metrics, and  sharing metrics information among stakeholders. While DOD has  numerous distribution metrics in place, a team within the Distribution  Working Group determined that five metrics should be included in its new  suite of metrics. The selected metrics are aimed at addressing various  attributes of the distribution system: responsiveness, reliability,  information visibility, and efficiency/cost.
The Improvement Plan’s focus on these efforts has the potential, if  implemented, to improve DOD’s ability to monitor various performance  attributes of its distribution system. However, the Improvement Plan  acknowledges that work remains to be done to investigate expanding the  use of certain performance metrics, develop other metrics, improve data  quality, and change policies to provide greater transparency of  performance data and conduct routine reviews of performance metrics.
DOD’s Improvement Plan refers to measuring performance for all legs of  the distribution system, including the tactical leg. Specifically, one of the  goals in the Improvement Plan is for greater transparency of service,  agency, and combatant command distribution performance data,  including cost data. The Improvement Plan identifies where a policy  change could be made to capture and provide such data. However, the  Improvement Plan does not specify the nature of data to be collected  from the DOD components or how the data would be integrated with other  metrics to measure the performance of all legs of the distribution system,  including the tactical leg, and allow DOD to comprehensively monitor and  oversee the materiel distribution system.
section_title: Demonstrated Progress
paragraphs: DOD began implementing its Improvement Plan in 2016. However, it is  too early to assess whether implementing its Improvement Plan will result  in the necessary demonstrated progress. However, the Improvement Plan  is a key step toward meeting this criterion. Specifically, as discussed  above, the Improvement Plan is aimed at improving the department’s  capability to comprehensively measure distribution performance. With a  performance measurement system in place, DOD will be better positioned  to identify distribution problems, along with root causes and solutions.
DOD has identified next steps for implementing its Improvement Plan.  According to the DASD(SCI), the Distribution Working Group (which  developed the Improvement Plan) will formulate an approach to  completing the Improvement Plan’s actions. The Distribution Steering  Group will assume responsibility for executing and overseeing the  Improvement Plan.
We have previously noted that DOD has made progress in addressing its  materiel distribution challenges. For example, DOD was able to improve  delivery times for some customers and use available assets more. These  efforts, according to DOD officials, resulted in $1 billion in cost  avoidances through April 2013. In its Improvement Plan, DOD highlighted  initiatives it has taken to improve distribution and noted that efforts to  improve asset visibility also benefit materiel distribution. However,  challenges remain in addressing materiel distribution weaknesses. As we  reported in 2015, current materiel distribution metrics used by the  department do not provide decision makers with a complete  representation of performance across the entire global distribution  pipeline. Further, although joint doctrine has set efficient and effective  distribution “from the factory to the foxhole” as a priority, these metrics do  not always include performance for the final destination. In addition, DOD  may not have sufficiently reliable data to accurately determine the extent  to which it has met the standards it has established for distribution  performance. DOD’s Improvement Plan is focused on these issues, but it  will be important for the department to demonstrate progress in  measuring the entire pipeline and ensuring the reliability of its data and  measures as implementation of the Improvement Plan evolves.
section_title: Asset Visibility
subsections: section_title: Leadership Commitment
paragraphs: Senior leaders at the department have continued to demonstrate  commitment to addressing the department’s asset visibility challenges as  evidenced, in part, by DOD issuing, in January 2014 and October 2015,  its Strategies for Improving DOD Asset Visibility. The Office of the Deputy  Assistant Secretary of Defense for Supply Chain Integration oversees  department-wide how the Strategy is developed, coordinated, approved,  and implemented, and reviews the implementation of the initiatives. Also,  senior leadership commitment is evident in its involvement in efforts to  improve asset visibility through groups such as the Supply Chain  Executive Steering Committee—senior-level officials responsible for  overseeing asset visibility improvement efforts—and the Asset Visibility  Working Group; which includes representatives from the components and  other government agencies, as needed; identifies opportunities for  improvement; and monitors the implementation of initiatives. Sustained  leadership commitment will be critical moving forward as the department  continues to implement its Strategies intended to improve asset visibility  and associated asset visibility initiatives.
section_title: Capacity
paragraphs: DOD now meets this criterion. As we previously reported in February  2013 and continued to report in February 2015 resources and  investments should be discussed in a comprehensive strategic plan, to  include the costs to execute the plan and the sources and types of  resources and investments—including skills, human capital, technology,  information and other resources—required to meet established goals and  objectives. DOD has demonstrated that it has the capacity—personnel  and resources—to improve asset visibility. For example, as we previously  noted the department had established the Asset Visibility Working Group  that is responsible for identifying opportunities for improvement; and  monitoring the implementation of initiatives. The Working Group includes  representatives from OSD and the components—Joint Staff, DLA,  USTRANSCOM, and each of the military services. Furthermore, DOD’s  2015 Strategy calls for the components to consider items such as  manpower, materiel, and sustainment costs when documenting cost  estimates for the initiatives in the Strategy, as we recommended in  January 2015. However, in December 2015 we found that the 2015  Strategy included three initiatives that did not include cost estimates.  DOD has taken steps to address this weakness.
Specifically, in December 2016, a DOD official provided an abstract from  the draft update to the 2015 Strategy that provides additional direction on  how to explain and document cases where the funding for the initiatives is  embedded within overall program funding. The draft update notes that  there may be instances where asset visibility improvements are  embedded within a larger program, making it impossible or cost  prohibitive to isolate the cost associated with the specific asset visibility  improvements. In these cases, the plan outlining the initiative will indicate  that cost information is not available and why. However, if at some point  during implementation some or all costs are identified, the information  about the initiative will be updated to reflect as such. According to Office  of the Secretary of Defense (OSD) officials, DOD plans to issue the  update to the 2015 Strategy in 2017, but a release date has not been  determined.
section_title: Action Plan
paragraphs: DOD now meets this criterion. The National Defense Authorization Act for  Fiscal Year 2014 (NDAA) required DOD to submit to Congress a  comprehensive strategy and implementation plans for improving asset  tracking and in-transit visibility. The 2014 NDAA, among other things,  called for DOD to include in its strategy and plans elements such as goals  and objectives for implementing the strategy. The NDAA also included a  provision that we assess the extent to which DOD’s strategy and  accompanying implementation plans include the statutory elements. In  January 2014, DOD issued its 2014 Strategy and accompanying  implementation plans, which outline initiatives intended to improve asset  visibility. DOD updated its 2014 Strategy and plans in October 2015.
We previously reported in February 2013 and continued to report in  February 2015 that while the 2014 Strategy and implementation plans  serve as a corrective-action plan, there was not a clear link between the  initiatives and the Strategy’s goals and objectives. We recommended that  DOD clearly specify the linkage between the goals and objectives in the  Strategy and the initiatives intended to implement the Strategy. DOD  implemented our recommendation and updated its 2015 Strategy, which  includes matrixes that link each of DOD’s ongoing initiatives intended to  implement the Strategy to the Strategy’s overarching goals and  objectives. DOD also added eight new initiatives to its 2015 Strategy and  linked each of these efforts to the Strategy’s overarching goals and  objectives.
section_title: Monitoring
paragraphs: DOD partially meets this criterion. As we previously reported in 2013 and  continued to report in February 2015, DOD lacked a formal, central  mechanism to monitor the status of improvements or fully track the  resources allocated to them. We also reported that, while DOD’s draft  strategy included overarching goals and objectives that address the  overall results desired from implementing the strategy, it only partially  addressed, among other factors, performance measures, which are  necessary for DOD to monitor progress. Since February 2015, DOD has  taken some steps to better monitor its improvement efforts. As noted in  the 2015 Strategy, DOD described a process that tasks the Asset  Visibility Working Group—a team that oversees the development and  execution of DOD’s Strategy—to, among other things, review the  performance of the component’s initiatives during implementation on a  quarterly basis. According to OSD officials, they plan to issue an update  to the 2015 Strategy, but the release date for this update has not been  determined.
The Working Group uses status reports from the DOD components that  include information on progress made toward implementation milestones,  resources, and funding. DOD also identified performance measures for its  asset visibility initiatives. However, the measures for the eight initiatives  we reviewed were generally not clear, quantifiable, objective, and reliable.  Measures with these attributes can help managers better monitor  progress, including determining how well they are achieving their goals  and identifying areas for improvement, if needed. Additionally, while the  Asset Visibility Working Group has closed initiatives, the Working Group  generally did not have information related to performance measures to  assess the progress of these initiatives.
As a result, DOD is unable to consistently monitor progress in achieving  the Strategies’ goals and objectives. In December 2016, a DOD official  provided an abstract from the draft update to the 2015 Strategy that noted  that detailed metrics data will be collected and reviewed at the level  appropriate for the initiative. High-level summary metrics information will  be provided to the Working Group in updates to the plan outlining the  initiatives. The extent this planned change will affect the development of  clear, quantifiable, objective, and reliable performance measures remains  to be determined.
section_title: Demonstrated Progress
paragraphs: DOD partially meets this criterion. While DOD has made progress  developing and implementing the 2014 and 2015 Strategies, the  performance measures associated with the eight initiatives we reviewed  cannot be used to demonstrate results. DOD reports it has closed or will  no longer review the status of 20 of the 27 initiatives from the 2014 and  2015 Strategies and continues to monitor the remaining seven initiatives.  Additionally, in October 2016, DOD officials stated that they plan to add  10 new initiatives in its update to the 2015 Strategy, which will be  released in 2017, but OSD officials have not determined a date.
However, DOD has not taken steps to consistently incorporate  information in after-action reports on initiatives’ performance measures to  demonstrate the extent to which progress has been made toward  achieving its goals for improving asset visibility. Without clear and  quantifiable performance measures and information to support that  progress has been made, DOD may not be able to demonstrate that  implementing these initiatives resulted in measurable outcomes and  progress towards achieving the goals and objectives in the Strategy. Also,  DOD will be limited in its ability to demonstrate sustained progress in  implementing corrective actions and resolving the high-risk area.
section_title: Benefits Achieved by Implementing Our Recommendations
subsections: section_title: Inventory Management:
paragraphs: DOD Developed Metrics Guidance and Uses the Metrics to  Monitor the Efficiency and Effectiveness of Its Inventory  Management: In 2012, we found that DOD was developing metrics to  assess the effectiveness and efficiency of its inventory management,  but that it had not determined if it would incorporate these metrics into  guidance. We noted that without guidance specifying standardized  definitions, methodologies, and procedures for data collection  procedures, DOD’s efforts to employ metrics to monitor and evaluate  inventory management performance may be hampered.
To ensure sustained management attention consistent with results- oriented management practices, we recommended that the Secretary  of Defense direct the Assistant Secretary of Defense for Logistics and  Materiel Readiness to (1) develop and implement guidance that  establishes a comprehensive, standardized set of department-wide  inventory management metrics, including standardized definitions and  procedures for measuring and reporting the metrics, and (2) employ  these metrics in periodically monitoring the effectiveness and  efficiency of its inventory management practices. Based on our  recommendations, the Assistant Secretary of Defense for Logistics  and Materiel Readiness developed and issued the Supply Chain  Metrics Guide in March 2016. This guide identifies a comprehensive,  standardized set of inventory management metrics and identifies each  metric’s application, definition, business value, data requirements,  computational rules, goals and trends analysis, and connections to  other related metrics.
DOD’s metric guidance provided the necessary information to ensure  that metrics across the services and the DLA are standardized and  can be used to manage the department’s inventory. Also, the  DASD(SCI) uses these metrics to regularly monitor the department’s  inventory management practices and outcomes. These actions will  allow the department to monitor the effectiveness and efficiency of its  inventory management practices across the services and the DLA.
The Army Established On-Order Excess Inventory Goals to  Guide Performance Improvement: In our April 2015 report on the  military services’ inventory management, we found that the Army had  not established goals for reducing on-order excess inventory. To  improve management and minimize the amount of on-order excess  inventory, we recommended that the Secretary of the Army direct the  Commander, Army Materiel Command, to develop life-cycle  management command-specific goals for the reduction of on-order  excess inventory and monitor these goals. Based on our  recommendation, in April 2015, the Army established on-order excess  inventory goals for its life-cycle management commands and began  monitoring its performance against those goals. These actions will  provide the Army the ability to better oversee on-order excess  inventory and maximize the amount of on-order excess inventory it  reduces.
The Navy Established Management Reviews to Improve  Oversight of On-Order Excess Inventory: In our April 2015 report  on the military services’ inventory management, we found that the  Navy did not use management reviews of potential on-order excess  inventory based on dollar thresholds, as required by DOD guidance,  resulting in a lack of oversight of on-order excess inventory. To help  ensure the Navy adequately oversees on-order excess termination  decisions, we recommended the Secretary of the Navy direct the  Commander, Naval Supply Systems Command, to incorporate  graduated management reviews based on dollar value thresholds into  its current on-order excess inventory termination practices. Based on  our recommendation, as of September 2015, the Navy began  management reviews based on dollar value thresholds. This action  will provide the Navy the ability to better oversee on-order excess  inventory, thereby preventing unneeded inventory from being  procured.
DLA Revised Its Fiscal Year 2014 On-Hand Inventory Goal: In our  June 2014 report on DLA inventory management, we found that DLA,  in order to meet its on-hand inventory goal in fiscal year 2013,  disposed of $855 million in inventory that its own economic analyses  determined should be kept due to the risk DLA will need to buy the  same items again in the future. To ensure that DLA does not dispose  of inventory that is more economic to keep, in accordance with DOD  guidance, we recommended that the Secretary of Defense direct the  Director, DLA, to reassess and, if determined appropriate, revise  DLA’s inventory reduction goals and schedule to achieve them in a  way that minimizes risks and costs of having to buy items again in the  long term. Based on our recommendation, in July 2014, DLA re- examined and documented its on-hand inventory reduction goal for  fiscal year 2014. As a result of the review, DLA revised its on-hand  inventory goal for fiscal year 2014 from $10 billion to about $10.9  billion. Adjusting its goals will result in DLA needing to dispose of less  inventory to meet the goals, which reduces the risk DLA may have to  buy the same inventory in the future.
DLA Incorporated On-Order Excess Inventory Metrics into Senior  Management Performance Briefings: In our June 2014 report on  DLA inventory management, we found that DLA senior management  did not regularly review on-order excess inventory performance and  that performance across DLA’s aviation, land, and maritime supply  chains varied. To improve management and minimize the amount of  on-order excess inventory, we recommended the Secretary of  Defense direct the Director, DLA, to regularly monitor progress  reducing on-order excess inventory through DLA’s senior  management performance briefings. Based on our recommendation,  in July 2014, DLA began including on-order excess inventory metrics  in DLA’s Agency Performance Review, which is reviewed quarterly by  the DLA Director and monthly by DLA headquarters senior logistics  operations managers. As a result of these actions, senior  management will oversee on-order excess inventory performance and  guide continued improvement managing its on-order inventory.
DLA Established and Monitors Supply Chain-Specific On-Order  Excess Inventory Goals: In our June 2014 report on DLA inventory  management, we found that DLA had not established supply chain- specific goals for on-order excess inventory and that performance  across DLA’s aviation, land, and maritime supply chains varied. To  improve management and minimize the amount of on-order excess  inventory, we recommended the Secretary of Defense direct the  Director, DLA, to establish and regularly monitor supply chain-specific  on-order excess goals that support DLA minimizing its investment in  inventory that is not needed to meet requirements and achieving the  DOD goal of 4 percent of the total value of on-order inventory by the  end of fiscal year 2016.
Based on our recommendation, DLA established supply chain-specific  goals of 6 percent in July 2014 that were aligned with DOD goals for  fiscal year 2014. In July 2014, DLA also began monitoring supply  chain-specific on-order excess inventory performance against DOD’s  established department wide goals as part of its monthly Agency  Performance Reviews. These actions will provide DLA the ability to  guide continued improvement in reducing on-order excess inventory  as well as monitor supply chain-specific performance against DOD’s  goals.
DLA Is Tracking and Reviewing On-Order Excess Inventory  Performance Data: In our June 2014 report on DLA inventory  management, we found that DLA had not consistently tracked and  reported data to thoroughly measure its efforts to reduce on-order  excess inventory. To improve management and minimize the amount  of on-order excess inventory, we recommended the Secretary of  Defense direct the Director, DLA, to track and regularly review  performance data, such as the amount of on-order excess inventory  reviewed, modified, or cancelled, and the reasons for not modifying or  cancelling, in its inventory management processes. Based on our  recommendation, as of June 2016, DLA implemented a monthly  report process that reviews performance cancelling of on-order  excess inventory as well as the reasons for decisions to retain or  cancel on-order excess contracts. As part of this review process, DLA  reports bi-annually on the status of its on-order excess inventory,  specifically the reasons for retaining on-order excess contracts. These  actions will provide DLA the ability to better oversee on-order excess  inventory, including tracking and monitoring the reasons for retaining  on-order excess inventory.
section_title: Asset Visibility:
paragraphs: DOD Made Clear the Linkage between Its Goals and Objectives  and Its Asset Visibility Initiatives: In our January 2015 report on  DOD’s efforts to improve asset visibility, we found that DOD’s 2014  Strategy included goals and objectives, but these goals and objectives  were not linked with the initiatives. We recommended that DOD  clearly specify the linkage between the goals and objectives in the  Strategy and the initiatives intended to implement the Strategy. In  October 2015, DOD issued its 2015 update to its Strategy, which  included graphics showing a summary of the initiatives and their  alignment to the Strategy’s goals and objectives. As a result of making  apparent the alignment between its goals and objectives in the 2015  Strategy and the initiatives intended to implement them, DOD should  be better positioned to assess progress toward realizing its goals and  objectives.
DOD Included the Elements Considered in Its Cost Estimates for  Asset Visibility Initiatives: In our January 2015 report on DOD’s  efforts to improve asset visibility, we found that DOD’s Strategy did  not specify the specific elements included in its cost estimates, such  as human capital, information, and other resources required to meet  the goals and objectives. That is, the components provided cost  estimates in the plans outlining the initiatives, but generally at an  aggregate level without details of the elements included.
We recommended DOD include this information in subsequent  updates to its Strategy. As a result, in its 2015 update to its Strategy,  DOD provided direction instructing the components to include cost  estimates in their plans outlining the initiatives and to include at least  the categories of manpower, materiel, and sustainment in these  estimates of cost. As a result of updating its Strategy to require the  components to include information on the specific elements included  in cost estimates, DOD gains insights on the elements considered in  developing the cost estimates and the level of detailed cost  information it needs to make well-informed decisions about asset  visibility.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Zina Merritt at  (202) 512-5257 or merrittz@gao.gov or Cary Russell at (202) 512-5431 or  russellc@gao.gov.
section_title: Related GAO Products
paragraphs: Defense Inventory: Further Analysis and Enhanced Metrics Could  Improve Service Supply and Depot Operations. GAO-16-450.  Washington, D.C.: June 9, 2016.
Defense Logistics: DOD Has Addressed Most Reporting Requirements  and Continues to Refine its Asset Visibility Strategy. GAO-16-88.  Washington, D.C.: December 22, 2015.
Defense Inventory: Services Generally Have Reduced Excess Inventory,  but Additional Actions Are Needed. GAO-15-350. Washington, D.C.: April  20, 2015.
Defense Logistics: Improvements Needed to Accurately Assess the  Performance of DOD’s Materiel Distribution Pipeline. GAO-15-226.  Washington, D.C.: February 26, 2015.
Defense Logistics: DOD Has a Strategy and Has Taken Steps to Improve  Its Asset Visibility, but Further Actions Are Needed. GAO-15-148.  Washington, D.C.: January 27, 2015.
Defense Inventory: Actions Needed to Improve the Defense Logistics  Agency’s Inventory Management. GAO-14-495. Washington, D.C.: June  19, 2014.
section_title: DOD Weapon Systems Acquisition
subsections: section_title: Why Area Is High Risk
paragraphs: In March 2016, we reported that the Department of Defense (DOD)  expects to invest $1.4 trillion (fiscal year 2016 dollars) to develop and  procure its portfolio of 79 major defense acquisition programs. Congress  and DOD have long sought to improve how major weapon systems are  acquired, yet many DOD programs fall short of cost, schedule, and  performance expectations, meaning DOD pays more than anticipated,  can buy less than expected, and, in some cases, delivers less capability  to the warfighter. With the prospect of slowly-growing or flat defense  budgets for years to come, DOD must get better returns on its weapon  system investments and find ways to deliver capability to the warfighter  on time and within budget.
section_title: What GAO Found
paragraphs: Top leadership at DOD is committed to improving the way DOD acquires  weapon systems. Since we added this area to our High-Risk List in 1990,  DOD has made progress in addressing challenges, such as through the  Better Buying Power initiatives outlined by the Office of the Under  Secretary of Defense for Acquisition, Technology, and Logistics since  2010. Although DOD lacks a comprehensive action plan for fully  addressing this high-risk area and its root causes, the Better Buying  Power initiatives are a step in the right direction, as DOD has prescribed  a number of concrete changes. DOD has partially met the criteria for  monitoring by issuing a series of annual performance reports on the  portfolio of major defense acquisition programs. In 2016, DOD issued the  fourth report in this series. Continuing and expanding this series of  reports should help DOD measure its progress over time.
DOD has partially met the criteria for capacity by, for example, updating  some policies to enable better outcomes and assessing the acquisition  workforce. However, we remain concerned about whether DOD will fully  implement its proposed reforms or continue to track progress in meeting  workforce goals, as DOD has, in the past, failed to convert policy into  practice. DOD has partially met the criteria for demonstrating progress as  it relates to the cost and schedules of its weapon programs. Although we  reported in March 2016 on the progress many DOD programs are making  in reducing their cost, as demonstrated by improvements when measured  against cost-growth targets, individual weapon programs are still not  conforming to best practices for acquisition, or implementing key  acquisition reforms and initiatives that could prevent long-term cost and  schedule growth.
Our work reveals that, while there is still cost and schedule growth in  major defense acquisition programs, DOD is making progress in  decreasing the amount of cost growth realized in the portfolio as a whole.  In March 2016, we reported that the total acquisition cost of DOD’s fiscal  year 2015 portfolio of 79 programs decreased by $2.5 billion from the  previous year. The decrease, however, was due primarily to reductions  in a few programs. The majority of individual programs, 42 of the 79,  increased in cost.
In terms of schedule, the time it took to deliver initial capabilities to the  warfighter increased, on average, an additional 2.4 months. Our analysis  also showed evidence that DOD made progress in improving efficiencies  in its programs from 2014 to 2015. When we account for increased costs  attributable to increased program quantity, 38 programs improved their  buying power—that is, the amount of goods procured for dollars spent.
DOD’s major acquisition programs also showed some improvement when  measured against the three cost-growth targets we have used to measure  DOD’s progress in the weapon system acquisition high-risk area since  2011. Most notably, 72 percent of programs meet the threshold for less  than 10 percent growth over the past 5 years, and 76 percent meet the  threshold for less than 2 percent growth in the past year, both an  improvement over past assessments (see figure 18).
In addition, Congress has been working to reform the process for  acquiring weapon systems for several years. In the National Defense  Authorization Acts (NDAA) for just the past 5 years, for example,  Congress has enacted the following reforms, among others:  In the 2013 NDAA, Congress introduced measures to control costs on  acquisition programs by requiring DOD to limit the use of cost-type  contracts for production, and to open programs to competition at the  subcontract level.
In the 2014 NDAA, Congress expanded requirements for cost  reporting by requiring DOD to include additional cost and schedule  estimates in its annual reports to Congress.
In the 2016 NDAA, Congress made numerous reforms to the  acquisition process including requiring more close involvement of the  service chiefs; requiring DOD to report on efforts to streamline the  requirements, acquisition, and budgeting processes; stipulating the  use and contents of an acquisition strategy; and reducing the number  of certifications required for programs at milestone reviews.
In the 2017 NDAA, Congress enacted reforms to require modular  open system approaches in major programs, further ensure the  achievement and reporting of program goals, modify requirements for  independent cost estimates, and reorganize the acquisition authority  within the Office of the Secretary of Defense.
section_title: What Remains to Be Done
paragraphs: At this point, DOD needs to build on existing reforms—not necessarily  revisiting the process itself but augmenting it by tackling incentives.  Based on our extensive body of work in weapon systems acquisition,  DOD could examine best practices to integrate critical requirements, resources,  and acquisition decision-making processes; attract, train, and retain acquisition staff and managers so that they  are both empowered and accountable for program outcomes; use funding decisions at the start of new programs to reinforce  desirable principles such as well-informed acquisition strategies;  identify significant risks up front and resource them; explore ways to align budget decisions and program decisions more  investigate tools, such as limits on system development time, to  improve program outcomes.
Further, we have open priority recommendations related to four  acquisition programs that would benefit from greater attention given the  size of DOD’s investments in them and their cost, schedule, and  performance challenges, including the following:  In April 2015, we made one priority recommendation for the F-35 Joint  Strike Fighter program, that DOD analyze the affordability of the  program’s current procurement plan that reflects various assumptions  about future technical progress and funding availability. DOD stated  that it would analyze affordability as part of an internal deliberative  process culminating in the services’ annual budget request.
We made one priority recommendation for the Littoral Combat Ship  program in July 2014. This recommendation stated that the program  should successfully complete key tests—such as shock, anti-air  warfare self-defense testing, or final survivability assessments— before contracting for additional ships. The Navy’s recent decision to  restructure the program alters the timing of our recommendation, but  does not change our intent to ensure that the Navy does not continue  to commit to additional ships until it demonstrates that it has attained  some level of knowledge in key areas, such as ship survivability.
In September 2013, we made three priority recommendations for the  lead ship in the Ford-class aircraft carrier fleet, designated as CVN  78. DOD should explore capability trade-offs, update the Ford-class  program’s test and evaluation master plan to allot sufficient time for  testing, and adjust the post-delivery test schedule to ensure that  system integration testing is completed prior to operational testing.  DOD has made progress in implementing these recommendations by,  for example, completing a cost-benefit analysis to determine the  acquisition strategy for the follow-on ship. DOD, however, failed to  fully explore capability trade-offs, and it remains to be seen whether  additional time has been allotted to complete testing, as an updated  test and evaluation master plan has not been approved.
We made two priority recommendations in April 2013 for the Missile  Defense Agency and its programs. We recommended that the agency  both stabilize its acquisition baselines to enable meaningful  comparisons over time and make its cost estimates more  comprehensive by including military services’ operation and support  costs. While DOD generally concurred with our recommendations, the  Missile Defense Agency’s baselines continue to change, and agency  decision makers still have not been informed of full program costs.
Finally, Congress has an important role to play in advancing weapon  system acquisition reform overall, particularly in what it sanctions via  funding approvals. Programs that propose optimistic or rushed acquisition  strategies represent opportunities for Congress to either maintain or  change the defense acquisition culture—a prevailing set of incentives that  encourages decisions to go forward with programs before they are ready,  and a willingness to accept cost growth and schedule delays as the likely  byproduct of such decisions. When programs that do not follow  acquisition best practices are denied funding approval, those risky  acquisition strategies, in effect, lack congressional sanction.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: DOD has met the criterion for leadership commitment. DOD continues to  demonstrate a strong commitment, at the highest levels, to improving the  management of its weapon system acquisitions. Over the past 6 years,  the Office of the Under Secretary of Defense for Acquisition, Technology,  and Logistics has implemented a series of efforts for acquisition reform  through its Better Buying Power initiative. In January 2015, DOD updated  its acquisition instruction, furthering this commitment as it incorporates  many of the Better Buying Power initiatives, as well as acquisition reforms  from the Weapon Systems Acquisition Reform Act of 2009 and other  legislation. These actions are consistent with our past findings and  recommendations.
If these initiatives are to have a lasting, positive effect, however, decision  makers need to be held accountable for implementing them. Our recent  work shows there is much ground yet to cover.
section_title: Capacity
paragraphs: DOD has partially met the criterion for capacity. Across the portfolio, DOD  has unevenly implemented knowledge-based acquisition practices that  might prevent or mitigate cost growth. When we assessed DOD weapon  programs in March 2016, we found that while DOD continues to show  progress in following a knowledge-based approach to reduce risk, it has  significant room for improvement. While programs that have recently  passed through major decision points have demonstrated best  practices—such as planning to constrain development times and  achieving design stability—key practices like demonstrating technology  maturity or controlling manufacturing processes are still not being fully  implemented. Of the 17 programs we assessed that had recently passed  through one of three key decision points in the acquisition process, only 3  had implemented all of the applicable knowledge-based practices  applicable for that decision point. The remaining programs will carry  technology, design, and production risks, which increase cost and  schedule risks, into subsequent phases of the acquisition process. In  March 2016, we also reported that implementation of the Better Buying  Power and acquisition reform initiatives varied across programs. While  91 percent of programs successfully implemented “should-cost” initiatives  and reported significant cost savings, only 67 percent had established  affordability constraints.
In addition, DOD has not completely implemented the direction to improve  competition. Of the 12 future programs we assessed in our March 2016  report on selected weapon programs, half did not plan to conduct  competitive prototyping before the start of development, and many  current programs did not have acquisition strategies to ensure  competition through the end of production. Eight current programs  reported that they will not take actions to promote any competitive  measures before or after development start.
A significant element of capacity is whether the agency has the workforce  in place to resolve risks. DOD has made some progress in managing its  acquisition workforce. Specifically, in October 2016, DOD issued its  updated acquisition workforce strategic plan which, among other things,  assessed the current capability of the workforce and identified risks that  DOD needed to manage to meet future needs. DOD acknowledged,  however, that it will need to develop and implement metrics to track  progress towards meeting the four strategic goals identified in its October  2016 strategic workforce plan. Further, the workforce plan does not  establish specific career field goals or targets, which will hinder efforts to  ensure DOD has the right people with the right skills to meet future  needs.
section_title: Action Plan
paragraphs: DOD has partially met the criterion for an action plan as it lacks a  comprehensive action plan for fully addressing this high-risk area and its  root causes, but addresses some of these issues in its Better Buying  Power initiatives. Better Buying Power outlines some steps DOD can take  across its acquisition portfolio to achieve better results. These initiatives  include measures such as setting and enforcing affordability constraints,  instituting a long-term investment plan for portfolios of weapon systems,  implementing “should cost” management to control contract costs, and  eliminating redundancies within portfolios. The initiatives also emphasize  the need to adequately grow and train the acquisition workforce.
section_title: Monitoring
paragraphs: DOD has partially met the criterion for monitoring progress. In December  2008, we, DOD, and the Office of Management and Budget discussed a  set of cost growth metrics and goals to evaluate DOD’s progress on  improving program performance for purposes of our high-risk report.  These metrics were designed to capture total cost-growth performance  over 1- and 5-year periods as well as from the original program estimate  on a percentage basis, as opposed to dollar amount to control for the  differences in the amount of funding among programs. DOD no longer  supports the use of these metrics. We continue to believe that the current  metrics have value.
DOD has made some progress in its efforts to assess the root causes of  poor weapon system acquisition outcomes, and monitor the effectiveness  of its actions to improve how it manages weapon systems acquisition. In  2016, DOD issued the fourth in what is promised to be an annual series  of performance reports on its portfolio of major defense acquisition  programs. The report examines a wide range of acquisition-related  information, such as contract type, contractor incentives, and the effects  of statutes and policies to determine if there is any statistical correlation  between these factors and good or poor acquisition outcomes. The report  is a good step, but DOD needs to continue to refine and enhance this  reporting. In addition, the department or Congress should formalize a  requirement for the report to ensure it continues despite changes in  leadership.
section_title: Demonstrated Progress
paragraphs: DOD has partially met the criterion for demonstrating progress. As we  reported in March 2016, many DOD programs are making progress  reducing costs, as demonstrated by improvements when measured  against cost-growth targets. However, individual weapon programs are  still not conforming to best practices for acquisition or implementing key  acquisition reforms and initiatives that could prevent long-term cost and  schedule growth.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: Over the past 4 fiscal years, our analyses of DOD’s weapon system  acquisitions have resulted in nearly $30 billion in financial savings. We  have reported on the F-35 Joint Strike Fighter (JSF) program, DOD’s  most expensive aircraft acquisition, for over a decade. A recurring theme  in this body of work has been the program’s very aggressive and risky  acquisition strategy, particularly the substantial concurrency, or overlap,  among development, testing, and production activities. We repeatedly  cautioned against procuring large quantities of aircraft before the system  design was stable, performance verified through testing, and the  manufacturing process capable of efficiently building aircraft at the  planned production rates.
We made numerous recommendations aimed at reducing annual  procurements, delaying plans to accelerate production, and focusing  more time and resources on system development and testing. We  amplified this message in annual “Quick Look” reports, congressional  testimonies, and numerous budget justification reviews. Defense officials  acknowledged the concurrency in the JSF acquisition strategy, but stated  that the risks were manageable.
DOD’s position started to change, however, after years of cost growth  and schedule delays. Consistent with our findings and recommendations,  DOD decreased near-term procurement quantities by 103 aircraft for  fiscal years 2013 and 2014 at a budgeted savings of about $9 billion, and  by 187 aircraft for fiscal years 2015 through 2017 at a budgeted savings  of about $12 billion. Congressional defense committees have depended  on our work to provide accurate and realistic information to inform the  ongoing debate on the F-35, and both congressional leaders and top  DOD officials have noted that we were right about concurrency and the  need to decrease annual aircraft purchases.
In addition, as part of our annual work on the Ballistic Missile Defense  System and assessments of defense-wide funding requests for research,  development, test and evaluation, and procurement, we reported to  Congress several times from March 2011 to April 2013 on the high  acquisition risks and lack of analysis supporting the Precision Tracking  Space System (PTSS). PTSS was designed as a satellite system to track  ballistic missiles. We found that the program had developed an optimistic  acquisition approach, including elevated levels of concurrency, and faced  significant design challenges. This approach would have precluded  demonstrations that the laboratory satellite design worked as intended  before the Missile Defense Agency committed to industry-built satellites.  DOD canceled the PTSS program in 2013 because of concerns with the  program’s high-risk acquisition strategy and technical challenges that we  raised, saving approximately $2.7 billion in planned funding for fiscal  years 2014 through 2018.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Michael J.  Sullivan, Director, Acquisition and Sourcing Management at (202) 512- 4841 or sullivanm@gao.gov .
section_title: Related GAO Products
paragraphs: F-35 Joint Strike Fighter: Continued Oversight Needed as Program Plans  to Begin Development of New Capabilities.GAO-16-390. Washington,  D.C.: April 14, 2016.
KC-46 Tanker Aircraft: Challenging Testing and Delivery Schedules Lie  Ahead. GAO-16-346. Washington, D.C.: April 8, 2016.
Defense Acquisitions: Assessments of Selected Weapon Programs.  GAO-16-329SP. Washington, D.C.: March 31, 2016.
Defense Advanced Research Projects Agency: Key Factors Drive  Transition of Technologies, but Better Training and Data Dissemination  Can Increase Success. GAO-16-5. Washington, D.C.: November 18,  2015.
Ford Class Aircraft Carrier: Poor Outcomes Are the Predictable  Consequences of the Prevalent Acquisition Culture. GAO-16-84T.  Washington, D.C.: October 1, 2015.
GPS: Actions Needed to Address Ground System Development Problems  and User Equipment Production Readiness. GAO-15-657. Washington,  D.C.: September 9, 2015.
Weapon System Acquisitions: Opportunities Exist to Improve the  Department of Defense’s Portfolio Management. GAO-15-466.  Washington, D.C.: August 27, 2015.
Defense Acquisition Process: Military Service Chiefs’ Concerns Reflect  Need to Better Define Requirements before Programs Start.  GAO-15-469. Washington, D.C.: June 11, 2015.
Defense Acquisitions: Better Approach Needed to Account for Number,  Cost, and Performance of Non-Major Programs. GAO-15-188.  Washington, D.C.: March 2, 2015.
Acquisition Reform: DOD Should Streamline Its Decision-Making Process  for Weapon Systems to Reduce Inefficiencies. GAO-15-192. Washington,  D.C.: February 24, 2015.
F-35 Joint Strike Fighter: Assessment Needed to Address Affordability  Challenges. GAO-15-364. Washington, D.C.: April 14, 2015.
Littoral Combat Ship: Additional Testing and Improved Weight  Management Needed Prior to Further Investments. GAO-14-749.  Washington, D.C.: July 30, 2014.
Ford-Class Carriers: Lead Ship Testing and Reliability Shortfalls Will Limit  Initial Fleet Capabilities. GAO-13-396. Washington, D.C.: September 5,  2013.
Missile Defense: Opportunity to Refocus on Strengthening Acquisition  Management. GAO-13-432. Washington, D.C.: April 26, 2013.
section_title: DOD Financial Management
subsections: section_title: Why Area Is High Risk
paragraphs: Since 2015, the Department of Defense’s (DOD) progress in improving its  financial management processes and operations has been mixed.  Without reliable, useful, and timely financial information, DOD is severely  hindered in making sound decisions affecting the department’s  operations.
DOD financial management was first added to our High-Risk List in 1995.  Long-standing, uncorrected deficiencies with DOD’s financial  management systems, business processes, financial manager  qualifications, and material internal control and financial reporting  weaknesses continue to negatively affect DOD’s ability to manage the  department and make sound decisions on mission and operations.  Having sound financial management practices and reliable, useful, and  timely financial and performance information is important to help ensure  accountability over DOD’s extensive resources and efficiently and  economically manage the department’s assets and budgets. This is  particularly important because DOD’s reported discretionary spending  makes up about half of the federal government’s reported discretionary  spending, and its reported assets represent more than 70 percent of the  federal government’s reported physical assets. However, DOD remains  one of the few federal entities that cannot demonstrate its ability to  accurately account for and reliably report its spending or assets. DOD’s  financial management problems remain one of three major impediments  preventing us from expressing an opinion on the consolidated financial  statements of the federal government.
The effects of DOD’s financial management problems extend beyond  financial reporting. Long-standing internal control deficiencies have  adversely affected the economy, efficiency, and effectiveness of  operations. For example, as we have reported, DOD’s financial  management problems have contributed to (1) inconsistent and  sometimes unreliable reports to Congress on weapon system operating  and support costs, limiting the visibility that Congress needs to effectively  oversee weapon system programs; and (2) an impaired ability to make  cost-effective choices, such as deciding whether to outsource specific  activities or how to improve efficiency through technology. DOD’s efforts  to improve its financial management have been impaired by its  decentralized environment; cultural resistance to change; lack of skilled  financial management staff; lack of effective processes, systems, and  controls; incomplete corrective action plans (CAP); and ineffective  monitoring and reporting.
Effective financial management is also fundamental to achieving DOD’s  broader business transformation goals. However, given DOD’s  decentralized environment and hundreds of nonstandard financial  management business processes and systems, DOD anticipates it will  take several years of effort before it will reach these goals. Current  budget constraints and fiscal pressures make the reliability of DOD’s  financial information and its ability to maintain effective accountability for  its resources increasingly important to the federal government’s ability to  make sound decisions about allocating resources.
The Army, Navy, and Air Force underwent audits of their respective  Schedules of Budgetary Activity (Budgetary Schedules) for fiscal years  2015 and 2016. However, all three of the independent public  accountants (IPA) that performed these audits issued disclaimers,  meaning that the IPAs were not able to complete their work or issue an  opinion because they lacked sufficient evidence to support the amounts  presented. These IPAs also identified material weaknesses in internal  control at the three military services and collectively issued hundreds of  findings and recommendations. As of the end of fiscal year 2016, 700 IPA  findings and recommendations related to the three military services’ fiscal  years 2015 and 2016 Budgetary Schedules remained open. These  weaknesses included the military services’ inability to, among other  things, reasonably assure that the Budgetary Schedules reflected all of  the relevant financial transactions that occurred and that documentation  was available to support such transactions.
The results of these audits illustrate the significant amount of work that  remains for DOD to have reliable, useful, and timely financial  management and performance information for decision making on its  mission and operations. In addition, DOD officials reported in the  November 2016 Financial Improvement and Audit Readiness (FIAR) Plan  Status Report that the department anticipates receiving disclaimers of  opinion on its full financial statements for several years but emphasized  that being subject to audit will help the department make progress.
section_title: What GAO Found
paragraphs: Since 2015, DOD’s progress in improving its financial management  processes and operations has been mixed. DOD has made partial  progress toward demonstrating leadership commitment and developing  capacity and action plans. For example, DOD continues its efforts to  address its financial management challenges through (1) updating the  FIAR Guidance related to service providers, financial reporting of  property, and seven critical capabilities for full audit readiness; (2)  implementing training programs to build a skilled financial management  workforce; and (3) developing a number of action plans. However, DOD  continues to face challenges in monitoring corrective actions and  demonstrating progress.
In furtherance of financial management reform, Congress took the  following actions during fiscal years 2013 through 2016:
The National Defense Authorization Act (NDAA) for Fiscal Year 2013  established certain requirements for the FIAR Plan, including actions  to be taken to ensure that DOD’s Schedule of Budgetary Resources is  validated as ready for audit not later than September 30, 2014, and an  assessment of readiness for the SBR audit.
The NDAA for Fiscal Year 2014 mandated an audit of DOD’s fiscal  year 2018 full financial statements, and that the results be submitted  to Congress not later than March 31, 2019.
Further, the NDAA for Fiscal Year 2016 had several relevant financial  management provisions that, among other things  required coordination with the Federal Accounting Standards  Advisory Board to establish accounting standards to value large  and unordinary general property, plant, and equipment items no  later than September 30, 2017;  required the Secretary of Defense to report to Congress, ranking  the military departments and defense agencies in order of how  advanced they are in achieving auditable financial statements; provided for DOD Office of Inspector General (OIG) involvement  in each DOD component’s annual audit, including obtaining an  audit of each component by an independent external auditor,  participating in selecting the auditors, and monitoring the audits;  required the financial audit reports issued by the independent  external auditors to be submitted to the Under Secretary of  Defense (Comptroller), Controller of the Office of Management  and Budget’s (OMB) Office of Federal Financial Management, and  appropriate congressional committees; and authorized the Secretary of Defense to carry out a pilot program  allowing financial management personnel to temporarily exchange  between DOD and contractors.
Congressional oversight committees have continued to press for  increased progress at DOD through hearings.
section_title: What Remains to Be Done
subsections: section_title: Leadership
paragraphs: DOD needs to assure the sustained involvement of leadership at all levels  of the department in addressing financial management reform and  business transformation. DOD leadership has stated that it is committed  to achieving effective financial management controls to support financial  accountability and reliable and timely information for day-to-day  management decision making, and auditable financial statements.  However, DOD reported in its November 2016 FIAR Plan Status Report  that because some remediation actions and major system and process  changes will not be fully completed, it expects the fiscal year 2018 full  financial statements audit to result in significant audit findings and a  disclaimer of opinion. In addition, DOD reported that it anticipates  receiving disclaimers of opinion on its financial statements for several  years. DOD leadership needs to reasonably assure that DOD  components adhere to the processes in the FIAR Plan and the  accompanying FIAR Guidance so that components have effective  leadership, processes, systems, and controls in place to sustainably  improve DOD’s financial management operations and audit readiness.  Sustained leadership commitment is critical to DOD’s success in  achieving financial accountability and in providing reliable information for  day-to-day management decision making as well as financial audit  readiness.
section_title: Capacity
paragraphs: DOD needs to continue building a workforce with the level of training and  experience needed to support and sustain sound financial management.  DOD needs to address the availability of financial management staff in  light of the mandatory workforce reductions at headquarters. In addition,  to continue building a skilled and knowledgeable workforce, DOD needs  to assure that its financial management certification program continues  developing and refreshing required competencies, periodically assessing  the workforce’s capabilities, identifying competency gaps, and closing  those gaps.
DOD needs to continue to develop and deploy enterprise resource  planning (ERP) systems as a critical component of DOD’s financial  improvement and audit readiness strategy. DOD also will need to  strengthen automated controls or design manual workarounds for the  remaining legacy systems to satisfy audit requirements and improve data  used for day-to-day decision making. The DOD OIG has reported that  DOD continues to have schedule delays in effectively implementing its  ERPs. These delays in implementing ERP systems increase the risk that  DOD will not have reliable information for making important decisions on  mission and operations or meet its goal of being validated as ready for an  audit of its full financial statements by September 30, 2017.
DOD needs to address identified deficiencies in service providers’  systems, processes, and controls that affect the reliability of financial data  and information used in the related business processes. In addition, each  of the components needs to resolve integration issues with DOD service  providers. Further, the military services need to work with Defense Finance and Accounting Service (DFAS) management to address  suspense accounts and support for adjustments made by journal  vouchers.
section_title: Action Plan
paragraphs: DOD needs to assure that military services enhance their policies and  procedures for developing CAPs and improve processes for identifying,  tracking, and remediating financial management related audit findings  and recommendations. Improving remediation processes over these  deficiencies will be more important in light of the hundreds of findings and  recommendations resulting from the fiscal year 2015 and 2016 Budgetary  Schedule audits.
DOD needs to effectively implement its FIAR Plan and FIAR Guidance to  focus on strengthening processes, controls, and systems to improve the  accuracy, reliability, and reporting for the Budgetary Schedule and the  SBR and assess the existence, completeness, and valuation of mission- critical assets. It also needs to fully define, in the FIAR Guidance, actions  needed to resolve long-standing department and component financial  management weaknesses. In taking such actions, DOD should not lose  sight of the ultimate goal of implementing lasting and sustainable financial  management reform which provides reliable, useful, and timely  information for decision making as a routine part of financial management  operations. Auditable financial statements would be a natural byproduct  of the department’s success.
section_title: Monitoring
paragraphs: To effectively monitor its components as they implement the FIAR  Guidance and assess and test controls and remediate control  deficiencies, DOD needs to establish a process for assuring that financial  improvement plans have been effectively implemented. DOD  management will need to monitor and assess the progress that the  department is making. Additionally, the FIAR Directorate should validate  that the military services and other components have achieved the seven  critical capabilities. According to the April 2016 FIAR Guidance, these  seven critical capabilities are related to DOD’s ability to: (1) produce a  universe of transactions; (2) reconcile its Fund Balance with Treasury  (FBWT) (i.e., balance its checkbook); (3) provide supporting  documentation for material adjustments to its financial records; (4)  validate the existence, completeness, and rights of its assets; (5)  establish processes to manage and value its assets correctly; (6)  establish an auditable process for estimating and recording its  environmental and disposal liabilities; and (7) implement critical  information technology controls for its financial systems.
DOD should take the following actions: assure that the Navy fully implements the FIAR Guidance for FBWT in  the areas of analyzing processes, prioritizing, assessing and testing  internal controls, and evaluating supporting documentation to support  audit readiness;  require the military services to improve their policies and procedures  for monitoring their CAPs for financial management related findings  and recommendations;  improve its process for monitoring the military services’ audit  remediation efforts by preparing a consolidated CAP management  summary that provides a comprehensive picture of the status of  corrective actions throughout the department; and expand the FIAR Plan Status Report so that Congress and other  decision makers will have more sufficient information to assess DOD’s  current audit readiness status and the improvements that still need to  be made.
In addition, with regard to our open priority recommendations, DOD  should monitor actions components are taking to direct DFAS to complete actions in response to our recommendations  for implementing the requirements in the FIAR Guidance in the areas  of planning, testing, and corrective actions;  improve DOD processes to identify, estimate, reduce, recover, and  report on improper payments to assure these processes fully comply  with OMB guidance, the Improper Payments Information Act of 2002,  as amended, and the Improper Payments Elimination and Recovery  Act of 2010, and  reconsider the status of three recommendations made by the House  Armed Services Committee Panel on Defense Financial Management  and Auditability Reform that the department determined to be met but  that we determined to be partially met; these recommendations  related to: attesting to audit readiness in each of the FIAR Plan Status  including FIAR-related goals in Senior Executive Service  performance plans and rewarding and evaluating performance  over time based on these goals; and  reviewing audit readiness assertions before component senior  executive committees.
section_title: Demonstrated Progress
paragraphs: Improving the department’s financial management operations—and  thereby providing DOD management and the Congress with more  accurate and more reliable information on the results of its business  operations—will not be an easy task. Key challenges remain, such as  allocating the department’s workforce and budget among competing  priorities, achieving the critical capabilities detailed in the FIAR Guidance,  and executing CAPs to effectively remediate findings and  recommendations from IPAs, the DOD OIG, and us.
According to its November 2016 FIAR Plan Status Report, DOD is  continuing to work toward undergoing a full financial statement audit for  fiscal year 2018; however, it expects to receive disclaimers of opinion on  its financial statements for a number of years. This is why it is important  for DOD and the military services to improve their processes for  identifying, tracking, remediating, and monitoring audit findings and  recommendations related to financial management. The military services  will need to assure that they enhance their policies and procedures for  remediating these findings and recommendations and DOD will need to  obtain comprehensive information on the status of CAPs throughout the  department in order to fully monitor and report on the progress being  made to resolve financial management deficiencies. A lack of  comprehensive information on the CAPs limits the ability of DOD and  Congress to evaluate DOD’s progress toward achieving audit readiness,  especially given the short amount of time remaining before DOD is  required to undergo an audit of the department-wide financial statements  for fiscal year 2018. Being able to show the progress that the department  is making in remediating its financial management deficiencies will be  useful as the department works toward implementing lasting financial  management reform to ensure that it can generate reliable, useful, and  timely information for financial reporting as well as for decision making  and effective operations.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: DOD continues to partially meet the leadership commitment criterion.  Since the last high-risk update in 2015, the commitment of DOD’s senior  leadership to improving the department’s financial management has  continued to be encouraging. The statements, testimony, and actions of  senior leaders have emphasized the importance of effective financial  management and audit readiness to DOD’s stewardship over the  substantial funding and other resources entrusted to the department.
In response to statutory requirements and targets, DOD leadership  directives have set out a strategy and methodology for improving DOD’s  financial management through the FIAR Plan Status Reports and FIAR  Guidance. DOD’s current FIAR strategy and methodology focuses on four  priorities—budgetary information, proprietary accounting and information,  mission critical asset information, and valuation—with overall goals of  improving the department’s financial management operations, helping  provide service members with the resources they need to carry out their  mission, and improving stewardship of the resources entrusted to DOD by  the taxpayers. DOD Comptroller officials meet regularly with us for a  constructive exchange of information on the status of DOD and  component actions and to help sustain progress toward the FIAR goals.
The April 2016 FIAR Guidance incorporates recent policy updates related  to integrating service providers and financial reporting on existence,  completeness, and valuation of property. It also defines seven critical  capabilities that reporting entities must address prior to asserting full audit  readiness. According to DOD, the approach to achieving full financial  statement auditability by September 30, 2017, relies upon each DOD  component and service provider addressing the seven critical capabilities  in a timely manner; failing to do so will put the entire department’s  strategy at risk.
section_title: Capacity
paragraphs: DOD continues to partially meet the capacity criterion. DOD faces  capacity challenges because (1) its financial management personnel are  insufficient in number, qualifications, and expertise; (2) its legacy financial  systems data and ERPs lack the necessary standardization and reliability  to support generating financial statements and related data; and (3) its  service providers’ audit readiness activities are not fully integrated with  respective DOD components’ audit readiness activities. DOD continues to  identify the need for sufficient numbers of qualified and experienced  personnel as a challenge to achieving its goals of financial improvement  and audit readiness. In the November 2016 FIAR Plan Status Report,  DOD reported that audit readiness resources are expected to decline  across the department as audit readiness activities continue to rise. For  example, DOD reported that new financial statement audits will increase  the work demands on headquarters staff. However, since the department  has been mandated to reduce its headquarters workforce by fiscal year  2020, this additional work could exacerbate the demands on the  workforce. In addition, the Defense Health Program reported that  resources needed to concurrently support audit readiness and financial  management operations exceed the capacity of its available resources.  Similarly, the Army identified resource constraints and the timing of its  fiscal year 2016 Schedule of Budgetary Activity audit as challenges to its  ability to remediate audit findings related to its ERP systems. Further,  DOD reported in its November 2016 FIAR Plan Status Report that  resource needs for financial statement audits will likely increase as the  scope of the audits expand and work to correct audit findings increases.
DOD has undertaken efforts to increase the knowledge and skills of its  financial management workforce by implementing its financial manager  certification program. However, it will take some time before DOD’s  financial management staff achieves the level of training and experience  needed to support and sustain financial management as envisioned by  the FIAR Plan. Further, DOD’s decentralized management environment  may have an effect on the ability of its financial management personnel to  gain the requisite expertise to develop and implement needed CAPs.  Moreover, while DOD has made progress in financial manager training, it  lacks the level of expertise needed to lead financial management reform  across the department.
DOD faces challenges with its systems’ capacity to generate reliable,  auditable financial information because it continues to rely on (1) legacy  systems and related processes and controls that feed financial  information to component general ledger systems and (2) general ledger  systems, including ERP systems, that do not meet federal accounting  standards, U.S. Standard General Ledger (USSGL) requirements, federal financial management system requirements, and DOD’s Standard  Financial Information Structure. DOD continues to report that relying on  legacy systems is a challenge. This is because legacy systems produce  data that are not standardized and are therefore difficult to reconcile to  the financial statements. Many legacy systems will still be in use when the  audit of DOD’s fiscal year 2018 full financial statements must commence.  In its May 2016 FIAR Plan Status Report, DOD discussed continuing  challenges regarding the large number of business and financial systems  and the level of effort and cost of developing and maintaining an audit- ready systems environment.
DOD continues to implement and upgrade various ERP systems to  establish an audit-ready systems environment. However, because these  systems were not always designed to capture transaction-level  information that can be tied to original supporting documents, significant  time will be needed to make necessary modifications to assure that they  generate reliable financial information. DOD components have varying  plans for correcting system deficiencies; for some components,  completion dates have either not been determined or extend into fiscal  year 2019.
DOD uses service providers to improve efficiency and standardize  business operations in various functional areas, including accounting,  personnel and payroll, logistics, contracting, and system operations and  hosting support. DOD service providers and their business systems are  fundamental to reliable accounting and reporting and financial audit  readiness. For example, to process and record payments to contractors,  DOD components depend on over a dozen systems owned and operated  by service providers and on nonstandard business processes that need to  link between the components and service providers. This complex level of  interdependency increases the difficulty of identifying the systems that  need to be modified, upgraded, or eliminated to support financial  management improvement and audit readiness and the difficulty of  defining critical roles and responsibilities for carrying out such actions.
The FIAR Guidance calls for examinations of DOD service providers’  systems, processes, and controls. The IPAs that conduct these  examinations have continued to identify deficiencies in service providers’ systems, processes, and controls that affect the reliability of financial data  and information used in the related business processes. Each of the  components has identified integration with DOD service providers as a  challenge to completing financial improvement initiatives and audit  readiness efforts. For example, the Army has expressed concerns about  service providers’ abilities to provide timely responses to auditor samples,  data requests, and sufficient supporting documentation. In addition, the  Marine Corps has expressed concerns about the ability of service  providers to provide supporting documentation for existence,  completeness, rights, and valuation of Marine Corps assets. Further, the  military services have expressed concerns about how DFAS manages  suspense accounts and provides supporting documentation for  adjustments made by journal vouchers.
section_title: Action Plan
paragraphs: DOD continues to partially meet the action plan criterion. While the  military services have developed, implemented, and validated many  corrective actions, DOD’s limited progress in making needed financial  management reform can be attributed to its decentralized management  environment and cultural resistance to change, which have significantly  impeded the department’s ability to modernize and transform business  processes, systems, and controls. Sound financial management practices  and reliable, useful, and timely financial information are important to help  ensure accountability over DOD’s extensive resources and to efficiently  and economically manage the department’s assets and budgets. Under  DOD’s nonstandard, decentralized environment, each component is  responsible for following steps in OMB’s guidance and DOD’s FIAR  Guidance for addressing financial management related findings and  recommendations reported by external auditors, including steps to (1)  identify and track them, (2) prioritize them, (3) develop CAPs to remediate  them, and (4) monitor the implementation status of the CAPs.
However, we found that the remediation processes designed by each  military service had deficiencies in one or more of these areas. For  example, each military service’s policies and procedures lacked sufficient  controls to reasonably assure that they identified and tracked the  complete universe of open findings and recommendations related to  financial management. Without identifying and tracking the complete  universe of unresolved deficiencies, the military services cannot  reasonably assure that the deficiencies will be addressed in a timely  manner, which can ultimately affect the reliability of financial information  and the auditability of their financial statements.
The need to effectively implement financial management remediation  processes has become more important in light of (1) the hundreds of  findings and recommendations that resulted from the fiscal year 2015 and  2016 Budgetary Schedule audits, (2) future audits that will have a broader  scope of work and may therefore identify additional findings and  recommendations, and (3) the short period remaining before DOD is  required to undergo a full financial statement audit for fiscal year 2018.
DOD components have self-identified completion dates for achieving the  seven critical audit readiness capabilities for both their general funds and  working capital funds in coordination with their service providers. As  reported in DOD’s November 2016 FIAR Plan Status Report, most of  DOD’s audit readiness tasks and associated audit readiness milestones  have planned completion dates in fiscal year 2017. DOD faces significant  challenges, given its limited progress in assuring it can attain the seven  critical capabilities and the volume and magnitude of open audit findings  and recommendations that still need to be addressed from the fiscal year  2015 and 2016 Budgetary Schedule audits of the Army, Navy, and Air  Force.
To date, the efforts of DOD components to implement the FIAR Guidance  have not fundamentally transformed systems and operations as  necessary to produce reliable, useful, and timely information for day-to- day decision making on mission and operations. Resolving these  deficiencies also will be crucial to DOD’s efforts to meet the statutory  requirement to undergo a full financial statement audit for fiscal year  2018. However, much work remains to be completed in order for this date  to be met. In its November 2016 FIAR Plan Status Report, DOD stated  that readiness to undergo an audit does not mean that it expects to  receive a positive opinion and that it is important to continue the audit  regimen in order to gain valuable information from its early audit efforts,  information that will help focus the department’s corrective actions in the  most critical areas.
section_title: Monitoring
paragraphs: DOD has not met the monitoring criterion. Effective monitoring requires  instituting a program to monitor and independently validate the  effectiveness and sustainability of corrective measures. However, as we  have reported, while the DOD Comptroller has established several  elements of a department-wide audit readiness remediation process, the  DOD Comptroller does not obtain the complete, detailed information on  all corrective action plans (CAP) from the military services related to the  department’s critical capabilities necessary to fully monitor and assess  DOD’s progress. Specifically, DOD does not prepare a consolidated  management summary that would provide a comprehensive, department- wide picture of the status of CAPs needed for audit readiness that  includes all of the elements that are recommended by the Implementation  Guide for OMB Circular A-123. As a result, reports to external  stakeholders, such as Congress, on the status of audit readiness do not  provide comprehensive information on progress against the CAPs,  limiting the ability of DOD and Congress to evaluate DOD’s progress  toward achieving audit readiness, especially given the short amount of  time remaining before the statutorily required full financial statement audit  for fiscal year 2018. Further, the lack of comprehensive information on the  status of CAPs increases DOD’s risk that it will not be able to fully, timely,  and efficiently correct its long-standing deficiencies.
In addition, we reported that DOD’s FIAR Plan Status Reports do not  provide adequate visibility for Congress and other decision makers  regarding the extent to which DOD has addressed certain internal control  deficiencies that it refers to as deal-breakers. For example, the status  reports do not include information on (1) audit assertions made without  correcting internal control deficiencies along with actions and plans to  remediate the deficiencies and (2) details of military services’ actions  taken and progress made toward correcting the underlying deficiencies  for reported deal-breakers. Without greater visibility of the status of  DOD’s audit readiness or progress toward reported completion dates in  its FIAR Plan Status Report, Congress and other decision makers may  not have sufficient information to assess DOD’s current audit readiness  status and the improvements that still need to be made.
DOD has not effectively implemented the FIAR Guidance because, in  part, it lacks effective monitoring to assess the effectiveness of controls  and the remediation of control deficiencies. For example, we reported that  the Navy did not fully implement the FIAR Guidance for reconciling its  FBWT in the areas of process analysis, prioritization, internal control  assessment and testing, and evaluation of supporting documentation to  support audit readiness. In addition, each of the IPAs that performed  audits of the military services fiscal year 2016 Budgetary Schedules  identified deficiencies in monitoring information technology controls for its  financial systems.
DOD also has challenges with carrying out its strategy in the FIAR  Guidance with regard to its critical capabilities. For example, the DOD  OIG reported that the Army could not reconcile approximately $207 billion  (68 percent) of its outlays, because the Army and DFAS did not  coordinate to reengineer business processes when they implemented a  new FBWT reconciliation tool. As a result, the DOD OIG reported that the  Army cannot demonstrate an effective FBWT transaction-level  reconciliation, which DOD identified as one of the deal-breakers to  auditability. Furthermore, the DOD OIG reported that Army and DFAS  could not adequately support material amounts of year-end adjustments  to the Army General Fund financial data during the fiscal year 2015  financial statement compilation. As a result, the data used to prepare the  fiscal year 2015 Army General Fund statements were unreliable and  lacked an adequate audit trail. The DOD OIG also reported that DOD and  Army managers could not rely on the data in the accounting systems  when making management and resource decisions. According to the  DOD OIG, until these control deficiencies are corrected, there is a  considerable risk that the Army General Fund financial statements will be  materially misstated and that the Army will not achieve the goal of being  audit ready by September 30, 2017.
section_title: Demonstrated Progress
paragraphs: DOD has not met the demonstrated progress criterion, showing limited  progress in implementing corrective measures to resolve its long-standing  financial management challenges. For example, because of difficulties  encountered in preparing for an audit of the multi-year Statement of  Budgetary Resources (SBR), DOD decided that, beginning with fiscal  year 2015, it would limit the scope of the initial audits for all DOD  components to current-year budget activity reported on a Budgetary  Schedule. This was intended to be an interim step toward achieving the  audit of multiple-year budgetary activity required for an audit of the SBR,  with subsequent audits including current-year appropriations as well as  prior-year appropriations going back to fiscal year 2015. Consequently,  the Budgetary Schedules for the Army, Navy, and Air Force for fiscal year  2015 reflected only current year budget activity. As noted above, all three  of the IPAs contracted to audit these fiscal year 2015 Budgetary  Schedules issued disclaimers, meaning that the IPAs were unable to  express an opinion because they lacked sufficient evidence to support the  amounts presented.
The IPAs for the three military services also identified material  weaknesses in internal control. These weaknesses included military  services’ inability to, among other things, reasonably assure that the  Budgetary Schedules reflected all of the relevant financial transactions  that occurred and that documentation was available to support such  transactions. The IPAs for the three military services also issued  disclaimers on the three services’ fiscal year 2016 Budgetary Schedules  for reasons similar to those identified in the fiscal year 2015 audits.  Further, the results of these audits—with hundreds of open findings and  recommendations—show the extent and complexity of improvements  needed to provide reliable information for financial reporting as well as for  sound decision making on mission and operations.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Asif Khan at  (202) 512-9869 or khana@gao.gov.
section_title: Related GAO Products
paragraphs: DOD Financial Management: Significant Efforts Still Needed for  Remediating Audit Readiness Deficiencies. GAO-17-85. Washington,  D.C.: February 9, 2017.
DOD Financial Management: Improvements Needed in the Navy’s Audit  Readiness Efforts for Fund Balance with Treasury. GAO-16-47.  Washington, D.C.: August 19, 2016.
DOD Financial Management: Greater Visibility Needed to Better Assess  Audit Readiness for Property, Plant, and Equipment. GAO-16-383.  Washington, D.C.: May 26, 2016.
DOD Financial Management: Improved Documentation Needed to  Support the Air Force’s Military Payroll and Meet Audit Readiness Goals.  GAO-16-68. Washington, D.C.: December 17, 2015.
DOD Financial Management: Additional Efforts Needed to Improve Audit  Readiness of Navy Military Pay and Other Related Activities.  GAO-15-658. Washington, D.C.: September 15, 2015.
DOD Financial Management: Continued Actions Needed to Address  Congressional Committee Panel Recommendations. GAO-15-463.  Washington, D.C.: September 28, 2015.
DOD Financial Management: Actions Are Needed on Audit Issues  Related to the Marine Corps’ 2012 Schedule of Budgetary Activity.  GAO-15-198. Washington, D.C.: July 30, 2015.
section_title: DOD Business Systems Modernization
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of Defense (DOD) spends billions of dollars each year to  acquire modernized systems that are fundamental to achieving its  business transformation goals, including systems that address key areas  such as personnel, financial management, health care, and logistics.  While DOD’s capacity for modernizing its business systems has improved  over time, significant challenges remain. These challenges include fully  defining and establishing management controls for business systems  modernization. Such controls are vital to ensuring that DOD can  effectively and efficiently manage an undertaking with the size,  complexity, and significance of its business systems modernization, and  minimize the associated risks. DOD’s effort to modernize its business  systems environment has been designated as high risk since 1995.
section_title: What GAO Found
paragraphs: DOD has demonstrated elements of leadership commitment and has  made progress in this area by taking steps to manage the modernization  of its business systems more effectively and efficiently. For example, the  department has begun to implement an improved investment  management framework and processes, and has established the capacity  to use its federated architecture to identify potentially duplicative  investments. However, more needs to be done to leverage DOD’s  capacity to identify potentially duplicative investments, and to ensure that,  among other things, systems are reviewed at appropriate levels as part of  the department’s improved investment management framework.
In addition, DOD’s business systems modernization efforts continue to fall  short of cost, schedule, and performance expectations, and the  department has not yet established an action plan (or plans) highlighting  how it intends to improve its use of its business architecture, improve its  business system investment management process, or improve its  business system acquisition outcomes. The department can leverage the  federal information technology (IT) dashboard as a mechanism for  beginning to monitor progress in improving its business system  acquisition outcomes. Nevertheless, without an action plan, DOD lacks a  baseline against which it can monitor broader progress in its business  systems modernization efforts.
Further, the National Defense Authorization Act for Fiscal Year 2017 and  its accompanying conference report include provisions that might impact  how the department will manage its business systems. Specifically, the  act establishes a Chief Management Officer and the accompanying  conference report calls for the department to develop a plan by June  2017 to implement a more optimized organizational structure and  processes to support information management and cyber operations,  including the policy, direction, oversight, and acquisition functions  associated with, among other things, business systems. The impact of  these provisions on the department’s business systems modernization  efforts remains to be seen.
Although more needs to be done to address this high-risk issue, DOD has  achieved important benefits by implementing our recommendations. For  example, fiscal years 2013 and 2014 saw total financial savings of $970  million due to the department cancelling the Air Force’s Expeditionary  Combat Support System because of significant cost and schedule  overages discovered as a result of increased oversight.
section_title: What Remains to Be Done
paragraphs: DOD must more fully demonstrate leadership commitment and progress  in implementing critical IT modernization management controls. For  example, the department needs to address the provisions of the  conference report accompanying the Fiscal Year 2017 National Defense  Authorization Act that call for DOD to develop a plan by June 2017 to  implement a more optimized organizational structure and processes to  support, among other things, business systems. DOD also needs to  ensure that its business system investments are managed with the kind of  rigor and discipline embodied in relevant acquisition management  guidance and best practices so that each investment will deliver expected  benefits and capabilities on time and within budget. In addition, DOD  should ensure that its information reported on the Office of Management  and Budget’s IT Dashboard is reliable and, over time, demonstrates  improved achievement of cost, schedule, and performance expectations.  DOD should also demonstrate that it is improving its guidance on  incrementally developing IT systems to help ensure a timely delivery of  needed capabilities, consistent with the Federal IT Acquisition Reform  provisions of the Carl Levin and Howard P. ‘Buck’ McKeon National  Defense Authorization Act for 2015.
In addition, DOD needs to take steps to address key portfolio  management practices documented in our IT Investment Management  Framework. For example, DOD has not yet defined criteria for reviewing  defense business systems at an appropriate DOD level based on factors  such as complexity, scope, cost, and risk in support of the certification  and approval process. DOD also needs to develop plans defining how it  will ensure that it is using its federated business architecture to identify  and address potentially duplicative investments within its business  systems environment.
Further, DOD should demonstrate that plans exist for addressing these  various actions and associated recommendations, and that it is  monitoring progress against these plans and demonstrating progress and  related outcomes. DOD also needs to ensure that it has the appropriate  capacity in place by conducting needed human capital analyses.
section_title: Additional Details on What GAO Found
subsections: section_title: DOD’s Business System Acquisition Management
subsections: section_title: Leadership Commitment
paragraphs: DOD has partially met the criterion for leadership commitment. For  example, the department has taken steps to improve its publicly available  investment ratings and encourage incremental development. However,  more remains to be accomplished before the department can fully  demonstrate leadership commitment. In particular, the department needs  to take steps to improve the accuracy of the department’s ratings,  improve its use of incremental development, and further define  expectations for managing its business system investments.
In March 2014, the department revised its chief information officer ratings  process for investments presented on the Federal IT Dashboard to take  into account additional information about the risk of its investments, such  as investment complexity, execution issues, and external risk  assessments, including our reports. Establishing an accurate picture of  program risk helps department management better understand which  investments would benefit from additional oversight. Nevertheless, we  reported in June 2016 that investment risk ratings presented on the  Dashboard were not consistent with our assessment of investment risks.  Specifically, our assessment of 25 DOD programs, 4 of which were  defense business systems, determined that 19 of the programs, including  all 4 defense business systems, were at a higher risk level than what was  presented on the Dashboard.
Moreover, in January 2015, the department revised Department of  Defense Instruction 5000.02: Operation of the Defense Acquisition  System, which describes an incremental software development approach  for IT investments. According to the instruction, the approach has been  adopted for many defense business systems. This is partially consistent  with the recommendation from our May 2014 report emphasizing the  importance of IT investments delivering capabilities in smaller increments  over shorter periods of time. However, the instruction does not provide a  time frame for how often functionality is to be delivered. As a result, the  instruction does not fully address our recommendation, which calls for  DOD to update its incremental development policies to ensure that it  complies with Office of Management and Budget guidance. This guidance  requires federal agencies to deliver usable system functionality every 6  months.
In addition, the results from our recent related work show that the  department has not consistently implemented an incremental development approach for all of its major IT investments. Specifically, in  August 2016, we reviewed 14 business system projects associated with  seven business system investments and found that, in fiscal year 2016,  only 8 projects planned to deliver functionality every 6 months.  Moreover, only nine projects planned to deliver functionality every 12  months. Six of the projects that had planned to deliver functionality within  6 months were associated with only one of the seven investments.  According to DOD officials, the department allows its program managers  to determine the appropriate delivery schedule. The officials also noted  that a 6-month schedule would be too expensive to implement given the  scale of the projects at the department. Nevertheless, until DOD modifies  and implements its incremental development policy, it continues to run  the risk of failing to deliver major investments in a cost-effective and  efficient manner.
In November 2016, DOD officials from the Offices of the Deputy Chief  Management Officer, Under Secretary for Acquisition, Technology, and  Logistics, and DOD Chief Information Officer stated that the department  had developed a draft DOD Instruction focused on improving business  system acquisition. This instruction is to provide guidance in areas such  as risk management, requirements management, and incremental  development. However, as of December 2016, the department had not  completed the instruction. In addition, as previously discussed, the impact  of provisions included in the National Defense Authorization Act for Fiscal  Year 2017, and its accompanying conference report, on DOD business  system acquisition management remains to be seen.
section_title: Capacity
paragraphs: DOD has not met the criterion for capacity. In May 2013, we reported that  the Office of the Deputy Chief Management Officer, which is responsible  for annually reviewing and approving the expenditure of funds associated  with DOD business systems, had not conducted a human capital analysis  and that no plans existed to analyze and address skill gaps, thus limiting  the department’s capacity to lead improvement initiatives in these areas.  In August 2016, department officials reported that the office had  undergone two reorganizational changes and used skill inventories, needs assessments, and gap analyses as part of a strategic approach to  human capital planning. However, DOD has not provided evidence of  having performed a needs assessment or a gap analysis. In November  2016, an official from the department’s Office of the Under Secretary of  Defense for Acquisition, Technology and Logistics stated that the  department planned to take additional steps to address human capital  needs after issuing its forthcoming instruction on defense business  systems.
section_title: Action Plan
paragraphs: DOD has not met the criterion for developing an action plan. In particular,  the department lacks a plan (or plans) to monitor efforts to manage its  business system investments with the rigor and discipline embodied in  relevant acquisition guidance and best practices. In October 2016, the  Assistant Deputy Chief Management Officer described steps the  department is taking to make improvements in this area, but stated that  the department has not developed an action plan to address this high-risk  area.
section_title: Monitoring
paragraphs: DOD has partially met the criterion for monitoring progress. Specifically,  the department can leverage the Federal IT Dashboard with more  accurate data as a mechanism for beginning to monitor progress in  improving its business system acquisition outcomes. However, without an  approved action plan for addressing the DOD Business Systems  Modernization high-risk area, the department lacks a means to monitor  broader progress in making improvements to its business system  acquisition management efforts.
section_title: Demonstrated Progress
paragraphs: DOD has partially met the criterion for demonstrating progress. As  discussed previously, the department has taken steps to improve  business system acquisition management. However, it needs to show  continued progress as it takes steps to improve its efforts. For example, in  our series of reports on DOD major automated information systems, we  reported that the department has had mixed success in addressing key  acquisition practices, such as risk and requirements management. We  also continue to identify examples of business systems that do not meet  performance expectations and experience significant cost overruns and  schedule slippages.
For example, in March 2016, we reported that the projected cost of the  Air Force system that provides financial capabilities, such as cost  accounting and collections, had increased about 9 percent from the  program’s first February 2012 estimate (from approximately $1.43 billion  up to $1.56 billion). Program officials attributed the cost increase, in part,  to program scope growth and the addition of software upgrade  enhancements. We also reported that this system experienced a 1-year  slippage in its full deployment decision date. Program officials attributed  this slippage to findings identified in the system’s initial operational test  and evaluation report. In addition, the system did not meet five of its nine  key performance indicators. In November 2016, DOD officials stated that  the system was not deployed as planned and is currently undergoing a  critical change. Accordingly, as of November 2016, updated milestones  have not yet been established.
section_title: DOD’s Business System Investment Management Process
subsections: section_title: Leadership Commitment
paragraphs: DOD has partially met the criterion for leadership commitment.  Specifically, the department has taken steps to improve its business  systems investment management process to include defining and  implementing policies and procedures for managing portfolio-level  investments consistent with our Information Technology Investment  Management Framework, and relevant investment management and  business system modernization requirements. For example, in July 2015,  we reported that DOD was continuing its efforts to further define and  implement its defense business system governance framework, called the  Integrated Business Framework.
In this regard, the department had taken steps to align its business  system certification and approval process with its planning, programming,  budgeting, and execution process. According to the department’s  February 2015 certification and approval guidance, organizational  execution plans, which are to summarize each component’s business  strategy for each functional area (e.g., financial management), are to  include information about certification requests for the upcoming fiscal  year as well as over the course of the department’s Future Years Defense  Program.
In addition, DOD has generally concurred with our recommendations to  address improvements to its management of business systems.  Nevertheless, the department needs to show continued leadership  commitment and progress in addressing our associated  recommendations as it takes steps to improve its business system  investment management process. These recommendations are aimed at  ensuring that business systems receive the appropriate levels of review  using a tiered investment review board approach, and that strategies for  DOD functional areas include all of the critical elements identified in DOD  investment management guidance. These critical elements include  performance measures to determine progress toward achieving the goals  that incorporate all of the attributes called for in the department’s  guidance. Further, as previously discussed, the impact of provisions in  the National Defense Authorization Act for Fiscal Year 2017, and its  associated conference report, on the department’s business systems  investment management process remains to be seen.
section_title: Capacity
paragraphs: DOD has partially met the criterion for capacity. Although the department  has established an investment review board to oversee its portfolio-based  investment management process, much still remains to be accomplished  to better define and institutionalize this process. For example, as of  December 2016, the department had not yet issued an update to its  February 2015 Certification Guidance. Officials from the Offices of the  Deputy Chief Management Officer, Under Secretary for Acquisition,  Technology and Logistics, and DOD Chief Information Officer stated in  November 2016 that the department was developing a DOD Instruction  aimed at improving the management of defense business systems.  According to the officials, updated guidance on defense business  systems, including updated certification guidance, will be issued after the  instruction is finalized.
In addition, in May 2013, we reported that the Office of the Deputy Chief  Management Officer, which is responsible for annually reviewing and  approving the expenditure of funds associated with DOD business  systems, had not conducted a human capital analysis and had not  developed plans to analyze and address skill gaps, thus limiting the  department’s capacity to lead improvement initiatives in these areas. In  August 2016, department officials reported that the office had undergone  two reorganizational changes and used skill inventories, needs  assessments, and gap analyses as part of a strategic approach to human  capital planning. However, DOD has not provided evidence of having  performed a needs assessment or a gap analysis. Nevertheless, in  November 2016, an official from the department’s Office of the Under  Secretary for Acquisition, Technology and Logistics stated that the  department planned to take additional steps to address human capital  needs after issuing its forthcoming instruction on defense business  systems.
section_title: Action Plan
paragraphs: DOD has not met the criterion for developing an action plan. Specifically,  the department has not established an action plan (or plans) for  addressing gaps in its business system investment management  approach. In October 2016, the Assistant Deputy Chief Management  Officer described steps the department is taking to make improvements in  this area, but stated that the department has not developed an action plan  to address this high-risk area.
section_title: Monitoring
paragraphs: DOD has not met the criterion for monitoring progress. Specifically,  without an approved action plan for addressing the DOD Business  Systems Modernization high-risk area, the department lacks a means to  monitor progress in making improvements to its business system  investment management process.
section_title: Demonstrated Progress
paragraphs: DOD has partially met the criterion for demonstrated progress. As  discussed previously, the department has taken steps to improve its  business system investment management process. However, the  department needs to show continued progress in addressing our  associated recommendations as it takes steps to improve its business  system investment management process. For example, as discussed, in  February 2015, the department took steps to align its business system  certification and approval process with its planning, programming,  budgeting, and execution process. However, as we reported in July 2015,  the department’s February 2015 certification and approval guidance does  not specify a process for conducting an assessment or call for the use of  actual versus expected performance data and predetermined thresholds.
section_title: DOD’s Federated Business Enterprise Architecture
subsections: section_title: Leadership Commitment
paragraphs: DOD has partially met the criterion for leadership commitment for its  federated business enterprise architecture. For example, in May 2014,  we reported that the department’s Deputy Chief Management Officer  required all business systems to be entered into the architecture  compliance tool before they could be certified and approved as part of  DOD’s business system investment management process. In addition,  the Office of the Deputy Chief Management Officer has initiated an effort  to improve how the department leverages the architecture, and the  department has identified several associated milestones. However, as of  December 2016, the department had not demonstrated that this effort and  the associated milestones had obtained final approval from the Assistant  Deputy Chief Management Officer. In addition, as previously discussed,  the impact of provisions in the National Defense Authorization Act for  Fiscal Year 2017, and its accompanying conference report, on the  business architecture remains to be seen.
section_title: Capacity
paragraphs: DOD has met the criterion for capacity by establishing tools and  processes intended to improve the department’s efforts to identify  potentially duplicative systems by leveraging the federated business  enterprise architecture. For example, in 2014, the department completed  efforts to automate its business architecture compliance review process.  According to officials, this automation will improve the department’s  efforts to identify potentially duplicative systems. In addition, the  department’s December 2014 problem statement requirements validation  guidance called for an enterprise architecture analysis to be conducted to  determine if a capability already exists within the organization or  elsewhere across the department. Further, the department’s April 2015  business enterprise architecture compliance guidance reinforced this  guidance by stating that programs should be examined for potential  duplication and overlap during the problem statement requirements  analysis process, which is to occur early in a program’s life cycle.
section_title: Action Plan
paragraphs: DOD has not met the criterion for developing an action plan. The  department has initiated an effort to improve how it leverages the  architecture and identified several associated milestones. However, as of  December 2016, the department had not demonstrated that this effort and  the associated milestones had been approved by the Assistant Deputy  Chief Management Officer.
section_title: Monitoring
paragraphs: DOD has not met the criterion for monitoring progress. The department  has developed a draft plan to improve how it leverages the architecture  and identified several associated milestones. However, as of December  2016, the department had not demonstrated that this effort and the  associated milestones had been approved by the Assistant Deputy Chief  Management Officer. Without approved plans, DOD lacks a means to  monitor progress in leveraging its architecture compliance tool.
section_title: Demonstrated Progress
paragraphs: DOD has partially met the criterion for demonstrated progress. For  example, the department has established the capacity to identify  potentially duplicative investments. DOD has also provided examples of  benefits attributed, at least in part, to the department’s business  enterprise architecture. For example, according to officials from the Office  of the Deputy Chief Management Officer, two proposed new defense  business system investments were not approved by DOD due, in part, to  architecture reviews that revealed the requested capabilities were already  available in existing systems. In addition, in November 2016, the  department provided examples of programs that had been assessed for  potential duplication and overlap based on their associated business  activities. Nevertheless, the department has not yet demonstrated that it  is actively and consistently using such assessments of potential  duplication and overlap to eliminate duplicative systems. The  department’s draft plan for improving how it leverages its business  architecture acknowledges this gap and identifies steps the department  can take to improve.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In 2013, the department took actions to improve its investment  management decision making. For example, the department’s  investment management guidance, issued by the Office of the Deputy  Chief Management Officer in April 2013, required the precertification  authorities to include any open recommendations from us for program  weaknesses, as well as a status update on addressing our  recommendations as part of the certification requests. These actions  help ensure that DOD’s Investment Review Board is provided with  identified program weaknesses that can be appropriately considered  and thus better inform and justify certification decisions for business  systems investments.
In 2014, the department reported all business system certification  actions in its annual report to Congress. Specifically, DOD’s 2014  annual report to Congress included, among other things, a list of all  certification actions the department took in the previous year on its  business systems modernization investments. For example, the report  contained an attachment that reported all fiscal year 2014 certification  actions, including the amount of funding requested, the amount  approved or disapproved, and any conditions placed on funding not  certified or conditionally certified.
Additionally, fiscal years 2013 and 2014 saw total financial savings of  $970 million due to the department cancelling the Air Force’s  Expeditionary Combat Support System because of significant cost  and schedule overages discovered as a result of increased oversight.
In 2015, the department demonstrated that it took steps to help  ensure that it was appropriately reengineering business processes on  defense business systems. In particular, as part of DOD’s fiscal year  2013 certification and approval process, the department placed  conditions on certifications for these business systems requiring that a  plan be submitted describing how each system would become  compliant with business process re-engineering requirements. DOD  officials also provided documentation showing that they tracked these  conditions. In addition, DOD has reported much higher levels of  compliance with business process reengineering requirements in  subsequent annual review cycles. For example, for the fiscal year  2014 and 2015 certification cycles, DOD officials reported that only  two systems and six systems, respectively, were approved that did  not have complete business process reengineering assertions.  Moreover, DOD officials provided justifications for why each of these  systems did not have complete business process reengineering  assertions.
In 2016, the Air Force, Army, and Navy developed a plan for  addressing core elements described in our Enterprise Architecture  Management Maturity Framework.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Carol C.  Harris at (202) 512-4456 or HarrisCC@gao.gov.
section_title: Related GAO Products
paragraphs: Information Technology Reform: Agencies Need to Increase Their Use of  Incremental Development Practices. GAO-16-469. Washington, D.C.:  August 16, 2016.
IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their  Major Investments. GAO-16-494. Washington, D.C.: June 2, 2016.
DOD Major Automated Information Systems: Improvements Can Be  Made in Reporting Critical Changes and Clarifying Leadership  Responsibility. GAO-16-336. Washington, D.C.: March 30, 2016.
DOD Business Systems Modernization: Additional Action Needed to  Achieve Intended Outcomes. GAO-15-627. Washington, D.C.: July 16,  2015.
Defense Major Automated Information Systems: Cost and Schedule  Commitments Need to be Established Earlier. GAO-15-282. Washington,  D.C.: February 26, 2015.
section_title: DOD Support Infrastructure Management
subsections: section_title: Why Area Is High Risk
paragraphs: Since our 2015 high-risk update, the Department of Defense (DOD) has  shown some improvement in managing its infrastructure to better achieve  reductions and efficiencies, and has partially met each of the five criteria  for removal from the High-Risk List. For this update, we are consolidating  our evaluation of these two areas based on DOD officials’ assertion that  achieving efficiencies in base support is integrated through numerous  programs and efforts at the Office of the Secretary of Defense (OSD),  military service, and installation levels, and is incorporated in DOD’s  overall efforts to efficiently manage its infrastructure. Further, DOD  officials stated that the joint basing program is no longer DOD’s primary  effort for achieving efficiencies in base support services. For these  reasons, we are reframing our evaluation to focus generally on DOD’s  efforts to better align DOD’s support infrastructure with the needs of its  forces and achieve efficiencies.
DOD manages a global real property portfolio that consists of more than  562,000 facilities—including barracks, commissaries, data centers, office  buildings, laboratories, and maintenance depots—located on about 4,800  sites worldwide and covering more than 25 million acres. With a DOD- estimated replacement value of about $880 billion, this infrastructure is  critical to maintaining military readiness, and the cost to build and  maintain it represents a significant financial commitment.
Since designating this area as high risk in 1997, we have reported on  various long-term challenges DOD faces in managing its infrastructure.  Specifically, DOD has experienced obstacles reducing excess  infrastructure, more efficiently using underutilized facilities, and reducing  base support costs, as well as achieving efficiencies by consolidating or  eliminating duplicate support services. In our 2015 high-risk update, we  categorized the need for improvement into two areas: (1) reducing excess  infrastructure, which included disposing of and consolidating facilities  under the Base Realignment and Closure (BRAC) process and improving  how DOD uses facilities; and (2) achieving efficiencies in base support  through joint basing—a program aimed at consolidating support services  by combining bases that are in close proximity or adjacent to one another.  We reported that DOD retained significant excess capacity relative to its  planned force structure; needed to improve the completeness and quality  of its information on how it uses facilities to better manage and use them;  and had not realized the anticipated cost savings and efficiencies in  reducing duplicative support services through its joint basing program.
section_title: What GAO Found
paragraphs: As cited previously, since our 2015 high-risk update, DOD has shown  some improvement in managing its infrastructure to better achieve  reductions and efficiencies, and has partially met each of the five criteria  for removal from the High-Risk List. Specifically, DOD has demonstrated  leadership by requesting more rounds of BRAC—its primary method for  reducing excess infrastructure not needed to support its forces. DOD has  also showed some improvement in its leadership commitment, capacity,  action plans, monitoring, and progress by increasing the completeness of  utilization data, publishing an overarching Real Property Efficiency Plan,  communicating and addressing issues on consolidating installation  services at the joint bases, and reducing excess infrastructure through the  Freeze the Footprint policy. However, DOD needs to take additional steps  across all five of our high-risk criteria. For example, DOD has not  committed to take action on some of our recommendations related to it  implementing any future BRAC rounds, such as improving DOD’s ability  to estimate potential liabilities, and savings to achieve desired outcomes.  Further, DOD continues to maintain excess capacity in relation to its force  structure, including long-standing excess facilities, and needs to ensure  accuracy of its real property data to better identify potential areas to  reduce and consolidate facilities. DOD also needs to address in its plans  any actions geared toward achieving efficiencies in base support  services, such as through consolidating services. By acting on our  recommendations to strengthen its efforts in each of these areas, DOD  will be better positioned to align its support infrastructure with the needs  of its forces and achieve efficiencies.
section_title: What Remains to Be Done
paragraphs: In April 2016, we provided DOD with a letter that outlined 19 actions and  outcomes that we believe it should address in order to correct long- standing weaknesses in its support infrastructure management efforts.  Based on discussions with DOD officials and recent efforts across the  department, as of January 2017, we believe that DOD has addressed 4 of  the 19 actions and outcomes related to capacity, monitoring, and  demonstrated progress. Specifically, DOD evaluated the purpose of joint  basing and whether its goals are still appropriate, reviewed and prioritized  standards to ensure a shared framework for managing base support,  provided guidance to the joint bases that directs them to identify  opportunities for cost savings and efficiencies, and continued to develop  an approach to identify and isolate cost savings resulting from  consolidating support services at the joint bases. We also added one  action on improving the accuracy and completeness of lease data, which  we believe will assist DOD in managing its facilities more efficiently.  Going forward, DOD needs to show measureable and sustained progress  in addressing the remaining 16 actions and outcomes across each of the  5 criteria for removal from the High-Risk List related to improving  implementation of any future BRAC rounds, improving facility utilization  data, reducing base support costs, and achieving efficiencies in base  support.
In September 2016, we also provided DOD with a letter describing the  overall status of DOD’s implementation of our recommendations, and  noted specific open recommendations that we believe the department  should give high priority to addressing. Included in the letter were 7 open  priority recommendations related to improving initial cost estimates,  limiting bundling of stand-alone realignments, developing baseline cost  data, and establishing reduction targets for any future BRAC, which are  also included in the 16 actions that are part of this high-risk update.
DOD needs to take the following 16 actions to satisfy the five high-risk  criteria for DOD support infrastructure management:  Leadership Commitment: For any future BRAC rounds, DOD needs to  commit to improve the process for identifying and entering into Cost of  Base Realignment Actions (COBRA) requirements for  relocating personnel and equipment,  costs for alternatively financed projects, and  limiting the practice of bundling multiple stand-alone realignments or  closures into single recommendations, or when bundling is  appropriate, itemize the costs and savings associated with each major  discrete action.
DOD should provide clear direction to the joint bases about goals, time  frames, and measures in consolidating base support services.
Capacity: DOD needs to  implement guidance on improving utilization data; and,  continue to manage the reduction of long-standing excess facilities,  such as proactively managing processes to meet historic preservation  and environmental requirements and working with host nations to  avoid prolonged negotiations over returning excess infrastructure in  foreign countries.
Action Plan: DOD needs to include in its plans any actions geared  toward reducing duplication or consolidating support services, such as  providing measurable goals linked to achieving savings and efficiencies  stemming from consolidation at the joint bases.
Monitoring: DOD needs to  improve the accuracy and completeness of data, including breaking  out the cost and square footage information on multiple properties  included in a single lease;  in any future BRAC round, commit to improving the fidelity of initial  BRAC cost estimates by working with military services and other  appropriate stakeholders to fully identify requirements—the cost of  military construction, information technology, and relocating personnel  and equipment, and alternatively financed projects—and limit bundling  multiple stand-alone realignments or closures into single  recommendations. When bundling is appropriate, itemize the costs  and savings associated with each major discrete action; direct the military departments to develop baseline cost data,  including any consolidation resulting from a future BRAC round; and  continue to periodically track service-level efforts to reduce excess  infrastructure, such as planned service targets to reduce or better use  excess space, based on reliable real property data, including  information on utilization and leased space.
Demonstrate Progress: DOD needs to establish targets for eliminating excess capacity, consistent with the  BRAC selection criteria chosen, for any future BRAC rounds; assess—using better data on the use of space and better monitoring  of DOD-level and service-level efforts— whether its goals and efforts  need to be reviewed to align space utilization with mission needs; and ensure its plans and programs to achieve reduction goals are  implemented and progress monitored, in addition to other actions  previously mentioned under the other high-risk criteria.
If Congress authorizes additional BRAC rounds, it may wish to consider  amending BRAC legislation to require the Secretary of Defense to  formally establish specific goals that the department expects to achieve  from a future BRAC process and require DOD to implement our  recommendations related to BRAC.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: DOD partially met the criterion for leadership commitment. DOD has  demonstrated some top leadership commitment to reducing excess  infrastructure and more efficiently managing its infrastructure, but needs  to demonstrate further commitment to better managing any future BRAC  rounds and providing steps to achieve its joint basing goals, timeframes,  and measures in achieving efficiencies in support services. Since 2013,  DOD has been successful in reducing excess infrastructure through its  past BRAC rounds and has demonstrated leadership in requesting  additional BRAC rounds. In addition, since 2013, in coordination with the  military services, DOD has developed and implemented more effective  and efficient methods to reduce excess infrastructure, such as through  more proactively managing DOD’s processes to meet historic  preservation and environmental requirements. Additionally, DOD has  worked with host nations to avoid prolonged negotiations over returning  excess infrastructure in foreign countries.
However, DOD needs to demonstrate additional leadership commitment  to ensuring the success of any future BRAC rounds by agreeing to  implement key actions we have recommended from reviews of the most  recent BRAC round. In March and April 2013, we reported that while the  BRAC process was fundamentally sound, the way DOD implemented the  2005 BRAC round at times limited its ability to estimate costs, potential  liabilities, and savings to achieve desired outcomes. Specifically, we  identified a number of issues with DOD’s process for estimating BRAC  costs and savings, which was hindered in many cases by underestimating  recommendation-specific requirements that were entered in the COBRA  estimation model. For example, the primary reason costs increased for  BRAC 2005 was higher-than-anticipated military construction costs—an  increase of 86 percent from $13.2 billion originally estimated by the BRAC  Commission to $24.5 billion after BRAC implementation ended in 2011.  DOD significantly understated initial requirements inputted into COBRA  for information technology costs (e.g., realigning supply, storage, and  distribution management initially estimated to be $31 million increased to  over $190 million).
Also, DOD understated the costs of relocating military personnel positions  and equipment, and did not consistently capture all costs associated with  alternatively financed projects. We recommended various actions to  improve the quality of information that forms the basis for the costs  estimates. In written comments to our March 2013 report, DOD officials  did not fully concur with these actions, stating that the COBRA model was  not meant for the purposes we recommended. However, more recently,  they agreed to take additional action to better forecast the initial costs  inputted into COBRA related to military construction, information  technology, and relocating military personnel positions and equipment,  and have already taken some steps to do so, in support of any future  BRAC round. Officials did not agree that liabilities from alternatively  financed projects need to be consistently captured in the COBRA model,  stating that it is difficult to estimate these costs. However, as we stated in  the April 2013 report, in cases where the amount of the liability cannot be  estimated, modifying the model with a capability to note the existence of a  potential liability would provide decision makers with valuable information  to inform their deliberations. DOD officials also cautioned that costs can  increase during implementation of BRAC recommendations which cannot  be easily foreseen, and increases in costs are reported to Congress. We  agree that costs can and have increased during the implementation of  BRAC recommendations. However, the intent of our recommendations  are to improve the information provided to decision makers while they are  comparing competing scenarios and making closure and realignment  decisions, understanding that ultimate costs may differ from these initial  estimates.
Further, DOD bundled multiple BRAC recommendations into single,  highly complex recommendations without itemizing costs and savings  associated with each separate major action, which limited visibility into  the estimated costs and savings for individual closures and realignments  and complicated the ability of the Defense Base Closure and Realignment  Commission (BRAC Commission) to review the recommendations. We  recommended actions to improve the quality of information that forms the  basis for the cost estimates by limiting the bundling of recommendations,  or if bundling is appropriate, to itemize the costs and savings associated  with each major discrete action. In the March 2013 report, DOD did not  fully concur with these recommendations, stating that actions are bundled  when they relate to a common outcome, and thus need to be viewed  comprehensively rather than individually. More recently, officials agreed  that when bundling is appropriate during any future BRAC round, they  would provide additional details related to costs and savings as needed.  We are encouraged by DOD’s agreement that improvements can be  made in the quality of the information that supports BRAC cost estimates,  and we continue to believe addressing these issues when planning for  any future BRAC rounds will help the department improve initial cost  estimates and provide a means for better evaluating the proposed closure  and realignment recommendations. Improving its planning processes,  including the cost estimates, would also help DOD implement the BRAC  process more effectively towards reducing excess capacity and provide  more confidence to Congress and the public on DOD’s efforts in  implementing BRAC actions.
With respect to achieving efficiencies in base support, DOD reported  relying on a multitude of efforts and initiatives at the OSD, military service,  and installation levels. We have reported on DOD’s progress in  implementing its joint basing program, one key initiative aimed at  achieving efficiencies in base support. We reported that OSD  demonstrated some leadership commitment to addressing issues  affecting joint bases by issuing a memo to the Secretaries of the military  departments asserting its support for joint basing and clarifying the  program goals, but OSD and the military departments have not yet  provided detailed guidance on how to meet the goals and related  timeframes. DOD’s memo outlined key areas for continual success of the  program, including continuing to consolidate installation support functions  at the bases. While the 2014 memo did not provide detailed guidance on  achieving cost savings and efficiencies or provide for milestones, as we  have recommended, it affirmed the purpose and goals of the joint bases  and demonstrated a commitment to the program.
Continued leadership by DOD, to include implementing our prior  recommendations in any future BRAC rounds and focusing its efforts to  reduce duplication of support services for its bases, among DOD’s other  efficiency measures, will be important to sustain efforts to more effectively  and efficiently align its infrastructure with its needs.
section_title: Capacity
paragraphs: DOD partially met the criterion for capacity. DOD demonstrated its  capacity to align its infrastructure with its force’s needs by disposing of  excess infrastructure during past BRAC rounds, and by consolidating  some installation services at the joint bases, among other efficiency  efforts. However, DOD needs to ensure the accuracy of its real property  data, and implement its utilization guide to improve its ability to identify  potential areas to reduce and consolidate its infrastructure. DOD needs to  further implement its Real Property Efficiency Plan, which is aimed at  disposing of longstanding excess infrastructure.
DOD has improved the way it collects utilization data for its facilities since  our 2015 high-risk update, and has issued a guide for calculating  utilization to help improve completeness and accuracy of the utilization  data. In following up on our September 2014 report recommendations on  DOD’s use of its facilities, we found that DOD has utilization data on  about 97 percent of its facilities as of September 2015, the most recent  data available—increasing from 53 percent as of September 2013.  However, the utilization rates entered into DOD’s database are likely not  reliable, since a majority of the facilities (85 percent) have the highest  possible rate of 100, which indicates full utilization at the same time that  DOD believes it has over 20 percent excess facility capacity. In addition,  of the facilities that have a rating of 100, 24 percent had either no  inspection date or been mostly recently inspected prior to September 30,  1999, which calls into question the accuracy of this data. In December  2016, DOD issued a policy memorandum that provided guidance for  calculating utilization to ensure utilization is measured and reported  consistently throughout DOD, and to maintain current information on  facility utilization. As the guidance is implemented, DOD officials expect  improvement in the accuracy of utilization data as facilities are assessed  and to increase the completeness of utilization data. Implementing the  guidance will help focus DOD’s efforts on reducing excess facility  capacity, and should improve information on the utilization of facilities to  position DOD to better identify excess facility capacity in support of its  efforts to reduce excess infrastructure.
In addition, we reported in September 2011 that long-standing excess  facilities—those identified prior to DOD’s demolition program in fiscal  2008—accounted for more than half of the excess inventory DOD  identified and may be more costly to eliminate due to historic preservation  of certain facilities and environmental issues. We recommended that  DOD continue to manage reduction of long-term excess facilities, such as  proactively managing processes to meet historic preservation and  environmental requirements and working with host nations to avoid  prolonged negotiations over returning excess infrastructure in foreign  countries. While DOD officials stated that they have been proactively  managing historic preservation and environmental requirements, the  amount of funding dedicated to future demolition is not consistent with the  number of long-standing facilities yet to be demolished. In October 2015,  DOD officials developed a DOD Real Property Efficiency Plan that  describes DOD’s strategic and tactical approach to managing its real  property effectively and efficiently, including reduction targets for fiscal  years 2016 through 2020. The plan further provides for how DOD expects  to dispose of long-standing excess facilities. However, DOD is in the early  stages of implementing the plan, and thus it is too early to assess its  results. If implemented effectively, the plan should help DOD improve its  capacity and ability to identify excess facilities, and to more effectively  and efficiently manage its real property.
We also reported that DOD has shown capacity to consolidate installation  services at the joint bases. We reported in November 2012 that the joint  bases reported meeting common standards more than 70 percent of the  time in fiscal years 2010 and 2011. Also, in September 2014, we reported  that the joint bases reported partially consolidating 80 percent of their  installation functions. However, we noted that without comprehensively  evaluating whether installation support functions were still suitable for  consolidation, and without identifying and addressing limitations reported  by the joint bases, DOD might not be able to fully consolidate all  installation support functions. We recommended that DOD evaluate the  support functions identified in its joint base guidance to determine which  are still suitable for consolidation, and subsequently identify and make  any appropriate changes. In 2015, DOD evaluated the possibility of a  European joint base, and removed six support functions that it determined  were not suitable because the functions provided limited opportunities for  consolidation. In addition, as part of its regular annual review of joint base  standards, DOD continues to evaluate which standards are suitable for  consolidation. Together, these actions address the intent of our  recommendation.
section_title: Action Plan
paragraphs: DOD partially met the criterion for having an action plan and has  developed plans to better identify and dispose of excess infrastructure,  including an overarching Real Property Efficiency Plan. However, these  plans do not include actions geared toward improving infrastructure  efficiencies related to achieving efficiencies in support services.
DOD developed a number of action plans to reduce infrastructure under  various initiatives. These action plans together provide for corrective  measures and solutions to reduce excess infrastructure. For example, in  October 2015, in response to a requirement under the Office of  Management and Budget’s (OMB) Reduce the Footprint policy, DOD  officials developed a Real Property Efficiency Plan that describes its  strategic and tactical approach to managing its real property effectively  and efficiently. This plan addresses our September 2014  recommendation to establish a strategic plan to manage DOD’s real  property and facilitate the department’s ability to identify potential  consolidation and disposal opportunities. The finalized plan describes  goals aligned with the National Strategy for the Efficient Use of Real  Property and for reducing the footprint of its real property inventory. The  plan also describes the strategies, programs, and methodology for  meeting these goals through the real property management policies and  procedures of the military departments, and metrics to gauge progress.  Implementing the plan, which began in 2016 and is scheduled to run  through 2020, will help DOD improve its ability to identify excess facilities  and plan for the effective and efficient management of its real property.
However, DOD’s plans, such as the Real Property Efficiency Plan, do not  address achieving efficiencies in support services. For example, for the  joint base program, DOD has not established an action plan, including  corrective measures and a timeline to benchmark progress, for achieving  cost savings and efficiencies, as we recommended in November 2012  and September 2014. As a result, joint base commanders are responsible  for determining to what extent they will pursue initiatives to reduce  redundancy and achieve potential cost savings or efficiencies, and the  extent to which such initiatives have been pursued varies by joint base.  We continue to believe that having an action plan related to reducing  duplication and consolidating installation support services would improve  DOD’s efforts to align its infrastructure to its mission needs and lead to  efficiencies in the department’s base support efforts.
section_title: Monitoring
paragraphs: DOD partially met the criterion for monitoring. DOD has committed to  taking actions that would improve its monitoring of any future BRAC  rounds, and has demonstrated some ability to monitor its efforts to  achieve reductions and efficiencies in infrastructure, but it does not have  reliable real property data to effectively monitor property and facility  utilization. Specifically, DOD is able to generally monitor excess  infrastructure reduced through past BRAC rounds and ongoing property  reduction efforts, and has improved its cost data monitoring for the joint  bases. For example, DOD has some procedures in place to monitor  excess infrastructure reduced from the 2005 BRAC round, the Freeze  and Reduce the Footprint policies and each service’s efforts at monitoring  its infrastructure. Under the Freeze and Reduce the Footprint policies,  OMB directed federal agencies to limit expansion of property (no new  facilities without disposing of equivalent facilities), provide real property  efficiency plans, and plan for and report on the reduction of property.  Through DOD’s Real Property Efficiency Plan, each military department  outlines its methods and metrics for identifying and reducing excess  infrastructure, and DOD monitors the military departments’ progress  towards meeting its reduction goals. However, it is too early to assess the  results from the plan since implementation began in 2016 and is  scheduled to run through 2020.
While DOD has made progress in improving its monitoring, it needs to  improve the reliability of its real property data and the monitoring of costs  and savings resulting from any future BRAC rounds. Specifically, as  mentioned previously, we reported in September 2011 and September  2014 that DOD does not have reliable real property data to assess how it  uses property and facilities. Subsequently, in March 2016 we reported  that DOD lacked reliable data to effectively assess how it uses leases.  While DOD is taking some steps to address data issues, it cannot fully  determine the number, size, and costs of its leases for real property  because the real property inventory system that DOD uses to monitor its  leased assets contains some inaccurate and incomplete data. For  example, we reported that about 15 percent of the lease records for fiscal  year 2011 and 10 percent of the records for fiscal year 2013 were  inaccurate. We recommended actions to improve the accuracy and  completeness of this data, such as breaking out the cost and square  footage information on multiple properties included in a single lease. DOD  concurred with our findings, but did not concur with our recommended  method to update DOD’s database. If DOD does not improve the  reliability of its data, the department will continue to be limited in its ability  to monitor its reduction of excess infrastructure, identify opportunities to  consolidate underutilized facilities, and identify opportunities to reduce  reliance on costly leased space by moving DOD organizations into  excess facilities.
Further, DOD has committed to taking some actions that would improve  the monitoring of costs and savings from any future BRAC rounds,  although some additional actions are needed. For example, we made a  number of recommendations in March 2013 and April 2013 which would  help DOD better monitor the implementation and effectiveness of the  BRAC recommendations. DOD officials acknowledged that they could  improve the initial estimates in future BRAC rounds, and have reported  taking some action to do so, including updating standard factors for  information technology as part of the European Infrastructure  Consolidation effort. However, DOD also needs to consistently capture  liabilities from alternatively financed projects in the COBRA model for any  future BRAC round. These actions would provide for better baseline data  with which to make decisions as well as to track and monitor the results  achieved through any future BRAC rounds. We also reported in February  2016 that DOD’s implementation of certain BRAC recommendations  limited its ability to determine cost savings because it lacked baseline  cost data. Despite challenges in isolating cost information, without  maintaining such information, DOD cannot determine the budgetary effect  of implementing actions to achieve reductions and efficiencies in  infrastructure.
With respect to improving baseline cost data for the joint bases, in  November 2012, we recommended that DOD continue to develop and  refine the joint bases common standards in order to eliminate data  reliability problems, facilitate comparisons of joint basing costs with the  costs of operating separate bases, and isolate costs and savings from the  joint basing initiative. DOD partially concurred with our recommendation,  and stated that it was working to improve the data’s reliability but found it  impractical to isolate and distinguish joint basing cost savings from the  savings that result from unrelated DOD- or service-wide actions. DOD  provided guidance to the joint bases to correct baseline data and as a  result, the quality of the data improved for fiscal years 2012 and 2013,  resulting in a 2013 analysis showing that the joint bases cost less to  operate than the separate installations. Together, these actions met the  intent of our recommendation and provided DOD with an improved picture  of the cost of operating the joint bases.
section_title: Demonstrated Progress
paragraphs: DOD partially met the criterion for demonstrated progress. DOD has  demonstrated some progress in aligning its infrastructure to its forces’  needs by reducing excess infrastructure through BRAC and other service  efforts, and in consolidating base support services. Although initially not  agreeing to our related recommendations, DOD identified steps to  improve the quality of information used to support recommendations for  any future BRAC rounds, and improve the accuracy and completeness of  utilization data. However, DOD needs to further improve lease data to  better identify excess infrastructure for disposal and develop a plan for  reducing duplication and consolidating support services to increase the  efficiency of the department’s infrastructure services.
DOD has also reduced some excess infrastructure, but needs to develop  targets for eliminating excess through any future BRAC rounds, and  ensure that its plans and programs to reach reduction goals are  implemented and progress monitored. DOD did not concur with our  recommendation to develop targets for eliminating excess infrastructure  through any future BRAC rounds, stating that having overarching targets  would subvert developing actions based on military value. However, in  further discussion, DOD officials stated that qualitative goals, such as  needing to reduce excess infrastructure, are helpful in focusing efforts  and measuring success, but they continued to believe that quantitative  goals would be in conflict with BRAC selection criteria. We have reported  on the soundness of the BRAC selection criteria and generally endorsed  their retention for the future, and do not believe that establishing targets  for eliminating excess infrastructure affects DOD’s ability to apply these  criteria. While we agree that stating a goal in future BRAC rounds, such  as reducing excess infrastructure, is useful, we continue to believe that  establishing specific targets would assist DOD in measuring progress in  reducing excess infrastructure and not harm the department’s ability to  consider military value as its primary selection criteria. Moreover, DOD  would retain the ability to exercise military judgement in selecting from  among the candidate recommendations to be put forward to the BRAC  commission, as was the case in BRAC 2005 and which we have  generally endorsed.
The military services have also demonstrated some progress in reducing  excess infrastructure. For example, the services have disposed of and  demolished excess facilities through their individual efforts, and under the  Freeze the Footprint policy DOD has limited construction of new facilities  without disposing of equivalent facilities. Further, for fiscal year 2013,  DOD reported a net reduction of 7.7 million square feet, which is about 75  percent of the total reduction across the federal government under this  policy. As described above, DOD’s Real Property Efficiency Plan outlines  goals, strategies and programs to reach goals, and metrics to gauge  progress. It will be important for DOD to ensure that the plan is effectively  implemented and progress is monitored so that the department can  achieve its reduction goals. However, DOD’s progress in reducing excess  infrastructure is limited by challenges with long-standing excess facilities  and unreliable data related to the use of its facilities and of its leased  space. Until DOD improves its capacity and monitoring of efforts aimed at  reducing long-standing excess facilities, the department cannot fully  demonstrate progress in better aligning its infrastructure to its mission  needs.
DOD has demonstrated some progress in achieving efficiencies in base  support, such as officials reporting reductions of redundant funded  positions, contracts, and procedures at the joint bases. DOD’s data  shows that joint bases are obligating less funding than they would have  as stand-alone bases, although some of the savings are attributable to  other service actions, such as budget cuts unrelated to joint basing, as  noted above. Further, DOD instituted mechanisms to facilitate routine  communication to encourage jointly resolving common challenges and  sharing best practices and lessons learned. DOD also issued a joint  basing handbook to address inconsistent service level guidance.  However, DOD has not provided clear direction to joint bases on steps  needed to reach program goals, and lacks a plan for reducing duplication  and consolidating support services.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In October 2015, DOD issued its Real Property Efficiency Plan that  describes DOD’s strategic and tactical approach to managing its real  property effectively and efficiently. This plan addresses our  September 2014 recommendation to establish a strategic plan to  manage DOD’s real property and to facilitate the department’s ability  to identify potential consolidation and disposal opportunities. The  finalized plan describes goals aligned with the National Strategy for  the Efficient Use of Real Property and for reducing the footprint of  DOD’s real property inventory. The plan describes strategies,  programs, and methodology to achieve these goals through the real  property management policies and procedures of the DOD property  holders—the three military departments and Washington  Headquarters Service. The plan also provides baseline amounts and  metrics to gauge progress toward goals established in the plan. As a  result, we believe that DOD’s plan should help improve its ability to  identify excess facilities and plan for effective and efficient  management of its real property.
In May 2015, DOD issued a handbook to provide basic information  and clarify processes and procedures for the joint bases. The  document is intended to serve as a first point of reference for  information about the joint bases and the unique policies and  guidance that govern them. This handbook, which addresses how  joint bases differ from other military installations among other relevant  issues, can better inform incoming servicemembers about the  particular characteristics of joint bases, as well as reduce duplication  or inconsistency in how the joint bases train incoming  servicemembers. This document addresses our November 2012  recommendation for DOD to develop guidance to ensure all joint  bases develop and provide training materials to incoming personnel to  increase opportunities for greater efficiencies and reduce duplication  of efforts.
In January 2015, DOD evaluated the possibility of a European joint  base, and removed six support functions that it determined were not  suitable because the functions provided limited opportunities for  consolidation. In addition, DOD continues to evaluate which standards  are suitable for consolidation in its annual review process. Together  these actions address the intent of our September 2014  recommendation to evaluate whether to continue including all current  joint base support functions in future joint basing efforts and to make  any changes appropriate to address these limitations.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Brian J.  Lepore at (202) 512-4523 or leporeb@gao.gov.
section_title: Related GAO Products
paragraphs: Defense Infrastructure: More Accurate Data Would Allow DOD to Improve  the Tracking, Management, and Security of Its Leased Facilities.  GAO-16-101. Washington, D.C.: March 15, 2016.
Military Base Realignments and Closures: More Guidance and  Information Needed to Take Advantage of Opportunities to Consolidate  Training. GAO-16-45. Washington, D.C.: February 18, 2016.
DOD Joint Bases: Implementation Challenges Demonstrate Need to  Reevaluate the Program. GAO-14-577. Washington, D.C.: September 19,  2014.
Defense Infrastructure: DOD Needs to Improve Its Efforts to Identify  Unutilized and Underutilized Facilities. GAO-14-538. Washington, D.C.:  September 8, 2014.
Military Bases: DOD Has Processes to Comply with Statutory  Requirements for Closing or Realigning Installations. GAO-13-645.  Washington, D.C.: June 27, 2013.
Defense Infrastructure: Improved Guidance Needed for Estimating  Alternatively Financed Project Liabilities. GAO-13-337. Washington, D.C.:  April 18, 2013.
Military Bases: Opportunities Exist to Improve Future Base Realignment  and Closure Rounds. GAO-13-149. Washington, D.C.: March 7, 2013.
DOD Joint Bases: Management Improvements Needed to Achieve  Greater Efficiencies. GAO-13-134. Washington, D.C.: November 15,  2012.
Military Base Realignments and Closures: Updated Costs and Savings  Estimates from BRAC 2005. GAO-12-709R. Washington, D.C.: June 29,  2012.
Excess Facilities: DOD Needs More Complete Information and a Strategy  to Guide Its Future Disposal Efforts. GAO-11-814. Washington, D.C.:  September 19, 2011.
section_title: DOD Approach to Business Transformation
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of Defense (DOD) has taken some positive steps since  the 2015 high-risk update to improve its business transformation efforts.  For example, DOD has established the Defense Business Council (DBC)  to serve as a senior-level governance forum for its business functions,  and issued an Agency Strategic Plan that includes business  transformation priorities and which the department is using to guide its  business operations. However, additional steps are needed to address  long-standing weaknesses in DOD’s business operations and remove this  issue from the High-Risk List.
DOD spends billions of dollars each year to maintain key business  operations intended to support the warfighter, including systems and  processes related to the management of contracts, finances, the supply  chain, support infrastructure, and weapon systems acquisition.  Weaknesses in these areas adversely affect DOD’s efficiency and  effectiveness, and render its operations vulnerable to waste, fraud, and  abuse. DOD’s overall approach to transforming these business  operations is inextricably linked to DOD’s ability to perform its overall  mission, directly affecting the readiness and capabilities of U.S. military  forces.
We added DOD’s overall approach to managing business transformation  as a high-risk area in 2005 because DOD had not taken the necessary  steps to achieve and sustain business reform on a broad, strategic,  department-wide, and integrated basis. Further, DOD’s historical  approach to business transformation has not proven effective in achieving  meaningful and sustainable progress in a timely manner. For example,  DOD had not established clear and specific management responsibility,  accountability, and control over business transformation-related efforts  and applicable resources across business functions. Also, DOD did not  have an integrated plan for business transformation with specific goals,  measures, and accountability mechanisms to monitor progress and  achieve improvements.
section_title: What GAO Found
paragraphs: Since 2005, DOD has demonstrated some leadership commitment and  notably improved capacity toward addressing business transformation  efforts, such as assigning responsibility for agency goals and objectives.  DOD has also taken several notable steps to improve its capacity to  monitor DOD’s business transformation efforts, such as developing  position descriptions for management analysts, and updating the mission  for the Office of the Deputy Chief Management Officer’s (DCMO)  Planning, Performance, and Assessment directorate to fulfill performance  management-related requirements. While DOD has demonstrated some  progress through undertaking initiatives intended to improve the efficiency  of its business processes, DOD has not 1) fully developed a corrective  action plan, 2) consistently held performance reviews that include  department-wide performance information, and 3) fully established  accountability mechanisms for meeting performance targets. Until DOD  makes further progress in addressing these actions and outcomes, its  progress in transforming into a more efficient department will be limited.
To date, Congress has passed legislation that could assist DOD in  addressing this high-risk area. For example, the National Defense  Authorization Act for Fiscal Year 2017, among other things, created a  distinct Chief Management Officer (CMO) position effective February 1,  2018, with the mission of managing, establishing policies on, and  supervising the business operations of the department. This position  would also have the authority to direct the Secretaries of the military  departments and the heads of all other DOD components with regard to  matters for which the CMO would have responsibility. Before the  implementation of this position, the Secretary of Defense is required to  conduct a review of the disposition of leadership positions, subordinate  organizations, and defined relationships, including the placement and  responsibilities of the new CMO position. Specifically, it requires a proposed implementation plan for how the Department would  recommendations for revisions to appointments and qualifications,  duties and powers, and precedent in the Department;  recommendations for such legislative and administrative action,  including conforming and other amendments to law, as the Secretary  considers appropriate to implement the plan; and any other matters that the Secretary considers appropriate.
A final report is due to the defense committees by August 1, 2017.  Continued congressional attention to addressing this high-risk area will be  essential going forward.
section_title: What Remains to Be Done
paragraphs: In August 2014, we provided DOD with a letter that outlined 13 actions  and outcomes that we believe it should address in order to mitigate or  resolve long-standing weaknesses in its business transformation efforts.  Based on discussions with DOD officials and recent efforts across the  department as of October 2016, we believe that DOD has addressed 5 of  the 13 actions and outcomes, but have yet to address 8 actions and  outcomes. These actions and outcomes are based on the five high-risk  criteria for removal: leadership commitment, capacity, action plan,  monitoring, and demonstrated progress. For the capacity criterion, while  we believe the actions and outcomes we have identified remain  important, we also believe they have made notable progress in this  criterion to be considered as met, such as reviewing the systems and  functions of the Office of the DCMO and Office of the Secretary of  Defense (OSD) organizations, and improving the alignment of its  personnel with the strategic goals in the draft Agency Strategic Plan. For  the remaining four criteria, DOD needs to show measureable and  sustained positive outcomes in addressing the remaining eight actions  and outcomes. This includes, among other things, DOD continuing to hold  business function leaders accountable for performance, refining or  developing a more comprehensive corrective action plan as well as  existing performance measures, and achieving measurable and sustained  outcomes.
Leadership Commitment: DOD should  continue to hold business function leaders accountable for diagnosing  performance problems and identifying strategies for improvement; and  continue to lead regular DOD performance reviews regarding  transformation goals and associated metrics and ensure that business  function leaders attend these reviews to facilitate problem solving. tradeoffs, priorities, and any sequencing needed to implement the  initiatives, and help leaders plan for and provide the resources  needed to make the corrective actions identified.  continue to refine existing performance measures to ensure that  measures assess progress in achieving all business transformation  initiatives as needed, and hold owners of DOD’s business functions  accountable for providing input into performance targets; and  conduct frequent and regular data-driven performance reviews using  established performance measures, and use existing governance  structures, such as the DBC, to assess department-wide performance  including the military departments.
Demonstrated Progress: DOD should make substantial progress in implementing a corrective action plan  that includes measures addressing the root causes of shortfalls in  business functions, and details how corrective actions designed to  improve DOD business functions will be implemented;  continue to implement initiatives that result in measurable and  sustained positive outcomes over several years, including cost  savings and increased efficiencies, thus promoting actions that control  costs across the department envisioned by the Secretary of Defense,  as noted in DOD’s 2014 Report to Congress on the Defense Business  Operations; and document and report on progress in implementing corrective actions  across business functions to Congress and other key stakeholders to  strengthen accountability; progress could be reported in the annual  report to Congress on DOD Business Operations or through other  means.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: a performance management framework that DOD intends to use to  evaluate its effectiveness. DOD’s Agency Strategic Plan identifies five  strategic goals that have associated strategic objectives, performance  goals, agency priority goals, or cross-agency priority goals, as well as  performance indicators with targets for assessing progress. One of these  goals is to reform and reshape the defense institution. As part of the  Agency Strategic Plan, OSD Principal Staff Assistants are responsible for  reporting progress on performance goals, agency priority goals, or cross- agency priority goals that are linked to DOD’s strategic goals and  objectives.
OSD Principal Staff Assistants have reported on the progress of meeting  these associated goals at the DBC meetings. In June and in August 2016,  the Acting DCMO, through the DBC, conducted performance reviews  intended to assess progress against agency priority goals and other  performance measures in the Agency Strategic Plan, and provide  opportunities to discuss problems and alternatives, among other things.  However, these performance reviews have not been conducted on a  regular basis. Specifically, prior to June 2016, the DBC had not  conducted a performance review since November 2015. Office of the  DCMO officials stated that the Acting DCMO plans to conduct a  performance review in December 2016 and on a quarterly basis going  forward. It will be important for the Acting DCMO to continue to conduct  these performance reviews on a regular basis to hold business function  leaders accountable for progress.
To further enhance DOD’s oversight of its business transformation efforts,  the National Defense Authorization Act for Fiscal Year 2017, among other  things, created a distinct CMO position with the mission of managing,  establishing policies on, and supervising the business operations of the  department. This new position, to begin in February 2018, is expected to  provide greater management authority to oversee management of  business operations, and could help DOD further demonstrate its  commitment to addressing business transformation efforts. This new  position would also report directly to the Secretary of Defense. The  Deputy Secretary of Defense will no longer serve as CMO. However, the  effect of this new structure on improving business transformation within  DOD remains to be determined, to include the extent to which this  position will have the authority and support needed to drive business  transformation efforts across the department.
section_title: Capacity
paragraphs: The Office of the DCMO has taken several notable steps to improve its  capacity to monitor DOD’s business transformation efforts and now meets  this high-risk criterion. In September 2016, the Acting DCMO stated that  DOD conducted a business process and systems review that included  reviewing structures and functions within the Office of the DCMO. DOD  DCMO officials said that the office completed the review of the Office of  the DCMO in September 2014.
The review of the DCMO found that the overall structure of the office was  sound from a mission perspective, but also identified opportunities to  better align related organizations within the office. For example, the Office  of the DCMO’s Planning, Performance, and Assessment Directorate was  restructured to create outreach teams aligned to major strategic initiatives  that are responsible for establishing goals and objectives. According to  DOD officials, as part of this effort, the Office of the DCMO reassessed  position descriptions to determine the appropriate structure for the office.  The Office of the DCMO also developed position descriptions for  management analysts, updated the mission for its Planning,  Performance, and Assessment directorate, and reorganized the  directorate to align its personnel with the strategic goals in the draft  Agency Strategic Plan. They stated that this action was taken to ensure  that the Office of the DCMO could work across each business function to  accomplish department-wide goals. Further, Office of the DCMO officials  stated that the Planning, Performance, and Assessment directorate hired  personnel with expertise in strategic planning and performance  management to increase its capacity to oversee business transformation  efforts. Officials further stated that the directorate has assessed its staff’s  knowledge, skills, and abilities related to strategic planning and  performance management, and monitors progress towards addressing  any gaps through annual performance reviews. working group is used to leverage subject matter expertise, including  conducting additional analyses on issues tied to business operations for  the Office of the DCMO as needed. It will be important for the Office of  the DCMO to continue to use its existing management analysis capacity  along with the Fourth Estate Working Group to drive business  transformation efforts across the department.
In addition to maintaining the capacity of the DCMO to drive business  transformation efforts, it will be critical that the CMO position, established  by the National Defense Authorization Act for Fiscal Year 2017, has the  personnel and other resources needed to fulfill its significant  responsibilities. Since this position will not go into effect until February  2018 and the details of its implementation and responsibilities are not fully  known, it is too early to determine whether it will have the capacity  needed to lead the department’s business transformation efforts. We will  monitor DOD’s progress in implementing this position moving forward to  include its impact on DOD’s transformation efforts.
section_title: Action Plan
paragraphs: DOD now partially meets this criterion. In July 2015, DOD issued its first  Agency Strategic Plan. Subsequently, in September 2016, DOD officials  shared its draft update to the Agency Strategic Plan for Fiscal Years 2015  – 2018, Version 2.0. This draft update has a performance action plan that  contains some but not all elements of a corrective action plan. The  performance action plan is intended to provide detailed information for  monitoring and reporting DOD’s progress towards each strategic goal,  objective, and performance goal as well as, where appropriate, to  address actions the department is taking in response to our and DOD  Inspector General recommendations. The performance action plan  identifies business function leaders for each strategic objective and  associated performance goals. In addition, the plan includes, among  other things, a description of the problem and opportunity; relationship to  strategic goal and objective; key barriers and challenges; mitigation  efforts; and an implementation plan, initiatives, and targets for  performance measures over time. However, the performance action plan  does not define the root causes of business transformation weaknesses  or the steps necessary to implement solutions we have recommended in  our prior work. Further, the performance action plan does not identify  processes and systems to implement initiatives to address root causes, or  the tradeoffs needed to implement the initiatives. In January 2017, a  senior DOD official stated that DOD does not plan to issue the update to  its Agency Strategic Plan, and will instead continue to collect, review, and  report on performance data using the draft update until it is superseded.
While the continued use of the draft update to the Agency Strategic Plan  is a positive step forward, a more comprehensive performance action  plan that outlines the necessary elements of a corrective action plan  would allow DOD to more effectively hold business function leaders  accountable.
section_title: Monitoring
paragraphs: DOD now partially meets this criterion. DOD’s performance action plan in  its draft update to the Agency Strategic Plan contains performance  measures intended to measure progress in DOD’s business  transformation efforts and establishes clear linkages to performance and  resource decisions. However, the Office of the DCMO has not established  how it plans to hold owners of DOD business functions accountable for  performance or monitor the military departments’ business transformation  efforts. According to DOD and military department officials, there has  been an increased emphasis on reviewing the performance of DOD’s  business functions as part of the DBC meetings. However, the DBC did  not conduct quarterly reviews of performance from November 2015 until  June 2016, when the Acting DCMO conducted a briefing of DOD’s  agency priority goals in June 2016. In September 2016, the Acting DCMO  stated that the department plans to conduct quarterly performance  reviews against the agency priority goals and other performance  measures in the draft update to the Agency Strategic Plan, and in its most  recent meeting in December 2016, the DBC conducted a quarterly  performance review against these measures. Further, in January 2017, a  senior DOD official stated that DOD does not plan to issue the update to  its Agency Strategic Plan, and will instead continue to collect, review, and  report on performance data using the draft update until it is superseded.  Consistently conducting quarterly performance reviews is critical to  assessing the department’s progress in its business transformation  efforts, and issuing an updated Agency Strategic Plan that sets forth  DOD’s approach to monitoring would further institutionalize such efforts. wide performance to more effectively achieve business transformation  goals.
section_title: Demonstrated Progress
paragraphs: DOD now partially meets this criterion. Since 2014, and in part to respond  to congressional direction, DOD has undertaken initiatives intended to  improve the efficiency of its business processes, but DOD has not been  able to demonstrate clear results associated with these initiatives, as well  as sustained attention and focus consistently across the business  functions. DOD guidance states that the DCMO is responsible for working  to better synchronize, integrate, and coordinate the business operations  of DOD to optimally align them to support the DOD warfighting mission.  DOD reviewed headquarters organizations and other DOD entities to  identify cost savings, but it is unclear to what extent these initiatives will  help the department achieve the savings it has identified. For example, in  May 2015, DOD concluded its Core Business Process Review, which was  intended to apply lessons learned and information technology approaches  from the commercial sector to the department’s business processes in  order to reduce cost and improve mission performance. Through this  review, the Office of the DCMO identified at least $62 billion in potential  cumulative savings opportunities across the six business processes for  fiscal years 2016 through 2020. The review identified that these potential  savings opportunities could be achieved through not replacing civilian  personnel who attrite and retire over the next 5 years; matching labor  productivity in comparable industries or sectors; and improving core  processes, such as rationalizing organizational structures to reduce  excessive layers, optimizing contracts, and using information technology  to eliminate or reduce manual processes. However, in June 2016, we  reported that the potential savings opportunities could not entirely be  achieved, according to Office of the DCMO officials. The results of DOD’s  reviews of headquarters organizations and other DOD entities are still  being implemented across the department, and DOD has not yet reported  on progress associated with these reviews. efficiencies for delayering, contracted services, and other headquarters- related initiatives. Identifying savings and increased efficiencies from  these efforts is important to promoting actions that control costs as  envisioned by the Secretary of Defense, and we have cited the need for  DOD to implement initiatives that result in measurable and sustained  positive outcomes.
The DCMO has used the DBC to continue to focus attention on  modernizing its business systems versus more broadly on business  transformation issues. While this is important in addressing another DOD  high-risk area, the DCMO also needs to place greater attention on  improving its business processes across the business functions. Further,  the DCMO has not yet documented or reported on progress in  implementing any corrective actions across business functions to  Congress and other key stakeholders to strengthen accountability.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Zina D. Merritt  at (202) 512-5257 or merrittz@gao.gov.
section_title: Related GAO Products
paragraphs: Defense Business Transformation: DOD Should Improve Its Planning with  and Performance Monitoring of the Military Departments. GAO-17-9.  Washington, D.C.: December 7, 2016.
Defense Headquarters: Improved Data Needed to Better Identify  Streamlining and Cost Savings Opportunities by Function. GAO-16-286.  Washington, D.C.: June 30, 2016.
DOD Financial Management: Greater Visibility Needed to Better Assess  Audit Readiness for Property, Plant, and Equipment. GAO-16-383.  Washington, D.C.: May 26, 2016.
High-Risk Series: Key Actions to Make Progress Addressing High-Risk  Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.
DOD Financial Management: Continued Actions Needed to Address  Congressional Committee Panel Recommendations. GAO-15-463.  Washington, D.C.: September 28, 2015.
DOD Business Systems Modernization: Additional Action Needed to  Achieve Intended Outcomes. GAO-15-627. Washington, D.C.: July 16,  2015.
Managing for Results: Agencies Report Positive Effects of Data-Driven  Reviews on Performance but Some Should Strengthen Practices.  GAO-15-579. Washington, D.C.: July 7, 2015.
Defense Business Transformation: DOD Has Taken Some Steps to  Address Weaknesses, but Additional Actions Are Needed. GAO-15-213.  Washington, D.C.: February 11, 2015.
section_title: Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally Identifiable Information
subsections: section_title: Why Area Is High Risk
paragraphs: Federal agencies and our nation’s critical infrastructures—such as  energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and  electronic data to carry out operations and to process, maintain, and  report essential information. The security of these systems and data is  vital to public confidence and the nation’s safety, prosperity, and well- being.
However, safeguarding federal computer systems and the systems that  support critical infrastructures—referred to as cyber critical infrastructure  protection—has been a long-standing concern. The security of federal  cyber assets has been on our High-Risk List since 1997. In 2003, we  expanded this high-risk area to include the protection of critical cyber  infrastructure. In 2015, we added protecting the privacy of personally  identifiable information (PII) that is collected, maintained, and shared by  both federal and nonfederal entities. implemented. As of October 2016, about 1,000 of our information  security–related recommendations had not been implemented.
Risks to cyber assets can originate from unintentional and intentional  threats. These include insider threats from disaffected or careless  employees and business partners, escalating and emerging threats from  around the globe, the steady advances in the sophistication of attack  technology, and the emergence of new and more destructive attacks.  Ineffectively protecting cyber assets can facilitate security incidents and  cyberattacks that disrupt critical operations; lead to inappropriate access  to and disclosure, modification, or destruction of sensitive information;  and threaten national security, economic well-being, and public health  and safety.
Regarding PII, advancements in technology, such as new search  technology and data analytics software for searching and collecting  information, have made it easier for individuals and organizations to  correlate data and track it across large and numerous databases. In  addition, lower data storage costs have made it less expensive to store  vast amounts of data. Also, ubiquitous Internet and cellular connectivity  makes it easier to track individuals by allowing easy access to information  pinpointing their locations. These advances—combined with the  increasing sophistication of hackers and others with malicious intent, and  the extent to which both federal agencies and private companies collect  sensitive information about individuals—have increased the risk of PII  being exposed and compromised.
section_title: What GAO Found
paragraphs: Leadership at the White House and Department of Homeland Security  (DHS) demonstrated commitment to improving cybersecurity. For  example, the President issued strategy documents for improving aspects  of cybersecurity and an executive order (E.O.) and policy directive for  improving security and resilience of critical cyber infrastructure. However,  challenges remain, such as shortages in qualified cybersecurity personnel  and continued weaknesses in agencies’ information security programs.  These challenges need to be addressed as initial steps toward removal  from the High-Risk List. Furthermore, progress will need to be  demonstrated by agencies fully implementing their information security  programs and by critical infrastructure sectors improving their  cybersecurity.
In addition, Congress enacted legislation intended to strengthen  information security across the federal government and to improve the  protection of critical cyber assets. The Cybersecurity Act of 2015  established a voluntary framework for sharing cybersecurity threat  information between and among the federal government, state  governments, and private entities, and protects private sector entities  from liability when sharing and receiving cyber threat information. The  act also makes DHS’s National Cybersecurity and Communications  Integration Center responsible for implementing these mechanisms,  requires DHS to offer its intrusion and detection capabilities to any federal  agency, and calls for agencies to assess their cyber-related workforce.
section_title: What Remains to Be Done
paragraphs: DHS needs to expand capabilities, improve planning, and support  wider adoption of its government-wide intrusion detection and  prevention system.
Agencies need to develop and implement complete policies,  plans, and procedures for responding to cyber incidents and  effectively oversee response activities.
Agencies need to consistently implement policies and procedures  for responding to breaches of PII.
The federal government needs to expand its cyber workforce planning  and training efforts. Agencies need to enhance efforts for recruiting and retaining a qualified  improve cybersecurity workforce planning activities.
The federal government needs to expand efforts to protect cyber  critical infrastructure. For example:
DHS and sector-specific agencies need to collaborate with sector  partners to develop performance metrics and determine how to  overcome challenges to reporting the results of their cyber risk  mitigation activities; and
DHS needs to assess whether its efforts to share information on  cyber threats, incidents, and countermeasures with federal and  non-federal entities are useful and effective.
The federal government needs to better oversee the protection of PII  contained in electronic health information and health insurance  marketplaces. Needed efforts include the following:
Department of Health and Human Services (HHS) needs to  enhance its oversight and guidance related to the actions to  protect privacy implemented by entities that maintain electronic  health information.
HHS’s Centers for Medicare & Medicaid Services (CMS) needs to  ensure that Healthcare.gov and state health insurance  marketplaces have effective controls in place to safeguard  electronic health information.
Congress should consider amending privacy laws to more fully protect  the PII collected, used, and maintained by the federal government.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: The EOP and DHS met the criterion of demonstrating top leadership  commitment to securing federal information and protecting the privacy of  PII. For example, the President signed legislation, issued executive  orders and a policy directive, and published a national action plan that  were intended to improve aspects of federal information security, privacy  safeguards, and critical infrastructure cybersecurity. In addition, updated  guidance, as well as actions such as creating positions for a senior  advisor for privacy and federal chief information security officer within the  Office of Management and Budget (OMB), further demonstrated the  extent to which the EOP was committed to securing federal information  systems and protecting privacy. Specific actions taken by the  administration and DHS included the following:  In July 2016, the President released Presidential Policy Directive  (PPD)-41 which set forth principles governing the federal  government’s response to cyber incidents involving government or  private sector entities. For significant cyber incidents, this PPD  establishes lead federal agencies and a process for coordinating the  broader federal government response. PPD-41 also requires the  Department of Justice (DOJ) and DHS to maintain updated contact  information for public use to assist entities affected by cyber incidents  in reporting those incidents to the proper authorities.
In February 2016, the President issued E.O. 13719, which created the  Federal Privacy Council, a council of senior federal privacy officials  established to share ideas and best practices and develop new  approaches for protecting privacy in today’s technology driven  environment. The President also directed his administration to  systematically review where the federal government can reduce  reliance on Social Security numbers. organizations, executive departments and agencies, and other entities  and to collaborate to respond in as close to real time as possible.
In July 2016, OMB issued a revised Circular A-130, Managing  Information as a Strategic Resource, to reflect changes in law and  advances in technology and to ensure consistency with executive  orders, presidential directives, recent OMB policy, and National  Institute of Standards and Technology (NIST) standards and  guidelines.  The revised circular establishes general policy for,  among other things, information governance, security, and privacy. It  incorporates security and privacy requirements as crucial elements of  a comprehensive, strategic, and continuous risk-based program at  federal agencies.
DHS established the Critical Infrastructure Cyber Community (C3)
Voluntary Program to encourage entities to adopt NIST’s Framework  for Improving Critical Infrastructure Cybersecurity. As part of this  program, DHS developed guidance and tools that are intended to help  entities use the framework. The C3 Voluntary Program also includes  outreach and awareness activities, promotion efforts targeting specific  types of entities, and creation of communities of interest around  critical infrastructure cybersecurity.
section_title: Capacity
paragraphs: The EOP and DHS partially met the criterion for improving the capacity of  federal agencies to sufficiently protect their information systems and PII.  Resources and initiatives were identified to address federal cybersecurity  capacity concerns. Increased budgetary resources and human capital  strategies were proposed to address limitations on federal cybersecurity  capacity. For example, the President’s 2017 budget request proposed  funds to enhance the Scholarship for Service program, develop a  cybersecurity core curriculum, increase the number of academic  institutions that are National Centers for Academic Excellence in  Cybersecurity, and offer student loan forgiveness for cybersecurity  experts in the federal workforce. The President’s 2017 budget also  proposed investing $19 billion in cybersecurity, an increase of about 35  percent over fiscal year 2016.
Nevertheless, according to OMB and agency chief information security  officers, the federal government suffered from a shortage of cybersecurity  professionals due to persistent recruitment and retention challenges.  Also, it is unclear the extent to which efforts to improve the capacity of the  cybersecurity workforce, among other cybersecurity-related initiatives,  were focused on increasing resources at agencies devoted to privacy  protection. Executing the human resources strategy and budget priorities  could ensure that federal agencies have the necessary capacity to better  address the information security and PII protection needs of federal  civilian agencies.
section_title: Action Plan
paragraphs: The EOP and DHS partially met the criterion for having a corrective action  plan to improve the protection of cyber assets and PII. Government-wide  plans identified actions to be taken to enhance cybersecurity and PII  protection. Examples included the following:
OMB issued the Cybersecurity Strategy and Implementation Plan in  October 2015. The plan aimed to strengthen federal civilian  cybersecurity by (1) identifying and protecting high-value information  and assets, (2) detecting and responding to cyber incidents in a timely  manner, (3) recovering rapidly from incidents when they occur and  accelerating the adoption of lessons learned, (4) recruiting and  retaining a highly qualified cybersecurity workforce, and (5) efficiently  acquiring and deploying existing and emerging technology.
The President directed his administration to implement the  Cybersecurity National Action Plan. The plan identified near-term  actions and a long-term strategy that are intended to enhance  cybersecurity awareness and protections, protect privacy, maintain  public safety and economic and national security, and empower  Americans to take better control of their digital security.
OMB issued the Federal Cybersecurity Workforce Strategy on July  12, 2016, which identified key actions to help recruit and retain a  federal cybersecurity workforce. These key actions included directions  to OMB and the Office of Personnel Management (OPM) to provide  guidance on the use of special hiring authorities to recruit  cybersecurity professionals as well as directions to DHS for piloting a  new hiring tool.
However, agencies had not yet fully implemented the actions identified in  the plans and strategy. In addition, the plans do not consistently address  the implementation of about 1,000 of our information security–related  recommendations identified across federal agencies.
section_title: Monitoring
paragraphs: The EOP, DHS, and federal agencies partially met the criterion for  implementing programs to monitor corrective actions related to  cybersecurity and PII protection. A government-wide reporting process  provided a mechanism for monitoring the efforts of federal agencies in  achieving cross-agency priority goals for cybersecurity. Specifically, the  EOP and DHS developed and used metrics for measuring agency  progress in implementing initiatives on information security regarding  continuous monitoring, strong authentication, and anti-phishing and  malware defense. In addition, OMB and DHS continued to monitor  agencies’ implementation of information security requirements using  FISMA reporting metrics that are tracked in the CyberScope system.  Together, they had conducted CyberStat reviews that are intended to  hold agencies accountable and offer assistance for improving their  information security posture.
Nevertheless, other cybersecurity monitoring efforts lacked metrics to  measure and report on the effectiveness of the planned and implemented  activities. Examples included the following:  In December 2015, we reported that DHS had not developed metrics  to measure the effectiveness of its efforts to promote the voluntary  use of NIST’s Framework for Improving Critical Infrastructure  Cybersecurity or to develop guidance and tools to help entities use  the framework. We recommended that DHS develop metrics to  monitor the effectiveness of its efforts to promote the framework. DHS  agreed and indicated that these efforts are underway. mitigate cyber risks and vulnerabilities for their respective sectors.  However, most sector-specific agencies had not developed metrics to  measure and report on the effectiveness of their cyber risk mitigation  activities or their sectors’ cybersecurity posture. We recommended  that federal agencies develop performance metrics to monitor their  progress. These metrics have not yet been developed.
section_title: Demonstrated Progress
paragraphs: The EOP, DHS, and federal agencies partially met this criterion by  demonstrating progress in implementing the many requirements for  securing federal systems and networks. For example, the federal  government had taken the following steps to enhance cybersecurity and  protect PII:
The EOP established an OMB Cyber Unit in January 2015 to improve  overall federal cybersecurity oversight.
OMB initiated a 30-day Cybersecurity Sprint in June 2015 to lead  federal agencies to adopt strong authentication controls and deploy  critical patches.
OMB and DHS conducted CyberStat reviews at federal agencies  during fiscal years 2015 and 2016. weakness or significant deficiency in internal controls over financial  reporting for fiscal year 2016. Further, inspectors general at 20 of  the 23 agencies cited information security as a major management  challenge for their agencies.
Providing government-wide intrusion detection and prevention  services. In January 2016, we reported that DHS’s National  Cybersecurity Protection System (NCPS) was partially, but not fully,  meeting its stated system objectives of detecting intrusions,  preventing intrusions, analyzing malicious content, and sharing  information. DHS also had not developed metrics for measuring the  performance of NCPS. We recommended that DHS take action to  enhance NCPS’s capabilities, among other things. DHS concurred  with our recommendations but has not yet fully implemented them.
Strengthening security over industry and public health data at  FDA. In August 2016, we reported that the Food and Drug  Administration (FDA) had a significant number of security control  weaknesses jeopardizing the confidentiality, integrity, and availability  of its information and systems. The agency did not fully or  consistently implement access controls, which are intended to  prevent, limit, and detect unauthorized access to computing  resources. Specifically, FDA did not always (1) adequately protect the  boundaries of its network, (2) consistently identify and authenticate  system users, (3) limit users’ access to only what was required to  perform their duties, (4) encrypt sensitive data, (5) consistently audit  and monitor system activity, and (6) review the physical security of its  facilities. We made 15 recommendations to FDA to fully implement its  agency-wide information security program. In a separate report with  limited distribution, we recommended that FDA take 166 specific  actions to resolve weaknesses in information security controls. FDA  concurred with our recommendations and stated it has begun  implementing many of them.
Improving security controls over high-impact systems. In May  2016, we reported that 18 federal agencies with high-impact systems  identified cyberattacks from “nations” as the most serious and most  frequently occurring threat to the security of their systems. These  agencies also noted that attacks delivered through e-mail were the  most serious and frequent. During fiscal year 2014, 11 of the 18  agencies reported 2,267 incidents affecting their high-impact systems,  with almost 500 of the incidents involving the installation of malicious  code. At least half of the 18 agencies reported that challenges in  recruiting and retaining staff with appropriate skills, rapidly changing  technologies, and the limited effectiveness of intrusion detection tools  impaired their capability to identify cyber threats to high-impact  systems to a great or moderate extent.
We also examined the security controls over eight high-impact systems at  four agencies and reported that although the agencies had implemented  numerous controls over the systems, they did not always fully implement  key elements of their information security programs including developing  security plans, assessing security controls, and remedying known  vulnerabilities. We recommended that OMB complete its plans and  practices for securing federal systems and that the National Aeronautics  and Space Administration, Nuclear Regulatory Commission, OPM, and  Department of Veterans Affairs fully implement key elements of their  information security programs. The agencies generally concurred with the  recommendations, with the exception of OPM. OPM did not concur with  our recommendation to re-evaluate security control assessments to  ensure they comprehensively test technical controls. We continue to  believe the recommendation is warranted.
Addressing cybersecurity for the nation’s critical infrastructures.
Improving Critical Infrastructure Cybersecurity in the critical  infrastructure sectors. For example, DHS established the Critical  Infrastructure Cyber Community Voluntary Program to encourage  entities to adopt the framework. However, DHS had not developed  metrics to measure the success of its activities and programs. In  addition, DHS and the General Services Administration (GSA) had not  determined whether to develop tailored guidance for implementing the  framework in government facilities sectors as other sector-specific  agencies had done for their respective sectors. DHS concurred with  our recommendation to develop metrics, but has not indicated that it  has taken action as of yet, and DHS and GSA concurred with our  recommendation and made a determination about whether to develop  sector-specific guidance.
In November 2015, we reported that the sector-specific agencies had  determined the significance of cyber risk to the nation’s critical  infrastructures and took actions to mitigate cyber risks and vulnerabilities  for their respective sectors. However, not all sector-specific agencies  had metrics to measure and report on the effectiveness of all their  activities to mitigate cyber risks or their sectors’ cybersecurity posture.  We recommended that agencies lacking metrics develop them and  determine how to overcome any challenges to reporting the results of  their activities to mitigate cyber risks. Four of the agencies explicitly  agreed with our recommendations and identified planned or on-going  efforts to implement performance metrics, but none have yet to provide  developed metrics or reports of outcomes.
Protecting the security and privacy of electronic health  information. In August 2016, we reported that guidance for securing  electronic health information issued by HHS did not address all key  controls called for by other federal cybersecurity guidance. In  addition, HHS oversight efforts did not always offer pertinent technical  guidance and did not always follow up on corrective actions when  investigative cases were closed. HHS generally concurred with the  five recommendations we made and stated it would take actions to  implement them. Information about actions taken to address the  recommendations had not been provided at the time of this report.
Ensuring privacy when face recognition systems are used. In  May 2016, we reported that the Federal Bureau of Investigation (FBI)  had not been timely in publishing and updating privacy documentation  for using face recognition technology. Publishing such documents in  a timely manner would better assure the public that the FBI is  evaluating risks to privacy when implementing systems. Also, the FBI  had taken limited steps to determine whether the face recognition  system it was using was sufficiently accurate. Of the six  recommendations we made, DOJ agreed with one, partially agreed  with two, and disagreed with three. Information about actions taken to  address the recommendations had not been provided at the time of  this report.
Protecting the privacy of users’ data on state-based  marketplaces. In March 2016, we reported on weaknesses in  technical controls for the “data hub” that CMS uses to exchange  information between its health insurance marketplace and external  partners. We also identified significant weaknesses in the controls in  place at three selected state-based marketplaces established to carry  out provisions of the Patient Protection and Affordable Care Act. We  recommended that CMS define procedures for overseeing the  security of state-based marketplaces and require continuous  monitoring of state marketplace controls. HHS concurred with our  recommendations. Information about actions taken to address the  recommendations had not been provided at the time of this report.
Improving consumer privacy protections. Major recommendations  of the administration’s 2012 report on consumer privacy had not yet  been implemented in 2016. The report included a framework as a  broad action plan intended to improve consumer privacy protection,  yet the administration’s recommendations to enact a consumer  privacy bill of rights into law and to establish a national standard for  data breach notification had not been implemented.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: Establishing a strategy for improving federal cybersecurity. In  October 2015, OMB issued the Cybersecurity Strategy and  Implementation Plan, which identified a series of action steps in  several key areas that are intended to improve federal information  security. As we had recommended in February 2013, the strategy  clearly assigns responsibilities to specific organizations and  individuals, sets specific dates for completing actions, and establishes  a mechanism for monitoring progress. Implementing the strategy  effectively and on time will likely improve the overall posture and  capabilities of the federal government to protect its information and  computer systems and networks.
Bolstering information security at federal agencies. Over the last  4 fiscal years, federal agencies have implemented over 330 of our  recommendations related to strengthening the security over sensitive  information and systems at the Census Bureau, Federal  Communications Commission, Internal Revenue Service, Federal  Deposit Insurance Corporation, Securities Exchange Commission,  CMS, and Federal Aviation Administration, among others. Security  vulnerabilities expose agency information to increased risk of  unauthorized access, disclosure, modification, and use. Addressing  vulnerabilities better assures the confidentiality, integrity, and  availability of the information agencies maintain and use for  conducting their missions.
Improving privacy protections for PII. While more needs to be  done, agencies have taken action in response to our  recommendations for specific steps to enhance the protection of PII.  For example, agencies have implemented 8 of the 23  recommendations we made in 2013 to improve their practices in  response to breaches of PII, improvements which can improve the  consistency and effectiveness of data breach response programs.  Likewise, HHS has implemented all 6 management recommendations  we made in 2014 to ensure that PII contained in systems supporting  the Healthcare.gov health insurance marketplace is properly protected  from potential privacy threats.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Gregory C.  Wilshusen at (202) 512-6244 or wilshuseng@gao.gov.
section_title: Related GAO Products
paragraphs: Federal Information Security: Actions Needed to Address Challenges.  GAO-16-885T. Washington, D.C.: September 19, 2016.
Electronic Health Information: HHS Needs to Strengthen Security and  Privacy Guidance and Oversight. GAO-16-771. Washington, D.C.: August  26, 2016.
Federal Chief Information Security Officers: Opportunities Exist to  Improve Roles and Address Challenges to Authority GAO-16-686.  Washington, D.C.: August 26, 2016.
Information Security: FDA Needs to Rectify Control Weaknesses That  Place Industry and Public Health Data at Risk. GAO-16-513. Washington,  D.C.: August 30, 2016.
Information Security: Agencies Need to Improve Controls over Selected  High-Impact Systems. GAO-16-501. Washington, D.C.: May 18, 2016.
Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but  DOT Needs to Define Its Role in Responding to a Real-world Attack.  GAO-16-350. Washington, D.C.: March 24, 2016.
SmartPhone Data: Information and Issues Regarding Surreptitious  Tracking Apps That Can Facilitate Stalking. GAO-16-317. Washington,  D.C.: April 21, 2016.
Information Security: DHS Needs to Enhance Capabilities, Improve  Planning, and Support Greater Adoption of Its National Cybersecurity  Protection System. GAO-16-294. Washington, D.C.: January 28, 2016.
Healthcare.gov: Actions Needed to Enhance Information Security and  Privacy Controls. GAO-16-265. Washington, D.C.: March 23, 2016.
Critical Infrastructure Protection: Sector-Specific Agencies Need to Better  Measure Cybersecurity Progress. GAO-16-79. Washington, D.C.:  November 19, 2015.
section_title: Strengthening Department of Homeland Security Management Functions
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of Homeland Security’s (DHS) top leadership, including  the Secretary and Deputy Secretary of Homeland Security, has  demonstrated exemplary commitment and support for addressing the  department’s management challenges. However, DHS needs to continue  implementing its Integrated Strategy for High Risk Management and  maintain engagement with us to show measurable, sustainable progress  in implementing corrective actions and achieving outcomes. In 2003, we  designated implementing and transforming DHS as high risk because  DHS had to transform 22 agencies—several with major management  challenges—into one department. Further, failure to effectively address  DHS’s management and mission risks could have serious consequences  for U.S. national and economic security. Given the significant effort  required to build and integrate a department as large and complex as  DHS, our initial high-risk designation addressed the department’s  implementation and transformation efforts to include associated  management and programmatic challenges. At that time, we reported that  the creation of DHS was an enormous undertaking that would take time to  achieve, and that successfully transforming large organizations, even  those undertaking less strenuous reorganizations, could take years to  implement. needs facing the nation after the department’s establishment, and the  challenges posed by creating, integrating, and transforming it.
As DHS continued to mature, and as we reported in our assessment of  DHS’s progress and challenges in the 10 years following 9/11, we found  that the department implemented key homeland security operations and  achieved important goals in many areas to create and strengthen a  foundation to reach its potential. For example, DHS developed strategic  and operational plans to guide its efforts—such as the National Response  Framework that outlines disaster response guiding principles—and  successfully hired, trained, and deployed workforces, including the federal  screening workforce to assume screening responsibilities at airports  nationwide.
However, we also found that more work remained for DHS to address  weaknesses in other areas of its operational and implementation efforts.  For example, we reported in 2011 that DHS had not yet determined how  to implement a biometric exit capability, had taken action to address a  small portion of the estimated overstay population in the United States,  and needed to strengthen efforts to assess national capabilities for all- hazards preparedness. We further reported that continuing weaknesses  in implementing and integrating DHS’s management functions continued  to affect the department’s implementation efforts.
2013 we narrowed the scope of the high-risk area and changed the name  from Implementing and Transforming the Department of Homeland  Security to Strengthening Department of Homeland Security Management  Functions to reflect this focus. In our 2015 high-risk update, we found that  DHS’s top leadership had continued to demonstrate exemplary  commitment to and support for addressing the department’s management  challenges and that DHS had made important progress in strengthening  its management functions. However, we also found that DHS continued to  face significant management challenges that hindered its ability to  achieve its missions and concluded that DHS needed to continue to  demonstrate sustainable, measureable progress in addressing key  challenges that remained within and across its management functions.
section_title: What GAO Found
paragraphs: DHS’s continued efforts to strengthen and integrate its acquisition, IT,  financial, and human capital management functions have resulted in the  department meeting three criteria for removal from the High-Risk List  (leadership commitment, a corrective action plan, and a framework to  monitor progress) and partially meeting the remaining two criteria  (capacity and demonstrated, sustained progress). DHS’s top leadership,  including the Secretary and Deputy Secretary of Homeland Security, has  demonstrated exemplary commitment and support for addressing the  department’s management challenges. For instance, the department’s  Deputy Secretary, Under Secretary for Management, and other senior  management officials have frequently met with us to discuss the  department’s plans and progress, which serves as a model for senior- level engagement and helps ensure a common understanding of the  remaining work needed to address our high-risk designation. Further,  DHS established a framework for monitoring its progress in its Integrated  Strategy for High Risk Management, in which it has included performance  measures to track the implementation of key management initiatives  since June 2012. In addition, since our 2015 high-risk update, DHS has  strengthened its monitoring efforts for financial system modernization  programs that are key to effectively supporting the department’s financial  management operations, resulting in DHS meeting the monitoring criteria  for the first time. which we identified and DHS agreed are critical to addressing the  challenges within the department’s management areas, and to integrating  those functions across the department. DHS has continued to make  important progress across all of its management functions, fully  addressing 13 of these outcomes, 9 of which it has sustained as fully  implemented for at least 2 years. For example, DHS fully addressed one  outcome for the first time by demonstrating improvement in human capital  management by linking workforce planning efforts to strategic and  program planning efforts.
DHS also sustained full implementation of two other outcomes by  obtaining a clean audit opinion on its financial statements for 4  consecutive fiscal years. Further, DHS has mostly addressed an  additional eight outcomes, meaning that a small amount of work remains  to fully address them. Considerable work remains, however, in several  areas for DHS to fully achieve the remaining 17 outcomes and thereby  strengthen its management functions. Addressing some of these  outcomes, such as those pertaining to improving employee morale and  modernizing the department’s financial management systems, are  significant undertakings that will likely require multiyear efforts. DHS  needs to make additional progress identifying and allocating resources in  certain areas to sufficiently demonstrate that it has the capacity (that is,  the people and resources) to achieve and sustain all 30 outcomes, as  well as demonstrate additional sustainable and measurable progress in  addressing key challenges that remain within and across these  management functions.
2015, the DHS Accountability Act of 2016, and the DHS Reform and  Improvement Act.
House Report 114-215, which accompanied H.R. 3128 (DHS  appropriations bill for fiscal year 2016) and later became effective  under the Consolidated Appropriations Act, 2016, includes mandates  related to DHS’s financial management system modernization  projects, which relate to three high-risk financial management  outcomes. Specifically, the committee directed GAO to assess the  risks of DHS utilizing the Department of Interior’s Business Center  (IBC), whether IBC is capable of expanding its services to additional  federal agencies, and a comparison of the services and capabilities of  federal and commercial shared service providers. In addition, the  committee directed the DHS Office of the Chief Financial Officer to  update the lifecycle cost estimate to reflect all contract awards and  projected overall costs, including those for every component that  plans to migrate to a federal shared service provider.
The Border Patrol Agent Pay Reform Act of 2014, enacted on  December 18, 2014, includes a mandate related to cybersecurity  workforce assessments, which relates to one human capital  management outcome. Specifically, DHS must identify all  cybersecurity workforce positions and identify positions and areas of  critical need.
Congress also held a number of oversight hearings related to addressing  DHS’s management challenges:
U.S. Senate, Committee on Homeland Security and Governmental  Affairs Hearing: DHS Management and Acquisition Reform. March 16,  2016.
U.S. House of Representatives, Committee on Homeland Security,  Subcommittee on Oversight and Management Efficiency Hearing:  Assessing DHS’s Performance: Watchdog Recommendations to  Improve Homeland Security. February 26, 2015.
U.S. House of Representatives, Committee on Homeland Security  Hearing: Preventing Waste, Fraud, Abuse and Mismanagement in  Homeland Security – A GAO High-Risk List Review. May 7, 2014.
U.S. Senate, Committee on Homeland Security and Governmental  Affairs Hearing: The Department of Homeland Security at 10 Years: A  Progress Report on Management. March 21, 2013.
section_title: What Remains to Be Done
paragraphs: In the coming years, DHS needs to continue implementing its Integrated  Strategy for High Risk Management and maintain engagement with us to  show measurable, sustainable progress in implementing corrective  actions and achieving outcomes. In doing so, it will be important for DHS  to maintain its current level of top leadership support and sustained  commitment to ensure continued progress in executing its corrective  actions through completion;  continue to identify the people and resources necessary to make  progress towards achieving outcomes, work to mitigate shortfalls and  prioritize initiatives, as needed, and communicate to senior leadership  critical resource gaps;  continue to implement its plan for addressing this high-risk area and  periodically provide assessments of its progress to us and Congress;  closely track and independently validate the effectiveness and  sustainability of its corrective actions, and make midcourse  adjustments as needed; and make continued progress in achieving the 17 outcomes it has not fully  addressed and demonstrate that systems, personnel, and policies are  in place to ensure that progress can be sustained over time.
We will continue to monitor DHS’s efforts in this high-risk area to  determine if the outcomes are achieved and sustained over the long term.  Further, in order to address the outcomes, DHS must implement our prior  recommendations listed below.
DHS should address employee morale problems through  comprehensively examining root causes and establishing clear  metrics of success within DHS and its components’ action plans.
DHS should ensure that its Human Resources IT Program (HRIT), of  which the Performance and Learning Management System is the  primary active project, receives necessary oversight and attention by  ensuring the HRIT Executive Steering Committee is consistently  involved. DHS should also address HRIT’s poor progress and  ineffective management by: (1) updating and maintaining a schedule  estimate for when DHS plans to implement each of the strategic  improvement opportunities; (2) developing a complete life-cycle cost  estimate for the implementation of HRIT; (3) documenting and  tracking all costs, including components’ costs, associated with HRIT;  and (4) updating and maintaining the department’s human resources  system inventory, among other things.
To more accurately communicate DHS’s funding plans for U.S. Coast  Guard’s major acquisitions programs, DHS should ensure the funding  plans presented to Congress are comprehensive and clearly account  for all operations and maintenance funding DHS plans to allocate to  each of the programs.
DHS should enhance its leadership’s ongoing efforts to improve the  affordability of the department’s major acquisitions portfolio by  requiring components to submit funding certification memorandums  for all major acquisition programs that have not been reviewed at an  Acquisition Decision Event; and convening Acquisition Review Boards  to discuss affordability and make tradeoffs between cost, schedule,  and performance, as necessary. In addition, DHS should ensure that  the Fiscal Year 2017 Future Years Homeland Security Program report  reflects the results of any tradeoffs stemming from the acquisition  affordability reviews; and require components to establish formal,  repeatable processes for addressing major acquisition affordability  issues.
DHS’s Chief Information Officer should use accurate and reliable  information, such as operational assessments of the new architecture  and cost and schedule parameters approved by the Under Secretary  of Management, to help ensure that assessments prepared by the  Office of the Chief Information Officer in support of the department’s  updates to the federal IT Dashboard more fully reflect the current  status of the Transformation Program.
DHS should continue to work to address its IT mission critical skills  gaps, such as those related to its cybersecurity workforce. Further,  DHS needs to remediate the material weakness in information  security controls reported by its financial statement auditor in fiscal  year 2016 by effectively addressing weaknesses in controls related to  access, configuration management, and segregation of duties.
DHS should ensure consistent, effective oversight of DHS’s  acquisition programs and make the Comprehensive Acquisition Status  Report (CASR) more useful by adjusting CASR to enable DHS to hold  programs accountable for maintaining their cost, schedule, and  performance data. For example, CASR could report an individual  rating for each program’s cost, schedule, and technical risks, and the  level at which the program’s life-cycle cost estimate was approved.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: progress on outstanding actions that are to be accomplished related to  the high-risk area. According to DHS officials, these meetings provide an  opportunity to maintain leadership support and accountability for making  progress toward resolving management challenges facing the  department. It will be important for DHS to maintain its current level of top  leadership support and commitment to ensure continued progress in  successfully completing its corrective actions.
section_title: Capacity
paragraphs: DHS has taken important actions to identify and put in place the people  and resources needed to resolve departmental management risks;  however, DHS needs to make additional progress identifying and  allocating resources in certain areas to sufficiently demonstrate that it has  the capacity to achieve and sustain corrective actions and outcomes. In  particular, in a September 2010 letter to DHS, we identified and DHS  agreed to achieve 31 outcomes that are critical to addressing challenges  within the department’s management areas and in integrating those  functions across the department. In March 2014, we updated these  outcomes in collaboration with DHS to reduce overlap and ensure their  continued relevance and appropriateness. These updates resulted in a  reduction from 31 to 30 total outcomes. Toward achieving the outcomes,  DHS has issued 10 updated versions of its initial January 2011 Integrated  Strategy for High Risk Management, most recently in August 2016.
Prior to the January 2016 Integrated Strategy for High Risk Management,  DHS did not identify sufficient resources in a number of areas that could  undermine DHS’s efforts to strengthen its management functions. For  example, in June 2015, DHS identified that it had resources and  personnel needed to implement 8 of the 11 key management initiatives it  was undertaking to achieve the 30 outcomes, but did not identify sufficient  resources for the 3 remaining initiatives. In addition, our prior work has  identified specific capacity gaps that could undermine achievement of  management outcomes. the Unity of Effort Integration within the Office of Policy to oversee Unity  of Effort implementation.
However, we found that DHS needs to make additional progress  identifying and allocating resources in certain areas.
Acquisition management. With respect to acquisition, DHS’s 2016  staffing assessments focused on identifying critical acquisition-related  position gaps rather than all major program acquisition-related  positions; consequently, some programs were assessed as being fully  or almost fully staffed for critical positions despite significant staffing  shortfalls in the overall program. This increased focus on critical gaps  may limit DHS’s insight into the size and nature of acquisition-related  staffing shortfalls, making it difficult for DHS to develop a plan or  process to address these vacancies. In December 2016, DHS  updated its staffing assessment guidance to refocus the assessment  process on all major program acquisition-related positions. However,  DHS plans to pilot the implementation of this policy update  incrementally during 2017, and the timing of full implementation is not  yet known.
Emergency Management Agency and U.S. Immigration and Customs  Enforcement modernization projects until April 2017.
DHS has taken actions to address some of its previous capacity  shortcomings and ensure that the department has the people and  resources necessary to resolve risk. However, additional progress is  needed to ensure that DHS has sufficient capacity not only to resolve  risks, but to fully achieve and sustain the 30 outcomes. As a result, we  assess DHS having partially met the capacity criterion. DHS needs to  continue to comprehensively identify the people and resources necessary  to make progress towards achieving all 30 outcomes; work to mitigate  shortfalls and prioritize initiatives, as needed; and communicate to senior  leadership about critical resource gaps requiring resolution.
section_title: Action Plan
paragraphs: DHS previously established a plan for addressing this high-risk area as  discussed above, and has continued to take critical, actionable steps  towards addressing challenges faced within the department. As with prior  iterations, DHS included in its most recent August 2016 version of its  Integrated Strategy for High Risk Management key management  initiatives and related corrective actions for addressing each of the  management challenges and related outcomes we identified. For  example, the August 2016 updated version of its strategy includes  information on actions DHS is taking for an initiative focused on financial  systems modernization and an initiative focused on IT human capital  management, which support various outcomes. DHS’s strategy and  approach, if effectively implemented and sustained, provides a path for  DHS to be removed from our High-Risk List.
section_title: Monitoring
paragraphs: strategy. For example, to monitor progress made towards strengthening  the DHS acquisition process by improving the acquisition workforce, DHS  management continues to monitor the percent of its nine acquisition  certification policies completed—policies related to program  management, cost estimating, and contracting among others—and the  percent of required acquisition certification training developed.
However, in our 2015 high-risk update, we found that DHS could  strengthen its financial management monitoring efforts and thus  concluded that the department had partially met the criterion for  establishing a framework to monitor progress. In particular, according to  DHS officials, as of November 2014, the department was establishing a  monitoring program that would include assessing whether the projects  modernizing key components of their financial management systems  were following industry best practices and meeting users’ needs.  Effectively implementing these modernization projects is important  because until they are complete, the department’s systems will not  effectively support financial management operations. Following the 2015  high-risk update, DHS entered into a contract for independent verification  and validation services that should help ensure that financial  management systems modernization projects meet key requirements.  Moving forward, DHS will need to continue to closely track and  independently validate the effectiveness and sustainability of its corrective  actions, and make midcourse adjustments as needed.
section_title: Demonstrated Progress
paragraphs: DHS has continued to make important progress in strengthening its  management functions, but needs to demonstrate additional sustainable  and measurable progress in addressing key challenges that remain within  and across these functions. DHS has either fully or mostly addressed 21  of the 30 outcomes, demonstrating the department’s progress in  strengthening its management functions, and partially addressed or  initiated the remaining 9 outcomes. For example, DHS established the  Joint Requirements Council, an acquisition oversight body, through which  it has created a process for validating capability and requirements  documents, among other things. DHS has also worked to improve the  management and oversight of its IT investments by establishing and  implementing a tiered governance and portfolio management structure. In  addition, DHS obtained a clean audit opinion on its financial statements  for 4 consecutive fiscal years—2013, 2014, 2015, and 2016. that hinder the department’s ability to meet its missions. For this update,  we determined that DHS has partially addressed 6 and initiated 3 of the  30 outcomes. For example, while DHS has initiated acquisition program  health assessments to demonstrate that major acquisition programs are  on track to achieve their cost, schedule, and capability goals, it will take  time to demonstrate that these initiatives will improve program  performance. In addition, DHS does not have modernized financial  management systems, which affects its ability to have ready access to  reliable information for informed decision making. Further, it is important  that DHS retain and attract the talent required to complete its work—a  challenge the department continues to face due to employee morale  issues. Addressing these and other management challenges will be a  significant undertaking, but will be critical to mitigate the risks that  management weaknesses pose to mission accomplishment.
Achieving sustained progress across the outcomes, in turn, requires  leadership commitment, effective corrective action planning, adequate  capacity (that is, the people and other resources), and monitoring the  effectiveness and sustainability of supporting initiatives. Table 7  summarizes DHS’s progress in addressing the 30 key outcomes and is  followed by selected examples.
Acquisition management. DHS has fully addressed two of the five  acquisition management outcomes, mostly addressed two outcomes,  and partially addressed the remaining outcome. For example, DHS  has validated the required acquisition documentation for all of its  major acquisition programs and plans to continue to ensure that all  major acquisition programs have approved acquisition program  baselines, and to use a pre-Acquisition Review Board checklist to  confirm that programs have all required documentation for Acquisition  Decision Events. In addition, DHS has taken a number of recent  actions to establish and operate the Joint Requirements Council.  These actions include (1) establishing a process for validating  capability and requirements documents, and (2) piloting a joint  assessment of requirements process that is intended to eventually  inform the department’s budget decisions.
Further, DHS continues to assess and address whether appropriate  numbers of trained acquisition personnel are in place at the  department and component levels. Finally, we reported in March 2016  that only 11 of the 25 major DHS acquisition programs we reviewed  remained on track to meet their current schedule and cost goals.  DHS has initiated acquisition program health assessments to report to  senior DHS management the status of major acquisition programs  toward achieving cost, schedule, and capability goals; however, it will  take time to demonstrate that such initiatives are improving program  performance. of DHS’s IT workforce, as well as hiring, training, and managing staff  with those new skill sets.
Enforcement financial management systems before DHS will be in a  position to implement modernized solutions for these components and  their customers.
For example, discovery phase activities to determine the feasibility of  implementing, deploying, and maintaining the chosen solution are not  expected to be completed for these two projects until April 2017. Such  information is essential for determining the implementation schedule  and finalizing cost estimates that are needed prior to approving the  projects for implementation. Further, without sound internal controls  and systems, DHS faces long-term challenges in sustaining a clean  audit opinion on its financial statements and in obtaining and  sustaining a clean opinion on its internal controls over financial  reporting, which are needed to ensure that its financial management  systems generate reliable, useful, and timely information for day-to- day decision making as a routine business operation.
Human capital management. DHS has fully addressed three human  capital management outcomes, mostly addressed three, and partially  addressed the remaining one. For example, the Secretary of  Homeland Security signed a human capital strategic plan in 2011— which was revised and reissued in 2014—that DHS has since made  sustained progress in implementing, thereby fully addressing one  outcome. In addition, DHS successfully demonstrated the ability to  conduct structured workforce planning for the majority of its priority  mission critical occupations at the department in fiscal year 2015, and  for all mission critical occupations in fiscal year 2016. To support this  planning, DHS issued its Workforce Planning Guide in 2015, which  enabled DHS components to apply a consistent and departmentally- approved methodology, including the use of standardized tools and  templates. DHS also published and implemented a department-wide  Employee Engagement Action Plan, which DHS’s components used  to develop tailored action plans for their own employee engagement  and outreach. results-oriented performance culture, talent management, and job  satisfaction) from 2008 through 2015. DHS has developed plans for  addressing its employee satisfaction problems and improved scores in  all four areas in 2016, but as we previously recommended, in  September 2012, DHS needs to continue to improve its root-cause  analysis efforts related to these plans. DHS also needs to continue  strengthening its learning management capabilities. Specifically, in  February 2016, we reported that DHS had initiated the Human  Resources Information Technology (HRIT) investment in 2003 to  address issues presented by its human resource environment. designed to allow the department to operate in a more integrated  fashion.
Further, in support of this effort, in August 2015, the Under Secretary  for Management identified four integrated priority areas to bring focus  to strengthening integration among the department’s management  functions. According to DHS’s August 2016 updated version of its  strategy, these priorities—which include, for example, strengthening  resource allocation and reporting reliability and developing and  deploying secure technology solutions—each include detailed goals,  objectives, and measurable action plans that are monitored at monthly  leadership meetings led by senior DHS officials, including the Under  Secretary for Management. Accomplishments DHS officials attribute  to the Unity of Effort initiative and integrated priorities initiatives  include the following, among others:
DHS’s Office of Program Accountability and Risk Management  developed and implemented a policy directive to monitor and track  critical staffing gaps for major acquisition programs to ensure that  such gaps are identified and remediated in a timely manner.
DHS Science and Technology Directorate established Integrated  Product Teams to better link the department’s research and  development investments with the department’s operational  needs.
DHS strengthened its strategy, planning, programming, budgeting,  execution, and acquisition processes by improving existing  structures and creating new ones where needed to build additional  organizational capability. DHS has institutionalized these reforms  by issuing a range of departmental management directives and  instructions.
However, given that these main management integration initiatives  are in the early stages of implementation and contingent upon DHS  sustaining implementation plans and efforts over a period of years, it  is too early to assess their effects. To achieve this outcome, DHS  needs to continue to demonstrate sustainable progress integrating its  management functions within and across the department and its  components, as well as fully address the other 17 outcomes it has not  yet achieved.
section_title: Benefits Achieved By Implementing Our Recommendations
paragraphs: In 2016, we recommended, among other things, that DHS (1) update  the HRIT executive steering committee charter to establish the  frequency with which HRIT executive steering committee meetings  are to be held, (2) establish time frames for re-evaluating the strategic  improvement opportunities and associated projects in the Human  Capital Segment Architecture Blueprint and determining how to move  forward with HRIT, and (3) evaluate the strategic improvement  opportunities and projects within the Human Capital Segment  Architecture Blueprint to determine whether they and the goals of the  blueprint are still valid and reflect DHS’s HRIT priorities going forward,  and update the blueprint accordingly. We reported that HRIT’s limited  progress was due in part to lack of involvement of its executive  steering committee and, as a result, key governance activities, such  as approval of HRIT’s operational plan, were not completed. We  concluded that until DHS takes actions to reevaluate and manage this  neglected investment, it was unknown when its human capital  weaknesses would be addressed. In response, in 2016, DHS  addressed these three recommendations. As a result, DHS should  have better assurance that the HRIT executive steering committee will  meet regularly and carry out its responsibility to provide oversight and  guidance to the HRIT investment. Further, DHS is better positioned to  update the blueprint and address inefficiencies in its human resources  environment, make informed resource decisions on the  implementation of the strategic improvement opportunities, and  address inefficiencies in its human resources environment.
In 2015, we recommended that DHS re-baseline cost, schedule, and  performance expectations for the remainder of the U.S. Citizenship  and Immigration Services Transformation Program. We reported that  the Transformation Program had an increased cost of $1 billion and  delay of over 4 years from its initial July 2011 baseline, mostly due to  changes in its acquisition strategy to address various technical  challenges. These changes significantly delayed the program’s  planned schedule, which in turn had adverse effects on when the  program expects to achieve cost savings, operational efficiencies, and  other benefits. In response, in 2015, DHS addressed this  recommendation, and the re-baseline helps ensure that progress  made by the program can be monitored against established and  approved parameters.
Secretary for Management (USM) to develop written guidance to  clarify roles and responsibilities of PARM and the Office of the Chief  Information Officer Enterprise Business Management Office for  conducting oversight of major acquisition programs; (3) directed the  USM to produce operations and maintenance cost estimates for  programs in sustainment and establish responsibility for tracking  sustainment programs’ adherence to those estimates; and (4) directed  the USM to determine mechanisms to hold programs accountable for  entering data in the Next Generation Periodic Reporting System  consistently and accurately, and to hold Component Acquisition  Executives accountable for validating the information and evaluate the  root causes of why programs are not using the Next Generation  Periodic Reporting System as intended. By PARM issuing a handbook  that provides oversight roles and responsibilities and other guidance  to PARM component leads, and by the USM and Acting Deputy USM  issuing multiple memorandums regarding the clarification of  acquisition oversight roles and responsibilities, the verification and  certification of the data in designated fields, the verification and  certification of the data on a biannual basis, and the requirement of  root cause analyses, DHS is helping ensure consistent and effective  oversight of its acquisition programs.
In 2015, we recommended that DHS should ensure the Director of  Operational Test and Evaluation explicitly address all of the relevant  key performance parameters in each letter of assessment appraising  operational test results of DHS’s major acquisitions programs. As a  result, in 2015, DHS finalized an internal office procedure that  established that each letter of assessment should provide detailed  analysis indicating whether or not the key performance parameters  were met.
In 2014, we recommended that DHS clearly identify Leader  Development Program goals and ensure program performance  measures include key attributes, such as linkage, clarity, and  measurable targets. As a result, in December 2014, Leader  Development Program Office officials provided us with updated  documentation on the program’s assessment approach. This  documentation established 10 program goals. It also explained how  the program’s performance measures link to the 10 program goals  and to department-wide goals. Further, the documentation established  targets for each performance measure and provided clarification for  ambiguous measures. These enhancements to the Leader  Development Program assessment approach should help produce  actionable information for the program’s management to use in  identifying the need for, and making, program improvements.
In 2013, we recommended that DHS should direct the Office of the  Chief Human Capital Officer (OCHCO) to require all components to  provide recruiting cost information in a consistent manner to allow  better tracking of overall recruiting costs, and use this information to  assess the extent to which recruiting costs are being reduced by  components as a result of increased coordination and leveraging  resources as called for in the Coordinated Recruiting and Outreach  Strategy. In June 2015, OCHCO provided us with examples of  recruiting cost information that it has begun tracking in response to  this recommendation. The data provided demonstrate that OCHCO  has begun to better track component-level recruiting expenditures in a  way that illustrates coordination among components, and could be  used to track reduction in costs stemming from this coordination.
In 2015, in response to one of our recommendations, DHS developed  a financial systems modernization transition plan that included the  tasks, milestones, and time frames for implementing new systems,  and establishing the optimal sequencing of activities. If effectively  implemented, the transition plan will help DHS increase its ability to  effectively manage its financial management system modernization  efforts. Also, in 2015, DHS developed a financial systems  modernization transition plan and an updated architecture roadmap  that collectively describe a target state architecture for DHS financial  management segment in business terms (e.g., business functions and  business processes) and technical terms (e.g., account classification  standards data model, shared services, and federated solution  approach). These DHS actions have helped improve DHS’s ability to  ensure the effectiveness of financial management system investment  decisions.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Rebecca  Gambler (202) 512-8777 or gamblerr@gao.gov.
section_title: Related GAO Products
paragraphs: Homeland Security Acquisitions: Joint Requirements Council’s Initial  Approach Is Generally Sound and It Is Developing a Process to Inform  Investment Priorities. GAO-17-171. Washington, D.C.: October 24, 2016.
Homeland Security Acquisitions: DHS Has Strengthened Management,  but Execution and Affordability Concerns Endure. GAO-16-338SP.  Washington, D.C.: March 31, 2016.
Department of Homeland Security: Progress Made, but Work Remains in  Strengthening Acquisition and Other Management Functions.  GAO-16-507T. Washington, D.C.: March 16, 2016.
Homeland Security: Oversight of Neglected Human Resources  Information Technology Investment Is Needed. GAO-16-253.  Washington, D.C.: February 11, 2016.
Immigration Benefits System: Better Informed Decision Making Needed  on Transformation Program. GAO-15-415. Washington, D.C.: May 18,  2015.
Homeland Security Acquisitions: DHS Should Better Define Oversight  Roles and Improve Program Reporting to Congress. GAO-15-292.  Washington, D.C.: March 12, 2015.
Department of Homeland Security: Progress Made, but More Work  Remains in Strengthening Management Functions. GAO-15-388T.  Washington, D.C.: February 26, 2015.
DHS Training: Improved Documentation, Resource Tracking, and  Performance Measurement Could Strengthen Efforts. GAO-14-688.  Washington, D.C.: September 10, 2014.
DHS Financial Management: Continued Effort Needed to Address  Internal Control and System Challenges. GAO-14-106T. Washington,  D.C.: November 15, 2013.
DHS Financial Management: Additional Efforts Needed to Resolve  Deficiencies in Internal Controls and Financial Management Systems.  GAO-13-561. Washington, D.C.: September 30, 2013.
section_title: Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interests
subsections: section_title: Why Area Is High Risk
paragraphs: Technological superiority is critical to U.S. military strategy. Thus, the  Department of Defense (DOD) spends billions of dollars each year to  develop and acquire sophisticated technologies to provide an advantage  for the warfighter during combat or other missions. Many of these  technologies are also sold or transferred to foreign partners to promote  U.S. economic, foreign policy, and national security interests. These  technologies can also be acquired through foreign investment in the U.S.  companies that develop or manufacture them. In addition, they are  targets for unauthorized transfer, such as theft, espionage, reverse  engineering, and illegal export.
To identify and protect technologies critical to U.S. interests, the U.S.  government has a portfolio of programs. These include export controls— those developed to regulate exports and ensure that items and  information are transferred in a manner consistent with U.S. interests—as  well as a number of non-export control programs, including the Foreign  Military Sales (FMS) program, anti-tamper measures, and the National  Industrial Security Program, which oversees government contractors  handling classified information, including that associated with critical  technologies. These programs and activities are administered by multiple  federal agencies with various interests, including DOD and the  Departments of Commerce, Homeland Security, Justice, State, and the  Treasury. We designated this area as high risk in 2007 because these  programs, established decades ago, were ill-equipped to address the  evolving challenges of balancing national security concerns and  economic interests. While these agencies are making progress in  addressing challenges identified by our work, we believe that additional  leadership and coordination of programs and activities in the non-export  control programs, among other things, is needed to identify strategic  reforms that will help to advance U.S. interests.
section_title: What GAO Found
paragraphs: Since this area was added to the High-Risk List in 2007, our body of work  in this area has identified progress in the programs designed to protect  technologies critical to U.S. national security interests, but government- wide challenges remain, including the need to adopt a more consistent  leadership approach, improve coordination among programs, address  weaknesses in individual programs, and implement export control reform.
Hence, we continue to consider each of our high-risk criteria in this area  to be partially met:
Leadership commitment to addressing challenges has been evident in  some areas of the critical technologies portfolio, particularly with  respect to the Export Control Reform initiative. However, as we  reported in our 2015 update, greater collaboration among the critical  technologies programs not directly related to export controls— including the FMS program, the anti-tamper program, and the  National Industrial Security Program—could ensure that lead and  stakeholder agencies take a more consistent approach to meeting  program goals.
The capacity for addressing challenges and implementing reforms has  improved for some programs. However, many efforts remain limited to  individual programs or activities within the overall program portfolio,  and there are areas where broader coordination could be beneficial,  such as determining an appropriate technical reference to inform key  decisions relating to critical technologies.
Action plans to guide improvements are in place for some programs;  however, additional steps have yet to be taken to develop and  implement action plans that will address ongoing challenges, such as  administering the anti-tamper program.
Monitoring of efforts to meet key challenges also has improved at  some programs. DOD and State have implemented some, but not all,  of our past recommendations on developing performance measures  and monitoring program outcomes.
section_title: What Remains to Be Done
paragraphs: The need for action remains both at the individual program level and the  portfolio level. We have made a number of recommendations to agencies  aimed at improving coordination among the programs that are intended to  protect technologies critical to U.S. national security. We believe that  implementing these recommendations could result in significant  improvements. Our body of work shows that challenges remain.
subsections: section_title: Leadership Commitment
paragraphs: To address existing challenges, we have previously reported that the  executive branch and Congress should consider reevaluating the wider  portfolio of programs protecting critical technologies, including assessing  the prospects for achieving collaboration across separate but related  programs designed to protect critical technologies. Executive branch  leadership has been committed to reforming the area of export controls,  an important step forward. But leadership commitment is less evident in  the critical technologies programs that fall outside the scope of export  control reform.
section_title: Capacity
paragraphs: Individual agencies need to continue to implement our recommendations  to address weaknesses in their respective programs. Doing so could  increase these programs’ capacity for implementing reforms. For  example, the export control agencies should work to develop standard  operating procedures for the Export Enforcement Coordination Center—a  primary forum within the federal government to coordinate export  enforcement efforts and identify and resolve conflicts—to facilitate data  sharing.
section_title: Action Plan
paragraphs: Developing a concrete action plan for achieving collaboration across  separate but related programs designed to protect critical technologies  remains important. Executive branch leadership has developed a  thorough action plan for export control reform. But formal and integrated  planning is less evident in the critical technologies programs that fall  outside the scope of export control reform.
section_title: Monitoring
paragraphs: Individual agencies need to continue to implement our recommendations  to address weaknesses in their respective programs. Doing so could  increase these programs’ ability to monitor progress. For example, DOD  should take additional actions to enhance its ability to provide security  assistance through, for example, its FMS program by establishing  performance measures for all phases of the security assistance process.
section_title: Demonstrated Progress
paragraphs: users’ needs for a technical reference, whether it be the U.S. Munitions  List or the Industrial Base Technologies List, other alternatives being  used, or some combination thereof, and ensure that resources are  coordinated and efficiently devoted to sustain the approach chosen.  Since our recommendation, DOD officials said the department has moved  toward using the U.S. Munitions List. However, DOD has not changed its  policy requiring use of the Militarily Critical Technologies List (MCTL) as it  has not yet received relief from that statutory requirement.
At the portfolio level, implementing export control reforms demonstrates  leadership commitment, but the agencies involved in export controls must  continue to implement reforms to achieve the goals set to protect U.S.  interests. For non-export control reform, increased collaboration between  DOD’s offices responsible for administering the FMS program and  approving exports represents an important step forward in coordinating  the activities of selected programs. However, leadership still must decide,  among other things, how to address protection of critical technologies at a  more strategic level. In particular, in February 2015 we recommended  that, to ensure a consistent and more collaborative approach to protecting  critical technologies, the Secretaries of Commerce, Defense, Homeland  Security, State, and the Treasury as well as the Attorney General of the  United States—who have lead and stakeholder responsibilities for the  programs within the critical technologies portfolio—should take steps to  promote and strengthen collaboration mechanisms among their  respective programs while they implement and assess ongoing  initiatives. These steps need not be onerous; for example, they could  include conducting an annual meeting to discuss their programs,  including the technologies they are protecting, their programs’ intent, and  any new developments or changes planned for their programs, as well as  defining consistent critical technologies terminology and sharing important  updates.
section_title: Congressional Actions Needed
paragraphs: Export control reform is being implemented in three phases. Phases I and  II reconcile various definitions, regulations, and policies for export  controls. As of August 2015, Phase I was finished. Phase II is nearing  completion. This is all building toward Phase III, which will result in  implementation of major changes supported by these reconciliations by  consolidating export control efforts in four reform areas: creating a single,  consolidated control list; designating a single licensing agency;  designating a primary export enforcement coordination agency; and  establishing a unified information technology system. We reported in  February 2015 that significant collaboration by the participating agencies  is essential to the Phase III consolidation efforts. In that same report, we  noted that in order for full implementation of this third and final phase to  occur, congressional action is needed to designate a single licensing  agency and a primary export enforcement coordination agency. For  example, since there are currently separate statutory bases for State and  Commerce to review and issue export licenses, legislation will be required  to consolidate the current system into a single licensing agency.
section_title: Additional Details on What GAO Found
subsections: section_title: Ensuring Protection of Critical Technologies - Export Controls
paragraphs: Some of the issues identified through past reports on export controls  include poor interagency coordination, inefficiencies in the license  application process, and a lack of systematic assessments.
subsections: section_title: Leadership Commitment
paragraphs: This criterion has been met. The Obama administration directed an  interagency review of the U.S. export control system that resulted in the  2010 establishment of an Export Control Reform initiative, which has  continued to demonstrate strong leadership commitment, both from that  administration and from leaders at the key federal agencies. This initiative  is under way and actions toward the four key goals of reform—creation of  a single, consolidated control list, a single licensing agency, a primary  export enforcement coordination agency, and a unified information  technology system—have been implemented using a phased approach,  which we have concluded has the potential to address weaknesses in the  U.S. export control system.
section_title: Capacity
paragraphs: the three key export control agencies are using this single system, and  other agencies, such as Treasury, are working toward joining this system.
However, other efforts under this criterion have yet to be completed.  Fifteen federal agencies have come together through the establishment of  the Export Enforcement Coordination Center (the Center), which,  according to statistics the Center Director provided to us, has heightened  awareness by exchanging investigation-related information. The Center  had made good progress in addressing our February 2015 findings that  export enforcement agencies had poor interagency coordination, but  remaining efforts have stalled. For example, the Center has not yet  finalized procedures for coordination between the investigative export  control enforcement and intelligence communities. Center officials cited  understaffing of interagency personnel as a key barrier, and, in August  2016, Commerce assigned new staff to the Center to assist in this  process.
section_title: Action Plan
paragraphs: This criterion has been met. The export control reform efforts lay out a  clear plan of action—consisting of a three-phase framework of agency  actions to implement reforms to export control lists, licensing,  enforcement, and information technology—which has the potential to  improve the efficiency and effectiveness of the export control process.
section_title: Monitoring
paragraphs: This criterion has been partially met. We made four recommendations in  March 2012 that departments with responsibilities for export control  enforcement take steps to more effectively monitor resources spent on  export control enforcement activities and develop and implement metrics  for monitoring their effectiveness. As of 2016, one of these  recommendations has been implemented by Homeland Security, but not  Justice; a second has been implemented by both Homeland Security and  Commerce; a third has not been implemented by Homeland Security; and  a fourth has been implemented by both Commerce and State.
section_title: Demonstrated Progress
paragraphs: remain under State control or move to Commerce control. The goal is to  move certain less sensitive items from State’s jurisdiction to Commerce’s,  while leaving high-risk and high-priority items on State’s list. However,  other key steps, such as implementation of the Center’s procedures for  coordination with the intelligence communities, remain incomplete.
section_title: Ensuring Protection of Critical Technologies - Non-Export Controls
subsections: section_title: Leadership Commitment
paragraphs: for ensuring consistent protection of critical technologies across weapon  systems and their respective export variants.
The Defense Security Service, which is responsible for administering the  National Industrial Security Program and overseeing the protection of  classified information at contractor facilities, has also made leadership  progress in its technology protection role by beginning implementation of  an enterprise-wide risk management approach that it expects to allow  more effective oversight of technology and classified information. In 2016,  agency officials reported that this approach has improved the overall  oversight of all contractors by increasing visibility of security management  issues across the agency’s individual directorates.
section_title: Capacity
paragraphs: This criterion has been partially met. In our 2015 update, we reported that  DOD had initiated a plan and instituted the capacity for oversight and  collaboration on those programs related to security cooperation and  disclosure, and, while DOD has continued to expand these capacities,  they remain fragmented across the portfolio of programs. For example,  based on direction in the National Defense Authorization Act for Fiscal  Year 2011, DOD created a Defense Exportability Features Pilot Program  to reduce program costs and facilitate export sales for U.S. and foreign  customers while balancing program protection needs. Since it was  created, this pilot program has funded a limited number of designated  systems to conduct initial feasibility studies, follow-on studies, and design  efforts relating to protection of critical information on systems that may be  candidates for export. Our ongoing work suggests that the pilot program  has achieved some significant initial successes in helping assure greater  value and effectiveness in preparing weapon programs for export. DOD  officials also reported improved collaboration between agencies involved  in the protection of critical technologies. Specifically, DOD officials  responsible for administering FMS and export license requests,  respectively, highlighted areas of increased collaboration, including joint  briefings to Congress and temporary staff details across their  organizations.
section_title: Action Plan
paragraphs: significant work remains to be done in this area. Specifically, DOD  officials said they do not have a strategic plan for administering the anti- tamper program, and officials also noted that, although technology  protection is a strategic priority within the department, it was not included  in a recent presidential transition strategy in terms of performance and  tracking measures.
section_title: Monitoring
paragraphs: This criterion has been partially met. While DOD has made some  progress in establishing data-driven performance measures and tracking  them against organizational goals, additional work is needed in some  areas relating to the transfer of U.S. military equipment to foreign  governments. For example, in our last update we noted that DOD has not  implemented our recommendations to improve monitoring of the security  assistance process for FMS and other security cooperation programs in  which military equipment is provided directly to foreign governments.  Since then, one recommendation—from November 2012—that DOD  establish performance measures to assess the timeliness of the security  assistance case closure process for FMS and related programs, has been  implemented, but another—from the same report—calling for DOD to  establish a performance measure to assess timeliness for the acquisition  phase of the security assistance process remains unaddressed.  Additionally, DOD officials responsible for administering the Defense  Exportability Features Pilot Program said they have not yet developed  meaningful metrics relating to aspects of the program International  Cooperation officials would like to measure, such as cost savings and the  defense industry’s ability to handle increased production to accommodate  both U.S. and export items.
section_title: Demonstrated Progress
paragraphs: example, we have previously reported that DOD’s MCTL, originally  developed in response to the Export Administration Act of 1979 in order  to inform export decisions, is no longer being updated or used by DOD  officials who provide input on the criticality of technologies as part of  export license determinations and reviews of foreign acquisition of U.S.  companies.
We recommended in January 2013 that DOD determine the best  approach for meeting users’ requirements for a technical reference and  DOD officials noted that a memorandum is pending final signature that  would cancel DOD’s policy requiring use of the MCTL. In the meantime,  DOD officials we spoke with in August 2016 highlighted an ongoing effort  to update the U.S. Munitions List, which is now more widely used in  security cooperation efforts. Additionally, the Defense Security Service  maintains a separate list—the Industrial Base Technology List—which is  used by many DOD entities to characterize threats to information and  technology and to categorize technology acquisitions.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In March 2012, we issued a report identifying delays in the license  determination process, by which agencies confirm whether an item for  export is controlled and requires a license. We recommended that  Commerce establish timeliness goals for responding to license  determination requests. According to Commerce, in April 2014,  Commerce’s Bureau of Industry and Security began implementing the  license determination module of the Commerce USXPORTS Export  Support System. This system has enabled them to reduce their  average processing time for license determinations to around 14  days, well below Commerce’s internal requirement for processing  license determinations of 35 days. foreign security forces under security-related assistance programs to  establish formal written procedures to consult with the Directorate of  Defense Trade Controls to determine if there are additional  safeguards recommended for the transfer of the defense articles.  According to State officials, in October 2015, the Department of  State’s Bureau of International Narcotics Control and Law  Enforcement Affairs issued new standard operating procedures  directing end-use monitoring officials to ensure that all U.S.  government personnel utilize an end-use monitoring defense article  checklist when conducting inspections.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Marie A. Mak  at (202) 512-4841 or makm@gao.gov.
section_title: Related GAO Products
paragraphs: Critical Technologies: Agency Initiatives Address Some Weaknesses, but  Additional Interagency Collaboration Is Needed. GAO-15-288.  Washington, D.C.: February 10, 2015.
Export Controls: NASA Management Action and Improved Oversight  Needed to Reduce the Risk of Unauthorized Access to Its Technologies.  GAO-14-315. Washington, D.C.: April 15, 2014.
Countering Overseas Threats: DOD and State Need to Address Gaps in  Monitoring of Security Equipment Transferred to Lebanon. GAO-14-161.  Washington, D.C.: February 26, 2014.
Protecting Defense Technologies: DOD Assessment Needed to  Determine Requirement for Critical Technologies List. GAO-13-157.  Washington, D.C.: January 23, 2013.
Security Assistance: DOD’s Ongoing Reforms Address Some  Challenges, but Additional Information Is Needed to Further Enhance  Program Management. GAO-13-84. Washington, D.C.: November 16,  2012.
Export Controls: Compliance and Enforcement Activities and  Congressional Notification Requirements under Country-Based License  Exemptions. GAO-13-119R. Washington, D.C.: November 16, 2012.
Nonproliferation: Agencies Could Improve Information Sharing and End- Use Monitoring on Unmanned Aerial Vehicle Exports. GAO-12-536.  Washington, D.C.: July 30, 2012.
Export Controls: U.S. Agencies Need to Assess Control List Reform’s  Impact on Compliance Activities. GAO-12-613. Washington, D.C.: April  23, 2012.
Export Controls: Proposed Reforms Create Opportunities to Address  Enforcement Challenges. GAO-12-246. Washington, D.C.: March 27,  2012.
Export Controls: Agency Actions and Proposed Reform Initiatives May  Address Previously Identified Weaknesses, but Challenges Remain.  GAO-11-135R. Washington, D.C.: November 16, 2010.
section_title: Improving Federal Oversight of Food Safety
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of Health and Human Services (HHS), the U.S.  Department of Agriculture (USDA), and the Office of Management and  Budget (OMB) have taken some positive steps since the 2015 high-risk  update to address fragmentation in the federal food safety oversight  system. For example, HHS and USDA have continued and expanded  collaboration on specific food safety issues, and HHS has updated its  strategic plan to address interagency coordination on food safety.  However, additional steps are needed to address the system’s  fragmentation and remove this issue from the High-Risk List.
For more than four decades, we have reported on the fragmented federal  food safety oversight system, which has caused inconsistent oversight,  ineffective coordination, and inefficient use of resources. We added  federal food safety oversight to the High-Risk List in 2007 because of  risks to the economy, to public health, and to safety. A 2011 estimate by  the Centers for Disease Control and Prevention (CDC)—its most recent  estimate—indicates that, as a result of foodborne illness, roughly 1 in 6  Americans (48 million people) gets sick each year, 128,000 are  hospitalized, and 3,000 die. CDC data also show that the number of  reported multistate foodborne illness outbreaks is increasing. This is  notable because although multistate outbreaks make up a small  proportion of total outbreaks, they affect greater numbers of people. For  example, according to CDC data, 3 percent of reported outbreaks from  2010 to 2014 were multistate, but these outbreaks were associated with  11 percent of illnesses, 34 percent of hospitalizations, and 56 percent of  deaths. CDC cites several potential contributors to the increase in  reported multistate outbreaks, including greater centralization of food  processing practices, wider food distribution, and improved detection and  investigation methods. developing Crohn’s disease, a chronic inflammatory bowel disease.  According to a May 2015 estimate from USDA’s Economic Research  Service, the most common 15 foodborne pathogens together impose an  economic burden related to foodborne illnesses, hospitalizations, and  deaths in the United States of over $15.5 billion annually. That same  year, researchers at HHS’s Food and Drug Administration (FDA)  estimated health costs associated with foodborne illness at about $36  billion annually.
In addition to the human health toll, foodborne illness outbreaks can  impose high costs to industry from food recalls. An October 2011 study  published by the Grocery Manufacturers Association (GMA), in  partnership with Covington & Burling LLP and Ernst & Young, estimated  the cost of food recalls. The study surveyed 36 GMA member companies  and found that more than half had been affected by a product recall in the  prior 5 years. For companies that had faced a recall in the past 5 years,  48 percent estimated the financial impact to be less than $9 million; 29  percent, from $10 million to $29 million; and 23 percent, $30 million or  more. Based on the survey results, the four largest costs that companies  face as a result of a recall are business interruption or lost profits; recall  execution costs, such as destroying and replacing recalled products;  liability risk; and company or brand reputation damage.
As we reported in December 2014, three major trends create food safety  challenges. First, a substantial and increasing portion of the U.S. food  supply is imported, which stretches the federal government’s ability to  ensure the safety of these foods. Second, consumers are eating more  raw and minimally processed foods, which in general are more  susceptible to foodborne pathogens. Third, segments of the population  that are particularly susceptible to foodborne illnesses, such as older  adults and immune-compromised individuals, are growing.
The safety and quality of the U.S. food supply, both domestic and  imported, are governed by a highly complex system stemming from at  least 30 federal laws that are collectively administered by 16 federal  agencies. The federal agencies with primary responsibility for food safety  oversight are USDA’s Food Safety and Inspection Service (FSIS) and  FDA. FSIS is responsible for the safety of meat, poultry, processed egg  products, and catfish. FDA is responsible for virtually all other food. As  we reported in May 2016, the federal food safety oversight system is  supplemented by states, localities, tribes, and territories, which may have  their own laws and agencies to address the safety and quality of food.
section_title: What GAO Found
paragraphs: HHS, USDA, and OMB have taken some positive steps since the 2015  high-risk update to address fragmentation in the federal food safety  oversight system—including in relation to crosscutting requirements for  individual strategic and performance planning documents and  collaboration on specific food safety issues—but they have not addressed  our March 2011 recommendation for a government-wide plan and  Congress has not acted on our December 2014 matters for it to consider  for government-wide planning and leadership. We continue to believe that  these actions are important to federal food safety oversight efforts. A  framework for addressing these actions could be provided through  development and implementation of a national strategy for food safety  oversight. Food safety and government performance experts who  participated in a 2-day meeting that we, with the assistance of the  National Academies of Sciences, Engineering, and Medicine (National  Academies), convened in June 2016 stated that there is a compelling  need for such a strategy to provide a framework for strengthening the  federal food safety oversight system and addressing fragmentation. a government-wide plan and our December 2014 matters for Congress to  consider for government-wide planning and leadership. In addition,  developing and implementing a national strategy could provide a  framework for addressing criteria for removing food safety from the High- Risk List. Such a strategy could also include actions consistent with our  prior suggestion that Congress may wish to assess the need for  comprehensive, uniform, risk-based food safety legislation or amendment  of FDA’s and USDA’s existing authorities.
section_title: What Remains to Be Done
paragraphs: To address capacity constraints for addressing fragmentation in federal  oversight of food safety and to guide corrective actions and monitor  progress, Congress should consider directing OMB to develop a  government-wide performance plan for food safety and formalizing the  Food Safety Working Group (FSWG) through statute. To provide building  blocks toward OMB’s development of a government-wide performance  plan for food safety, USDA should implement our priority recommendation  to continue building upon its efforts to implement the GPRA  Modernization Act of 2010 (GPRAMA) requirements to address  crosscutting food safety efforts in its strategic and performance planning  documents, which HHS has already done. These actions should provide  federal food safety agencies with vehicles to demonstrate strong  commitment to, top leadership support for, and progress in implementing  corrective measures to address fragmentation in federal oversight of food  safety. These actions could also be addressed through development and  implementation of a national strategy for food safety oversight, which  could thereby address criteria for removing food safety oversight from the  High-Risk List. In addition, such a strategy could include actions  consistent with our prior suggestion that Congress may wish to assess  the need for comprehensive, uniform, risk-based food safety legislation or  amendment of FDA’s and USDA’s existing authorities. If, over the next  several years, weaknesses in the food safety system persist, Congress  should also consider commissioning a detailed analysis of alternative  organizational structures for food safety.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: The criterion of demonstrating commitment to, and top leadership support  for, addressing fragmentation in federal oversight of food safety has been  partially met. With the enactment of GPRAMA in January 2011,  Congress and the executive branch demonstrated strong commitment  and top leadership support for improving collaboration across the federal  government. GPRAMA further highlights the need for crosscutting  strategic and performance planning for issues that involve multiple federal  agencies and could provide the initial steps toward a government-wide  performance plan for food safety.
GPRAMA added new requirements for addressing crosscutting efforts in  federal strategic and performance planning. For example, GPRAMA  requires agencies to describe in their strategic and performance planning  documents how they are working with other agencies to achieve their  goals and objectives. In December 2014, we found that HHS and USDA  had taken steps to implement GPRAMA’s crosscutting requirements for  their food safety efforts. However, the agencies did not fully address  crosscutting food safety efforts in their strategic and performance  planning documents. We recommended that HHS and USDA continue to  build upon their efforts to implement GPRAMA requirements to address  crosscutting food safety efforts in their strategic and performance  planning documents. Both agencies agreed with the recommendation. included more information on crosscutting food safety efforts in its fiscal  year 2017-2021 strategic plan and in its draft fiscal year 2017 annual plan  than it did in its prior strategic and annual plans; USDA planned to include  information on interagency collaboration in its next strategic plan,  according to USDA officials.
Fully addressing crosscutting food safety efforts in individual strategic and  performance planning documents is an important first step toward  providing a comprehensive picture of the federal government’s  performance in overseeing food safety. However, the agency-by-agency  focus of individual planning documents alone does not provide the  integrated perspective on federal food safety performance necessary to  guide congressional and executive branch decision making and to inform  the public about what federal agencies are doing to ensure food safety.  Those individual documents could, however, provide building blocks  toward the next, more challenging task of developing a single,  government-wide performance plan for food safety.
The President demonstrated strong commitment and top leadership in  March 2009, when the President established the FSWG to coordinate  federal efforts and develop goals to make food safer. In March 2011, we  indicated that creation of the FSWG was a positive step. However, the  group stopped meeting after about 2 years. In December 2014, we  reported that, according to senior FDA and FSIS officials and OMB staff,  the FSWG was no longer needed, given the existence of other  collaborative mechanisms. FDA and FSIS are involved in numerous  mechanisms to facilitate interagency coordination on food safety;  however, existing mechanisms focus on specific issues, and none  provides for broad-based, centralized collaboration. For example, FDA  and FSIS are collaborating with CDC through the Interagency Food  Safety Analytics Collaboration to improve estimates of the most common  sources of foodborne illnesses. However, this and other mechanisms do  not allow FDA, FSIS, and other agencies to look across their individual  programs and determine how they all contribute to federal food safety  goals.
In addition, the FDA Food Safety Modernization Act (FSMA)—enacted  in 2011 to amend existing food safety laws—includes numerous  provisions requiring interagency collaboration, but these too focus on  specific topics and do not provide for centralized, broad-based  collaboration across food safety regulations and programs. In December  2014, we suggested that Congress consider formalizing the FSWG  through statute to help ensure sustained leadership across food safety  agencies over time.
As of January 2017, HHS, USDA, and OMB had taken some positive  steps since our 2015 high-risk update to address fragmentation in the  federal food safety oversight system—including continued and expanded  collaboration on specific food safety issues—but they had not addressed  our March 2011 recommendation for a government-wide plan and  Congress had not acted on our December 2014 matters for it to consider  for government-wide planning and leadership. We continue to believe  that these actions are important to federal food safety oversight efforts. In  January 2017, however, we also concluded that a framework for  addressing these actions could be provided through development and  implementation of a national strategy for food safety oversight. Food  safety and government performance experts who participated in a 2-day  meeting that we, with the assistance of the National Academies,  convened in June 2016 stated that there is a compelling need for such a  strategy to provide a framework for strengthening the federal food safety  oversight system and addressing fragmentation.
The experts identified stating the purpose, establishing sustained  leadership, identifying resource requirements, monitoring progress, and  including actions for gaining traction as key elements that should be  included in a national strategy for food safety oversight; these elements  are consistent with characteristics that we have identified as desirable in  a national strategy. We have found that complex interagency and  intergovernmental efforts, which could include food safety, can benefit  from developing a national strategy and establishing a focal point with  sufficient time, responsibility, authority, and resources to lead the effort.
The experts did not specify which entity should lead such a strategy, but  they emphasized that it should be led by the highest level of the  administration.
Past efforts to develop high-level strategic planning for food safety have  depended on leadership from entities within the Executive Office of the  President (EOP). By developing a national strategy to guide the nation’s  efforts to improve the federal food safety oversight system and address  ongoing fragmentation, the appropriate entities within the EOP, in  consultation with relevant federal agencies and other stakeholders, could  provide a comprehensive framework for considering organizational  changes and making resource decisions. Experts identified the following  stakeholders as key contributors to a national strategy for food safety:  federal, tribal, state, and local government agencies; industry; consumer  groups; academia; and key congressional committees.
In our January 2017 report, we found that a national strategy for food  safety, as described by the experts and possessing the desirable  characteristics identified in our past work, could fulfill the intent behind our  March 2011 recommendation for a government-wide plan and our  December 2014 matters for congressional consideration for government- wide planning and leadership. Such a strategy could include all of the  elements of a government-wide performance plan for federal food safety  oversight, such as government-wide goals and performance indicators. In  addition, we found that, to the extent that such a strategy establishes  sustained leadership, it could fulfill the intent behind our December 2014  matter for Congress to consider formalizing the FSWG through statute to  help ensure sustained leadership across food safety agencies over time.  We therefore recommended that the appropriate entities within the EOP,  in consultation with relevant federal agencies and other stakeholders,  should develop a national strategy that states the purpose of the strategy,  establishes high-level sustained leadership, identifies resource  requirements, monitors progress, and identifies short- and long-term  actions to improve the food safety oversight system. HHS and OMB did  not comment on our recommendation. USDA disagreed with the need for  a national strategy but cited factors to consider should changes be  proposed. Even with USDA’s reservations, we continue to believe that a  national strategy would provide a comprehensive framework for  considering organizational changes and resource decisions to improve  the federal food safety oversight system. It will be up to the stakeholders  participating in such a strategy to decide which actions to pursue.
Among the actions identified by experts at our June 2016 meeting for  potential inclusion in a national strategy was alignment of FDA’s and  USDA’s existing authorities. For example, several experts mentioned  modifying the statutes that FSIS implements, such as the Federal Meat  Inspection Act and the Poultry Improvement Act, to align the authorities of  USDA with the Federal Food, Drug, and Cosmetic Act, as amended by  FSMA, which outlines FDA’s responsibilities. This could help ensure a  consistent approach across food commodities. Such actions would  comport with our prior suggestion that Congress may wish to assess the  need for comprehensive, uniform, risk-based food safety legislation or to  amend FDA’s and USDA’s existing authorities.
section_title: Capacity
paragraphs: Federal food safety agencies have partially met the criterion for capacity  to address the fragmentation in food safety oversight. USDA and HHS  have the capacity to more fully address crosscutting food safety efforts in  their individual strategic and performance planning documents; however,  OMB action is needed to use those documents as building blocks to  develop a government-wide performance plan on food safety. Federal  food safety agencies also have the capacity to participate in a centralized  collaborative mechanism on food safety—like the FSWG—but  congressional action would be required to formalize such a mechanism  through statute. Furthermore, appropriate entities within the EOP have  the capacity to consult with relevant federal agencies and other  stakeholders to develop a national strategy for food safety. Doing so  could address our March 2011 recommendation for a government-wide  plan and our December 2014 matters for congressional consideration for  government-wide planning and leadership.
section_title: Action Plan
paragraphs: The criterion of having a corrective action plan has not been met. Without  a government-wide performance plan for food safety, Congress, program  managers, and other decision makers are hampered in their ability to  identify agencies and programs addressing similar missions and to set  priorities, allocate resources, and restructure federal efforts, as needed,  to achieve long-term goals. Moreover, without a centralized collaborative  mechanism on food safety—like the FSWG—there is no forum for  agencies to reach agreement on a set of broad-based food safety goals  and objectives that could be articulated in a government-wide  performance plan on food safety. Development and implementation of a  national strategy for food safety could also fulfill these government-wide  planning and leadership needs.
section_title: Monitoring
paragraphs: The criterion of having a program to monitor corrective measures has not  been met. Without a government-wide performance plan for food safety,  federal food safety efforts are not clear and transparent to the public.  Currently, to understand what government is doing to ensure the safety of  the food supply, Congress, program managers, other decision makers,  and the public must access, attempt to make sense of, and reconcile  individual documents across the 16 federal agencies responsible for  administering the more than 30 federal statutes that govern food safety  and quality. This government-wide planning need could also be  addressed through a national strategy for food safety.
section_title: Demonstrated Progress
paragraphs: The criterion of demonstrating progress in implementing corrective  measures to address fragmentation in federal oversight of food safety has  been partially met. As noted, HHS, USDA, and OMB took some positive  steps to address fragmentation in the federal food safety oversight  system—including in relation to GPRAMA crosscutting requirements and  collaborative mechanisms on specific food safety issues—but they did not  address our March 2011 recommendation for a government-wide plan  and Congress did not act on our December 2014 matters for it to consider  for government-wide planning and leadership. Development and  implementation of a national strategy for food safety could fulfill these  government-wide planning and leadership needs and show sustained  progress in addressing fragmentation in the federal food safety oversight  system.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In response to a recommendation we made in December 2014, HHS took  steps to update its strategic and performance planning documents to  better address crosscutting food safety efforts. For example, in February  2015, HHS updated its strategic plan to more fully describe how it is  working with other agencies to achieve its food safety related goals and  objectives. Among other things, HHS described its collaboration with  USDA, the Environmental Protection Agency, and others through  collaborative mechanisms such as the National Antimicrobial Resistance  Monitoring System, the Partnership for Food Protection, and the Food  Emergency Response Network. As a result, we closed the  recommendation to HHS as implemented.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Steve D.  Morris at (202) 512-3841 or morriss@gao.gov.
section_title: Related GAO Products
paragraphs: Food Safety: A National Strategy Is Needed to Address Fragmentation in  Federal Oversight. GAO-17-74. Washington, D.C.: January 13, 2017.
Food Safety: FDA Coordinating with Stakeholders on New Rules but  Challenges Remain and Greater Tribal Consultation Needed.  GAO-16-425. Washington, D.C.: May 19, 2016.
Federal Food Safety Oversight: Additional Actions Needed to Improve  Planning and Collaboration. GAO-15-180. Washington, D.C.: December  18, 2014.
Federal Food Safety Oversight: Food Safety Working Group Is a Positive  First Step but Governmentwide Planning Is Needed to Address  Fragmentation. GAO-11-289. Washington, D.C.: March 18, 2011.
High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January  2007.
section_title: Protecting Public Health through Enhanced Oversight of Medical Products
subsections: section_title: Why Area Is High Risk
paragraphs: Millions of medical products—drugs, biologics, and medical devices—are  used daily by Americans at home, in the hospital, and in other health care  settings. The Food and Drug Administration (FDA) has the vital mission of  protecting the public health by overseeing the safety and effectiveness of  these products marketed in the United States. The agency’s  responsibilities begin long before a product is brought to market and  continue after FDA approves a product, regardless of whether it is  manufactured in the United States or abroad.
The importance of FDA’s role in ensuring our citizens’ well-being cannot  be overstated. In recent years, FDA has been confronted with multiple  challenges. Rapid changes in science and technology, globalization,  unpredictable public health crises, an increasing workload, and the  continuing need to monitor the safety of thousands of marketed medical  products are among the many challenges with which FDA must routinely  contend. The oversight of medical products was added to our High-Risk  List in 2009 because these obstacles threatened to compromise FDA’s  ability to protect the public health. While progress has been made, we  have found that some challenges remain and new ones, such as drug  shortages, have emerged.
section_title: What GAO Found
paragraphs: In 2015, we found that FDA had made substantial progress in addressing  some of the concerns we raised in this high-risk area. Specifically, we  determined that FDA had significantly improved its oversight of medical  device recalls and the implementation of the Safe Medical Devices Act of  1990. In recognition of the agency’s significant strides in these two areas,  we narrowed the scope of our high-risk designation. FDA met all five  criteria—demonstrating strong leadership commitment, ensuring sufficient  capacity, developing both specific action plans and effective monitoring  tools, and demonstrating progress—for having the high-risk designation  removed for both medical device areas. At that time we also found that  FDA had action plans in place to help it respond to two remaining issues  of high importance: the effect of globalization on FDA’s ability to monitor  medical product manufacturing, and the availability of medically  necessary drugs. In addition, we reported that the agency’s leadership  was committed to and supportive of initiatives in these two remaining  areas. However, the agency’s capacity to address these issues was  unclear, and the effectiveness of its monitoring and lack of adequate  progress was a concern. Therefore, FDA’s oversight of medical products  remained as a high-risk area.
Since 2015, we have found FDA has made some progress addressing  our remaining concerns about globalization and drug availability. For  example, FDA has demonstrated progress in responding to globalization  by increasing the number of inspections it conducts of foreign  manufacturing establishments producing drugs for the U.S. market. It has  also improved the accuracy and completeness of information in its  catalog of drug manufacturing establishments subject to inspection (which  we referred to as an “inventory” in previous reports). The availability of  more reliable data should enhance FDA’s oversight and help FDA apply  its risk-based model for selecting drug establishments for inspection. FDA  also has the opportunity to better monitor drug shortages by fully utilizing  a recently implemented tracking system.
Although these are positive steps, we continue to have concerns in both  areas. The effectiveness of FDA’s foreign offices, which began opening in  2008, has not yet been meaningfully assessed. In addition, persistently  high vacancy rates in these offices suggest that they may lack the  capacity to robustly monitor the global arena as the agency originally  envisioned. As of July 2016, 46 percent of FDA foreign offices positions  were vacant. Moreover, we found that some of the challenges FDA faces  in recruiting staff to work in these offices are the same as those we  reported on in 2010 and 2015.
With regard to ensuring drug availability, the way FDA monitors its drug  shortage information remains a concern. Although it implemented a new  tracking system—the Shortage Tracker—in March 2016, this is the fourth  approach to monitoring shortages that the agency has taken in 5 years.  According to FDA, it routinely enters data into the system, but the agency  has not yet developed standard reports to help it manage its efforts, nor  has it made plans to use these data to analyze trends or identify patterns  to help it predict future shortages. Similarly, we remain concerned about  the reliability and availability of information that is necessary to monitor  postmarket drug safety. For example, FDA has not yet fully implemented  a recommendation we made in 2013 to ensure its databases collect  reliable and timely data on inspections of certain establishments that  compound drugs. causes, has been inconsistent. These inconsistencies may undermine  FDA’s action plan and its effectiveness. In addition, in December 2015  and May 2016, we identified new concerns regarding the agency’s  collection of reliable data regarding postmarket drug safety and  shortcomings in its broader strategic planning efforts for drugs and other  medical products. As a result, we no longer consider that FDA has met  the criteria associated with having an effective action plan, and are  therefore changing its rating in this area from met to partially met.
In recent years, Congress has taken actions that have facilitated FDA’s  ability to address concerns we have identified, and make progress in this  important high-risk area.
In July 2013, we reported that FDA’s authority to oversee drug  compounding was unclear. The Drug Quality and Security Act,  enacted in November 2013, helped clarify FDA’s authority to oversee  drug compounding nationally. In November 2016, we reported that  since the law’s enactment, FDA has issued numerous guidance  documents related to compounding and conducted more than 300  inspections of drug compounders. These inspections have resulted in  actions such as FDA issuing warning letters, which are issued for  violations of regulatory significance, and recalls voluntarily initiated by  manufacturers of potentially contaminated drugs.
The Food and Drug Administration Safety and Innovation Act  (FDASIA), enacted in July 2012, directed FDA to take a risk-based  approach to inspecting both foreign and domestic drug manufacturing  establishments, consistent with our 2008 recommendation. FDA has  now fully implemented this provision. The number of foreign  inspections has consistently increased each year since fiscal year  2009. In fiscal year 2015, FDA conducted more foreign than domestic  inspections. The agency has also enhanced its risk-based approach  to prioritizing drug establishments for inspection.
section_title: What Remains to Be Done
paragraphs: consider the agency to meet the criteria for having an effective action  plan.
In addition to redoubling its efforts to develop—and sustain—an effective  action plan for both globalization and drug availability, FDA needs to  demonstrate that it has the capacity to address multiple challenges we  have identified, along with effective monitoring strategies. For example, it  needs to fully execute its plan to inspect the many foreign drug  establishments making drugs for the U.S. market, for which it has no  inspectional history, over the next 3 years.
Furthermore, FDA should implement our prior recommendations to  resolve new and previously identified concerns, including the following:
FDA should assess the effectiveness of the foreign offices’  contributions, by systematically tracking information to measure  whether the offices’ activities specifically contribute to drug safety- related outcomes, such as inspections, import alerts, and warning  letters.
FDA should establish goals to achieve the appropriate staffing level  for its foreign offices.
FDA should routinely use its new Shortage Tracker and conduct  periodic analyses to systematically assess drug shortage information  to proactively identify risk factors for potential drug shortages.
FDA should develop comprehensive plans, including goals and time  frames, to correct problems with its postmarket safety data and  ensure that these data can be easily used for oversight.
FDA should consistently collect reliable and timely information in  FDA’s databases on inspections and enforcement actions associated  with compounded drugs.
section_title: Additional Details on What GAO Found
subsections: section_title: Response to Globalization
subsections: section_title: Leadership Commitment
paragraphs: FDA has met this criterion. In 2015, we noted FDA showed leadership  commitment to this area by creating an office dedicated to confronting the  challenges of globalization and helping prepare the agency to move from  regulating domestic products to overseeing a worldwide market. The  agency’s leadership commitment was made further evident by its  strategic priorities for fiscal years 2014 through 2018, which discuss its  goal of expanding its regulatory presence and partnerships overseas.
section_title: Capacity
paragraphs: producing drugs for the U.S. market than any other country, followed  closely by China. While globalization brings benefits, it also carries risks,  as some of these countries have regulatory systems less sophisticated  than our own. This global marketplace has placed greater pressure on  FDA to oversee the safety and effectiveness of all medical products  marketed in the United States, regardless of where they are produced.
In 2008, we reported that FDA inspected relatively few foreign drug  manufacturing establishments each year. We also pointed out that FDA  had not used its risk-based process to select foreign establishments for  inspection to the extent it had for selecting domestic establishments. Two  years later, in 2010, we reported FDA had increased the number of  foreign drug inspections it conducted, but that it still conducted relatively  fewer foreign drug inspections. However, since 2009, FDA has enhanced  its capacity to conduct inspections and has increased the number of  foreign establishments it inspects each year. In fiscal year 2015, FDA  conducted more foreign than domestic inspections. Establishments in  China and India were inspected by FDA more than those in other foreign  countries.
More recently, we have questioned the effectiveness of FDA’s foreign  offices, which are overseen by its Office of International Programs (OIP).  FDA began opening these offices in 2008 to obtain better information on  products coming from overseas. Among other things, these offices help  FDA build partnerships with its regulatory counterparts and industry  members overseas, and help certain countries improve their regulatory  capacities. Staff in these offices also inspect foreign establishments,  gather intelligence, and foster information sharing with FDA headquarters.  In December 2016, we reported that, while foreign office staff have  inspected drug establishments overseas, they have conducted relatively  few such inspections and may not have the capacity to do more. Most  inspections of foreign drug establishments have been conducted by  FDA’s domestically-based staff. Foreign office staff have conducted 5  percent of these inspections since fiscal year 2010.
Further, the persistently high vacancy rates in these offices suggest that  they may lack the capacity to robustly assist FDA and monitor the global  arena, as the agency originally envisioned. As of July 2016, 46 percent of  the offices’ positions were vacant, up slightly from 44 percent in October  2014. Moreover, we found that FDA still faces some of the challenges of  recruiting staff to work in these offices that we identified in 2010 and  2015.
Although FDA recently finalized a strategic workforce plan, as we  recommended in 2010, we have identified several weaknesses in it. For  example, the plan does not target vacancies by specific position types.  While FDA recognizes its vacancy rate in its foreign offices is high and  has set a goal of reducing this rate, the measure it has developed targets  all of the staff in OIP, including those who are domestically-based. Thus,  FDA could increase the number of domestically-based staff in OIP and  fulfill its goal without reducing vacancies in its foreign offices. We remain  concerned that, without targeting the foreign offices specifically or the  types of positions most likely to have vacancies, FDA will not have a  meaningful measure reflecting its true staffing needs overseas. In  December 2016, we recommended that FDA establish goals to achieve  the appropriate staffing levels for its foreign offices, which would include  separating foreign office vacancies from the OIP-wide vacancy rate and  setting goals by position type. We believe such actions are needed in  order for FDA to demonstrate progress and help ensure that its foreign  offices have the capacity to monitor conditions abroad and meaningfully  contribute to drug safety. FDA said it is taking immediate steps to address  this recommendation.
section_title: Action Plan
paragraphs: FDA has met this criterion. In 2015, we recognized that FDA had  developed an action plan for building a stronger, more secure global  product safety net. In addition, we noted that FDA developed plans to  partner with foreign regulatory authorities to leverage resources through  increased information sharing following the enactment of FDASIA in  2012, which increased FDA’s ability to strengthen its efforts in this area.  FDASIA also reinforced our 2008 recommendation that the agency  should take a risk-based approach to selecting both foreign and domestic  drug manufacturing establishments for inspection, which helped FDA  develop plans to prioritize its drug inspections.
section_title: Monitoring
paragraphs: FDA has partially met this criterion. We have been critical of FDA’s  internal monitoring of its drug inspection program since as early as 1998,  when we reported that the agency’s own internal evaluations concluded  that it did not have a comprehensive data management system to monitor  foreign manufacturers. The evaluations concluded that unless corrected,  problems in FDA’s foreign inspection program could allow adulterated  and low-quality drugs to be imported, posing serious health risks to  Americans. Although the agency was aware of this problem, we found  that similar problems persisted in 2008 and 2010, which affected the  agency’s ability to manage the foreign drug inspection program.
FDA has recently taken steps to better monitor its drug inspection  program. In December 2016, we reported that FDA formalized its process  for developing, evaluating, and documenting key decisions about the risk- based model that it will use to select drug establishments to inspect each  year. FDA previously lacked a process for tracking revisions to its model  and, as a result, officials were unable to recall or explain all the changes  to the model over time. FDA’s documentation will now chronicle decisions  made regarding which factors were included in the model in a particular  year, according to officials. FDA officials also said that our prior reviews  reinforced the need for written procedures.
FDA has also taken steps to improve the accuracy and completeness of  the information it uses to manage its foreign drug inspection program.  The databases that FDA was using to select establishments to inspect did  not contain accurate information on the number of establishments  manufacturing drugs for the U.S. market, as we reported in 2008. Two  years later, in 2010, we also found that 64 percent of the foreign  establishments in FDA’s catalog may have never been inspected, almost  half of which were in China and India. To help the agency manage its  catalog of data, FDA established a data governance board in May 2015 to  define standards, best practices, and policies, on which FDA’s oversight  depends, including the veracity of its risk-based site selection model. FDA  officials said the board has developed guidance for merging data  processes and is working toward defining data metrics to determine  whether they have improved on their reporting. The board has also  defined data standards for storing key attributes of establishments, such  as companies’ names, and continues to examine best practices for  sharing establishment data across FDA.
This action has helped FDA reduce the number of establishments in its  catalog that may never have had a surveillance inspection. Currently,  FDA lacks information on the inspection history of 33 percent of the  foreign establishments in its catalog, compared to the 64 percent for  which it lacked inspection history in 2010. While the agency has made  progress in reducing this knowledge gap, it is important to note that the  overall number of foreign establishments with no surveillance inspection  history remains large, with about 1,000 of the approximately 3,000 in its  catalog of establishments with no inspection history. To address this  persistent concern, the agency plans to inspect all establishments in its  catalog with no prior surveillance inspection history over the next 3 years  (approximately one-third each year), beginning in fiscal year 2017.
In addition, FDA has not sufficiently monitored the contributions of its  foreign offices or meaningfully assessed their effectiveness. While these  offices engage in collaborative activities with foreign stakeholders, FDA  does not systematically track how information collected by the offices has  contributed to drug safety. The agency has been considering the best  approach to assessing the future needs of its foreign offices and  measuring their performance. In 2014 and 2015, FDA’s Office of Planning  compiled detailed information about their operations, including their  workforce composition.
More recently, in July 2016, FDA’s Office of Planning completed an  internal evaluation to develop an evidence-based, collaborative, and  repeatable process to select foreign post locations, considering the  effects of cost, legislation, and program alignment on FDA foreign post  operations, and the appropriate mix of FDA staffing at the posts. This  evaluation proposed a process for determining the correct mix of staffing  and position types for the foreign offices. The results of this evaluation  suggest that the foreign offices would benefit from strategically aligning  their operational activities and desired public health impacts. However,  OIP has yet to implement and apply the process to the foreign offices. In  December 2016, we recommended that FDA assess the effectiveness of  the foreign offices’ contributions, which would require systematically  tracking information to measure whether the offices’ activities specifically  contribute to drug safety-related outcomes. FDA said it is taking  immediate steps to address this recommendation.
section_title: Demonstrated Progress
paragraphs: FDA has partially met this criterion. Since 2015, FDA has taken a variety  of steps to respond to globalization and has made progress in meeting  this challenge. For example, FDA has  strengthened its monitoring of foreign drug establishments by  improving the accuracy and completeness of information used to  develop its catalog of drug manufacturing establishments subject to  inspection. The availability of more reliable data should enhance  FDA’s monitoring and oversight while helping it apply its risk-based  model for prioritizing drug establishments for inspection.  taken a risk-based approach to inspecting both foreign and domestic  drug manufacturing establishments, in accordance with a directive in  FDASIA and consistent with our 2008 recommendation.  formalized its process for prioritizing the establishments it inspects to  determine compliance with good manufacturing requirements, based  on certain risk factors specified by FDASIA. decided that, starting in fiscal year 2017, the agency will allow no  more than 5 years to elapse between inspections at a specific  establishment.
Yet, FDA still faces challenges overseeing the global marketplace and  must continue to demonstrate progress in conducting more inspections of  foreign establishments. There remain a large number of foreign  establishments making drugs for the U.S. market—almost 1,000—that  may never have been inspected.
section_title: Drug Availability
paragraphs: Over the last decade, prescription drugs—including those that are life- saving and life-sustaining—have been in short supply, preventing health  care providers and patients from accessing medications that are essential  for treatment. Those in shortage have included essential therapies, such  as anesthetic, anti-infective, cardiovascular, nutritive, and oncology drugs.  Although the number of new shortages reported each year has generally  decreased since 2011, the number of ongoing shortages—those that  began in prior years—have remained high. Since 2013, the majority of the  ongoing shortages in a given year were first reported at least 2 years  earlier. We have issued several reports on this topic since 2011 and  made recommendations to enhance the agency’s ability to respond and  oversee shortages. FDA has since implemented some of these  recommendations.
subsections: section_title: Leadership Commitment
paragraphs: FDA has met this criterion by demonstrating leadership commitment to  responding to drug shortages, which we recognized in 2015. Its strategic  priorities for fiscal years 2014 through 2018 emphasize its continued  commitment to responding to shortages. FDASIA also required FDA to  issue a strategic plan to enhance the agency’s ability to prevent and  mitigate shortages. FDA issued this strategic plan in October 2013.
section_title: Capacity
paragraphs: found that, while shortages persisted, FDA had prevented more potential  shortages than it had in the prior 2 years by, for example, working with  manufacturers to increase production. More recently, in 2016, we  reported that FDA prioritized its review of nearly 400 applications to  market generic drugs (or supplements to existing approved new or  generic drug applications) to address shortages from January 2010  through July 2014. We analyzed a subset of those submissions and found  that some were approved before the shortage was prevented or resolved.  Although the timing of FDA’s approvals of submissions could not be  directly linked to the resolution of particular shortages, we believe that  prioritizing reviews may be a useful strategy in addressing some drug  shortages. Despite the agency efforts, shortages persist and we  recognize that FDA cannot resolve this concern alone. Nonetheless, there  is more FDA could do. For example, given that the median time to  approve prioritized generic drug applications is over a year, this approach  is generally not a strategy for addressing shortages in the short term. In  addition, FDA’s ability to manage risk-based decisions and proactively  help prevent and resolve shortages may be hindered because it does not  routinely analyze the data it collects.
section_title: Action Plan
paragraphs: FDA now partially meets this criterion. In 2015, we rated FDA as meeting  this criterion. However, we are changing this rating to partially meets due  to shortcomings that we identified in recent reports, as discussed below.
In order to protect public health, FDA works to ensure the availability of  medically necessary drugs and the safety of the drug supply. In our 2015  high-risk report, we credited FDA for having an action plan that focuses  on its capacity to respond when alerted to supply disruptions and on  developing long-term prevention strategies to address the causes  underlying supply disruptions. However, more recently we have identified  several concerns with the agency’s readiness and plans to collect, track,  and analyze data related to drug shortages and postmarket drug safety.  We have also reported on shortcomings in its broader strategic planning  efforts related to drugs and other medical products. We no longer  consider that FDA has met the criteria associated with having an effective  action plan. routinely and systematically assess this information, and use it proactively  to identify risk factors for potential drug shortages. FDA’s response to  these two recommendations has been mixed and an action plan has not  been fully developed to implement these recommendations.
In 2011, FDA relied on e-mail status reports to track shortages. Later that  year it began using an electronic spreadsheet, which was replaced by a  drug shortage database in 2012. A new drug shortage data system  followed in 2014. But FDA’s planning did not result in a smooth transition  from one system to another. FDA suspended its use of the drug shortage  database at the end of 2013 while it was developing the more robust drug  shortage data system. The transition to the new data system took longer  than anticipated and FDA documented limited information about  shortages using manual logs during an extended period in 2014. FDA  began using its new data system in late 2014, and information on new  and active shortages in 2014 was entered retroactively into this system.  However, that system is no longer in use and FDA has now adopted an  even newer system—its fourth approach to monitoring shortages in 5  years. The Shortage Tracker was implemented in March 2016. While it  appears promising, FDA officials said it has been populated with data  going back to January 2015 only, precluding the agency from easily  conducting extensive analyses of trends prior to that date. Moreover, the  agency has not yet made plans to use these data to analyze trends or  identify patterns to help it predict future shortages, nor has it developed  standard reports to assist with managing its efforts.
Similar to our concerns with FDA’s drug shortage data, the reliability and  availability of information that is necessary to monitor postmarket drug  safety is limited. FDA lacks an action plan to address these issues. For  example, in July 2013 we reported that FDA lacks timely and reliable  information to oversee the entities that compound drugs, including timely,  reliable information on the findings of inspections of these entities. FDA’s  inspection database did not always distinguish compounding pharmacies  from manufacturers of human or veterinary drugs. In addition, its  database did not consistently reflect the agency’s final determination of  an individual inspection’s results. We also found that the agency lacked  reliable data to make decisions to prioritize its inspections of such  pharmacies and other follow-up and enforcement actions. We  recommended that FDA ensure its databases collect reliable and timely  data on inspections of certain establishments that compound drugs, but  the agency has not yet fully implemented this recommendation, which  would improve its monitoring.
Similarly, in December 2015, we found that FDA lacks reliable, readily  accessible data on tracked safety issues and postmarket studies needed  to meet certain postmarket safety reporting responsibilities, and to  conduct systematic oversight. Tracked safety issues are potential safety  issues that FDA determines are significant and that it tracks using an  internal database. However, FDA’s evaluations of its database revealed  problems with the completeness, timeliness, and accuracy of the data.  For example, data on tracked safety issues were incomplete, postmarket  study data were outdated and contained inaccuracies, and tracked safety  issue and postmarket study data were not readily accessible to FDA staff  for analysis. These problems, as well as problems with the way data are  recorded that impair their accessibility, have prevented FDA from  publishing statutorily required reports on certain potential safety issues  and postmarket studies in a timely manner, and have restricted the  agency’s ability to perform systematic oversight of postmarket drug  safety.
FDA has demonstrated some progress in addressing the problems with  its data. However, the agency lacks plans that comprehensively outline its  efforts and establish related goals and time frames. We recommended  that FDA develop plans to correct problems with its postmarket safety  data and ensure that these data can be easily used for oversight. While  FDA recognized the challenges with its ability to track safety issues and  has begun some efforts to improve its data, the agency has not provided  comprehensive plans, with goals and time frames, to help ensure that  FDA corrects the identified problems with its database on safety issues  and postmarket studies. among the centers. Moreover, the strategic integrated management plan  does not fully link its performance goals to its general goals and  objectives.
We also found in May 2016 that FDA lacks measurable goals to assess  its progress in advancing regulatory science—the science supporting its  effort to assess the products it regulates. Although the agency issued  strategic planning documents in 2011 and 2013 to guide its regulatory  science efforts and identify priority areas for conducting work, these  documents do not specify the targets and time frames necessary for the  agency to measure progress overall or within each of the eight priority  areas related to medical products. According to leading practices for  strategic planning, identifying and using consistent measurable goals in  planning and progress documents is important to assessing  effectiveness. While FDA cited examples of its achievements in  regulatory science in a 2015 report, it cannot assess how those  achievements constitute progress towards its goals. In addition, FDA  lacks information about how funding targeted at regulatory science is  distributed across the priority areas. Decisions to award these funds are  made by individual FDA centers and offices, which generally did not  collect information on the associated priority areas of funded projects.  Rather, FDA retrospectively identified these areas for the purpose of our  review. The lack of consistent information limits FDA’s ability to examine  obligations across, or progress within, specific priority areas.  Furthermore, multiple centers or offices fund projects toward a given  priority area and leading practices for strategic planning encourage  agencies to manage efforts that cut across the agency.
Given the totality of our concerns, which range from needing action plans  to address specific weaknesses we have identified to the agency’s overall  strategic planning, we no longer consider that FDA has met the criteria  associated with having an effective action plan. This criterion requires that  a corrective action plan exist that defines the root cause, identifies  solutions, and explains how an agency will substantially complete  corrective measures, including steps necessary to implement solutions  we recommended. We are therefore changing FDA’s action plan rating in  this area, as well as its overall rating, from met to partially met.
section_title: Monitoring
paragraphs: help it predict future shortages. While the drug shortage staff said that  FDA’s Office of Pharmaceutical Quality will be interested in using data to  conduct rigorous analyses for predicting shortages and risk factors, the  drug shortage staff have not provided reports to any FDA components,  raising questions about the agency’s commitment to conducting such  analyses and leaving this recommendation unimplemented.
We are also concerned that the annual reports FDA has issued to  Congress on drug shortages have been limited, with no report providing  data for more than a 9-month period. This annual report, which is required  by FDASIA, is due no later than the end of the calendar year. FDA staff  explained to us that it is not possible to issue a report containing 12  months of calendar year data by December 31, and they therefore report  data from the first 9 months. However, FDA has not met the December 31  deadline, with publication dates ranging from February 5 through April 17.  Given that the agency has never met its publication deadline, we believe  it would be more helpful that policymakers receive a full year’s worth of  data—such as data covering the federal fiscal year (October 1 through  September 30)—so they could more closely monitor shortage information  themselves and obtain a more realistic view of this serious public health  problem.
section_title: Demonstrated Progress
paragraphs: FDA has partially met this criterion by taking actions in recent years. FDA  has implemented some of our recommendations, including one we made  in 2014 regarding the need for the agency to develop policies and  procedures for its drug shortages information management system, now  known as the Shortage Tracker. These policies and procedures should  help ensure information is entered into the Shortage Tracker consistently  and accurately. FDA has assessed how it allocates its resources to  improve the agency’s capacity to respond to drug shortages and  increased the number of personnel devoted to shortages, as we  recommended in 2011. In addition, FDA elevated the office of its drug  shortage staff to a more prominent position in the agency and assigned  drug shortage coordinators in each of its 20 district offices to help bring  drug shortage-related concerns to light earlier, such as inspections citing  violations of good manufacturing practices at establishments producing a  large volume of drugs. And as we recommended in 2011, FDA has issued  a strategic plan to enhance the agency’s ability to prevent and mitigate  shortages, and also developed results-oriented performance metrics that  can help evaluate program performance. including fully addressing the recommendations we made in 2011 and  2014. While FDA developed the new Shortage Tracker in March 2016— its fourth approach to monitoring shortages in the last 5 years—it needs  to use this system consistently and share information across FDA offices  regarding drugs that are in short supply. FDA also needs to periodically  analyze this information to proactively identify risk factors for potential  drug shortages early, thereby potentially helping FDA to recognize trends,  clarify causes, and resolve problems before drugs go into short supply.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: FDA is now conducting more inspections of foreign manufacturing  establishments producing drugs for the U.S. market, and is taking a  risk-based approach by combining foreign and domestic  establishments into a single list to prioritize establishments for  inspection.
FDA has improved the accuracy and completeness of information in  its catalog of drug manufacturing establishments subject to inspection.
FDA has developed a new drug shortage tracking system.
section_title: GAO Contact
section_title: Related GAO Products
paragraphs: Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but  Needs to Assess the Effectiveness and Staffing of Its Foreign Offices.  GAO-17-143. Washington, D.C.: December 16, 2016.
Drug Compounding: FDA Has Taken Steps to Implement Compounding  Law, but Some States and Stakeholders Reported Challenges.  GAO-17-64. Washington, D.C.: November 17, 2016.
Drug Shortages: Certain Factors Are Strongly Associated with This  Persistent Public Health Challenge. GAO-16-595. Washington, D.C.: July  7, 2016.
Food and Drug Administration: Comprehensive Strategic Planning  Needed to Enhance Coordination between Medical Product Centers.  GAO-16-500. Washington, D.C.: May 16, 2016.
Drug Safety: FDA Expedites Many Applications, But Data for  Postapproval Oversight Need Improvement. GAO-16-192. Washington,  D.C.: December 15, 2015.
Drug Shortages: Better Management of the Quota Process for Controlled  Substances Needed; Coordination between DEA and FDA Should Be  Improved. GAO-15-202. Washington, D.C.: February 2, 2015.
Drug Shortages: Public Health Threat Continues, Despite Efforts to Help  Ensure Product Availability. GAO-14-194. Washington, D.C.: February  10, 2014.
Drug Compounding: Clear Authority and More Reliable Data Needed to  Strengthen FDA Oversight. GAO-13-702. Washington, D.C.: July 31,  2013.
Drug Shortages: FDA’s Ability to Respond Should Be Strengthened.  GAO-12-116. Washington, D.C.: November 21, 2011.
section_title: Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals
subsections: section_title: Why Area Is High Risk
paragraphs: The Environmental Protection Agency’s (EPA) ability to effectively  implement its mission of protecting public health and the environment is  critically dependent on assessing the risks posed by chemicals in a  credible and timely manner. Such assessments are the cornerstone of  scientifically sound environmental decisions, policies, and regulations  under a variety of statutes, such as the Safe Drinking Water Act, the  Toxic Substances Control Act (TSCA), and the Clean Air Act. EPA  conducts assessments of chemicals under its Integrated Risk Information  System (IRIS) program. EPA is also authorized under TSCA to obtain  information on the risks of chemicals and to control those the agency  determines pose an unreasonable risk. Because EPA had not developed  sufficient chemical assessment information under these programs to limit  exposure to many chemicals that may pose substantial health risks, we  added this issue to the High-Risk List in 2009 as a government program  in need of broad-based transformation. The Frank R. Lautenberg  Chemical Safety for the 21st Century Act, enacted on June 22, 2016,  provides EPA with greater authority to address chemical risks, but  implementing it will take time.
section_title: What GAO Found
paragraphs: to continue to implement the TSCA reform legislation and define how it  will implement corrective actions to assess and control toxic chemicals.
EPA has now met the criteria for monitoring the IRIS program by finalizing  the IRIS Multi-Year Agenda and other actions, including continuing to  submit IRIS assessments for independent review to entities with scientific  and technical credibility. EPA has not met the criteria for monitoring the  TSCA program; to help ensure that the resources dedicated to TSCA are  sufficient for effectively implementing the new law, EPA needs to institute  a program to monitor and independently validate the effectiveness and  sustainability of its initiative to use the new TSCA authorities. For the IRIS  program, EPA has now partially met the criteria for demonstrated  progress by, among other things, issuing five IRIS assessments since  fiscal year 2015—as of January 19, 2017—and making three  assessments available for public comment in fiscal year 2016 in  preparation for an external peer review meeting associated with that  particular assessment. For the TSCA program, EPA has not met the  criteria for demonstrated progress. Both the IRIS and TSCA programs  need to continue to implement corrective actions to resolve this complex  high-risk area.
Passing the Frank R. Lautenberg Chemical Safety for the 21st Century  Act may facilitate EPA’s effort to improve its processes for assessing and  controlling toxic chemicals in the years ahead. The new law provides EPA  with greater authority and the ability to take actions that could help EPA  implement its mission of protecting human health and the environment.  Continued leadership commitment from EPA officials and Congress will  be needed to fully implement reforms. Additional work will also be needed  to issue a workload analysis to demonstrate capacity, complete a  corrective action plan, and demonstrate progress implementing the new  legislation.
section_title: What Remains to Be Done
subsections: section_title: Integrated Risk Information System
paragraphs: We recommended that EPA periodically assess the level of resources  that should be dedicated to the Integrated Risk Information System  (IRIS) program to meet user needs and maintain a viable database. therefore is not ensuring that current and accurate information on  chemicals that EPA plans to assess through IRIS is available to IRIS  users. Using the Federal Register to communicate these plans offers  greater transparency to the public about the IRIS process than other  forms of communication.
We recommended that EPA develop a strategy to address the needs  of its Program Offices and regions when IRIS toxicity assessments  are not available. Officials from select EPA offices stated that, in the  absence of agency-wide guidance, they used a variety of sources,  other than IRIS toxicity assessments to meet their needs, including  toxicity information from other EPA offices, or other state or federal  agencies. IRIS program officials also stated that there is no agency- wide mechanism for EPA to ensure that chemicals without sufficient  scientific data during one nomination period will have such information  by subsequent nomination periods. We recognize that the  development of EPA’s Multi-Year Agenda, issued in December 2015,  was a productive effort that EPA told us included an extensive  evaluation of user needs. However, the agency does not have a  strategy for addressing data gaps or have assurance that its efforts  will be sustainable over time. EPA needs to address this priority  recommendation by developing: (1) an agency-wide strategy that  addresses coordination across EPA offices and with other federal  research agencies to help identify and fill data gaps that preclude the  agency from conducting IRIS toxicity assessments, and (2) guidance  that describes alternative sources of toxicity information and when it  would be appropriate to use them when IRIS values are not available,  applicable, or current.
section_title: Toxic Substances Control Act
paragraphs: After many years of congressional committees considering legislation  aimed at reforming the Toxic Substances Control Act (TSCA), in June  2016, Congress passed and the President signed the Frank R.  Lautenberg Chemical Safety for the 21st Century Act, which gave EPA  greater authority to improve its processes for assessing and controlling  toxic chemicals. EPA and Congress need to continue to ensure that the  resources dedicated to TSCA activities are sufficient to effectively  implement the new law.
We made three priority recommendations to address challenges EPA  has faced obtaining toxicity and exposure data, banning or limiting the  use of chemicals, and identifying resource needs. First, we  recommended that EPA issue a rule to obtain toxicity and exposure  data that chemical companies have submitted to the European  Chemicals Agency. Second, we recommended that EPA issue a rule  to obtain exposure-related data from processors. Third, we  recommended that EPA develop strategies for addressing challenges  associated with obtaining these data, banning or limiting the use of  chemicals, and identifying resource needs. Because EPA has used its  authority to limit or ban only five chemicals since TSCA was originally  enacted in 1976, in part, because it believed it didn’t have enough  information, we made these recommendations to address these  concerns. The Frank R. Lautenberg Chemical Safety for the 21st  Century Act, enacted on June 22, 2016, provides EPA with greater  authority to address chemical risks, but implementing it will take time.
With the implementation of the Frank R. Lautenberg Chemical Safety for  the 21st Century Act, we believe EPA can make progress on these open  recommendations. The act substantially revises TSCA and requires EPA  to carry out numerous rulemaking and other activities within the next 2  years. In early 2016, we started a review of the TSCA program. With the  passage of TSCA reform, we decided to suspend our review and give  EPA time to implement the new law. In October 2016, as part of our  recommendation follow-up process, we reviewed information on the new  TSCA provisions. EPA officials told us that with new TSCA authority, the  agency is better positioned to take action to require chemical companies  to report chemical toxicity and exposure data. The new law authorizes  EPA to order companies to develop new information relating to a  chemical as necessary for prioritization and risk evaluation. This authority  may help EPA to gather new information, as necessary, to evaluate  hazard and exposure risks. TSCA reform legislation offers promise for  EPA implementation of our recommendations and bringing the agency  closer to achieving its goal of ensuring the safety of chemicals.
section_title: Additional Details on What GAO Found
paragraphs: provide a management-level review for consistency and quality control  across assessments. Also, the Office of Research and Development’s  Deputy Assistant Administrator worked with other EPA Deputy Assistant  Administrators in Program Offices, such as the Office of Water and  Deputy Regional Administrators, to develop the IRIS Multi-Year Agenda.  EPA’s top leadership has also demonstrated support for improving the  IRIS program by continuing to implement recommendations from us and  EPA’s Science Advisory Board, and suggestions from the National  Academies.
subsections: section_title: Capacity
paragraphs: EPA has partially met the criteria for capacity, after not meeting the  criteria in 2015. In May 2013, we reported that EPA had not recently  evaluated the demand for IRIS toxicity assessments with input from users  inside and outside EPA. In response to our report, EPA started work on  an IRIS Multi-Year Agenda in the summer of 2013 and issued it in  December 2015. According to EPA, the purpose of the agenda was to: (1)  identify IRIS assessments currently underway and their status; (2)  prioritize IRIS assessments that will be initiated over the next few years;  and (3) evaluate assessment needs and develop an update process for  existing IRIS values. Now that EPA has finalized the agenda, the agency  is better informed about how many people and resources to dedicate to  the IRIS program.
We have reviewed internal EPA documents on the need for people and  resources, and the IRIS program has started to determine if it has the  capacity to address the issues it faces. Because of EPA’s efforts to  develop the Multi-Year Agenda, in October 2016, we closed a priority  recommendation we made to EPA in 2008 for the program to determine  the types of IRIS assessments to conduct on the basis of the needs of  EPA’s Program Offices and other users. EPA’s actions are a good  starting point for EPA’s continued process for determining the types of  IRIS assessments to conduct on the basis of the needs of EPA’s Program  Offices and others.
section_title: Action Plan
paragraphs: part of its process for developing the Multi-Year Agenda it issued in  December 2015. EPA also indicated that the agency used six general  criteria to inform the selection of chemicals for assessment or  reassessment, and it documented this process in an internal working  table as part of its process for developing the agenda. By beginning to  document how it applies its IRIS selection criteria, the IRIS program can  start to determine a corrective action plan that defines root causes and  solutions to move the program forward. EPA needs to be as transparent  as possible when applying the selection criteria so that IRIS stakeholders  can know how EPA is choosing what assessments to start and why.
section_title: Monitoring
paragraphs: EPA has met the criteria for monitoring the IRIS program—after partially  meeting the criteria in 2015—by finalizing the IRIS Multi-Year Agenda and  other actions. Specifically, the program identified and evaluated demand  for the number of IRIS toxicity assessments and resources required to  meet users’ needs—a priority recommendation we made in 2013 and  closed recently based on internal documents provided by EPA. Moreover,  EPA presented a plan for how the agency will implement the National  Academies’ suggestions for improving IRIS assessments in the “roadmap  for revision” included in the National Academies’ peer review report on  the draft formaldehyde assessment. The National Academies’ most  recent report on the IRIS program, issued in May 2014, independently  validates some of the corrective measures the program is implementing.  EPA also created the Chemical Assessment Advisory Committee in  January 2013, and uses it to provide continuing, consistent review of IRIS  assessments and comment on implementing the National Academies’  suggestions in specific IRIS assessments—a recommendation we made  in December 2011 and closed in the fall of 2016. All of these actions  demonstrated EPA’s commitment to monitoring the IRIS program.
section_title: Demonstrated Progress
paragraphs: EPA has partially met the criteria for demonstrating progress in  implementing corrective measures by taking actions, such as releasing  the IRIS Multi-Year Agenda that publicly identifies the current and future  IRIS assessments. As of January 19, 2017, EPA issued two assessments  in fiscal year 2017, two assessments in fiscal year 2016, and one  assessment in fiscal year 2015. In addition, EPA made three  assessments available for public comment in fiscal year 2016 in  preparation for an external peer review meeting associated with that  particular assessment. the public’s comments prior to peer review. EPA told us that the Stopping  Rules also are important to the IRIS process to determine how to include  new studies in an assessment without delaying the process or cycling  through repeated revisions and re-revisions.
Because of these actions, we closed a 2008 priority recommendation that  demonstrated progress in implementing corrective measures. The  recommendation called for EPA to conduct IRIS assessments on the  basis of peer-reviewed scientific studies available at the time of the  assessment, and develop criteria for allowing assessments to be  suspended to await the completion of scientific studies only under  exceptional circumstances. Although EPA officials told us that the agency  has not formally invoked the Stopping Rules in response to a request to  delay an assessment to incorporate studies, they told us they apply the  rules in their everyday work when deciding whether to include new  studies at different points in the IRIS development process. EPA said they  would characterize the Stopping Rules as public IRIS policies that are in  place to avoid delay for the inclusion of new studies or analysis that they  believe would not affect the assessment’s conclusions.
Over the past two decades, we reported that EPA had found much of  TSCA difficult to implement—hampering the agency’s ability to obtain  certain chemical data or place limits on chemicals. For example, EPA has  found it difficult to obtain adequate information on toxicity—that is, the  degree to which the chemical is harmful or deadly—and exposure  levels—the frequency and duration of contact with the chemical. Without  this information, it is difficult for EPA to determine whether a chemical  poses an unreasonable risk to human health or the environment, and  then take any action necessary to regulate such chemicals. The Frank R.  Lautenberg Chemical Safety for the 21st Century Act, which reformed  TSCA, was enacted on June 22, 2016. The new law provides EPA with  greater authority and the ability to take actions that could help EPA  implement its mission of protecting human health and the environment.
section_title: Leadership Commitment
paragraphs: including TSCA. In addition, the former Administrator and top leadership  have expressed support for implementing TSCA reform. For example, the  former Administrator said that, as with any major policy reform, this one  includes compromises. But the former Administrator noted that the  legislation should help EPA’s mission to protect public health and the  environment.
section_title: Capacity
paragraphs: As in 2015, EPA has not met the criteria for capacity because the agency  has not yet issued a workload analysis which is needed to determine  whether EPA’s TSCA program has the capacity—people and resources— to resolve the risk to the program. The TSCA reform legislation requires  EPA to report to Congress by December 2016 on its capacity to  implement certain aspects of the legislation, including carrying out  chemical risk evaluations and issuing rules regulating specific chemicals.  In January 2017, EPA issued a report in response to this deadline. The  report estimates the costs of carrying out risk evaluations under the TSCA  reform legislation and discusses actions underway or planned for  increasing EPA’s capacity to carry out these evaluations. The report does  not, however, contain estimates of EPA’s capacity for carrying out risk  evaluations or promulgating associated rules. We have previously  reported that EPA has found many provisions of TSCA cumbersome and  time consuming to implement. It is currently unclear if EPA has the people  and resources to implement the new law. We will continue to monitor the  program to determine if progress is made and the criteria for capacity are  met.
section_title: Action Plan
paragraphs: EPA continues to partially meet the criteria for having an action plan. As  we reported in 2015, EPA has increased its efforts to obtain chemical  toxicity and exposure data, initiate chemical risk assessments, and review  certain new uses of chemicals, but it is too early to tell whether these  actions will reduce chemical risks. With new TSCA authority, EPA officials  stated that the agency is better positioned to take action to require  chemical companies to report chemical toxicity and exposure data.  Officials also stated that the new law gives the agency additional  authorities, including the authority to require companies to develop new  information relating to a chemical as necessary for prioritization and risk  evaluation. Using both new and previously existing TSCA authorities  should enhance the agency’s ability to gather new information as  necessary to evaluate hazard and exposure risks.
section_title: Monitoring
paragraphs: ensuring the safety of chemicals. We will continue to monitor the TSCA  program as the agency implements this important legislation.
section_title: Demonstrated Progress
paragraphs: As in 2015, EPA has not met the criteria for demonstrating progress,  although it has recently begun implementing corrective measures to  resolve this high-risk area. For example, the first TSCA reform reporting  deadline directed EPA to publish in the Federal Register a list of mercury  compounds that will be prohibited from export, not later than 90 days after  the date of enactment. That reporting deadline was September 20, 2016;  on August 26, 2016, EPA published a list of the mercury compounds that  will be prohibited from export effective January 1, 2020. TSCA reform  actions required by December 19, 2016, included the following topics and  actions: (1) Risk Evaluations: EPA must ensure that risk evaluations are  being conducted on 10 chemical substances drawn from the 2014 TSCA  Work Plan; (2) Small Business: EPA must review, and potentially revise,  its definitions of small businesses for reporting purposes after consulting  with the Small Business Administration; and (3) Congressional Report:  EPA must submit a report to Congress regarding the agency’s capacity to  carry out risk evaluations and associated actions.
According to EPA, the promulgation of these rules will better position the  agency to increase the rate at which chemicals are evaluated for human  and environmental health and safety. As of December 19, 2016, EPA had  taken steps to respond to the December deadlines for risk evaluations  and small business. Specifically, EPA has announced the first 10  chemicals it will evaluate for potential risks to human health and the  environment and published a Federal Register notice on Standards for  Small Manufacturers and Processors. In January 2017, EPA took action  in response to December deadline 3 by issuing a report: Initial Report to  Congress on the EPA’s Capacity to Implement Certain Provisions of the  Frank R. Lautenberg Chemical Safety for the 21st Century Act. We will  continue to monitor EPA as it implements this important piece of chemical  legislation and determine if it is satisfying all the criteria for removal from  the High-Risk List.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: recommendation we made in 2013 and closed recently based on EPA’s  actions.
Our work has also supported deliberations by Congress about TSCA and  about strengthening EPA’s ability to regulate chemicals. For example, as  far back as 1994, we reported that Congress should consider setting  specific deadlines for reviewing existing chemicals, which the new TSCA  legislation would address because it requires EPA to establish a chemical  prioritization process, and to initiate risk evaluations of high priority  chemicals, among other issues.
Our work since then has addressed a variety of chemical management  policy matters for Congress. For example, in 2009, we testified that EPA  does not routinely assess the risks of chemicals in commerce, and in  2013, we testified about possible statutory changes to TSCA to give EPA  additional authorities to obtain information, and shift more of the burden to  chemical companies for demonstrating the safety of their chemicals.  Finally, in 2016, Congress passed the Frank R. Lautenberg Chemical  Safety for the 21st Century Act, which we found addresses key challenge  areas we’ve identified previously.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Alfredo  Gómez at (202) 512-3841 or gomezj@gao.gov.
section_title: Related GAO Products
paragraphs: Chemicals Management: Observations on Human Health Risk  Assessment and Management by Selected Foreign Programs.  GAO-16-111R. Washington, D.C.: October 9, 2015.
Chemical Assessments: Agencies Coordinate Activities, but Additional  Action Could Enhance Efforts. GAO-14-763. Washington, D.C.:  September 29, 2014.
Chemical Regulation: Observations on the Toxic Substances Control Act  and EPA Implementation. GAO-13-696T. Washington, D.C.: June 13,  2013.
Chemical Assessments: An Agencywide Strategy May Help EPA Address  Unmet Needs for Integrated Risk Information System Assessments.  GAO-13-369. Washington, D.C.: May 10, 2013.
Toxic Substances: EPA Has Increased Efforts to Assess and Control  Chemicals but Could Strengthen Its Approach. GAO-13-249. Washington,  D.C.: March 22, 2013.
Chemical Assessments: Challenges Remain with EPA’s Integrated Risk  Information System Program. GAO-12-42. Washington, D.C.: December  9, 2011.
Chemical Assessments: Low Productivity and New Interagency Review  Process Limit the Usefulness and Credibility of EPA’s Integrated Risk  Information System. GAO-08-440. Washington D.C: March 7, 2008.
section_title: Mitigating Gaps in Weather Satellite Data
subsections: section_title: Why Area Is High Risk
paragraphs: The two federal agencies responsible for managing weather satellites, the  Department of Commerce’s National Oceanic and Atmospheric  Administration (NOAA) and the Department of Defense (DOD), are in  different stages in their efforts to ensure continued weather satellite  coverage in their respective satellite orbits. In recognition of NOAA’s  significant progress, we have narrowed the scope of this high-risk area to  remove the segment on NOAA’s geostationary weather satellites. At the  same time, we are expanding this high-risk area to include a segment on  DOD’s polar-orbiting weather satellites because the agency has been  slow to replace aging satellites and, as a result, is at risk of a gap in  weather satellite data in the early morning orbit. We did not include a  segment on DOD weather satellites in our prior high-risk update because  the department was not, at that time, facing an imminent satellite data  gap.
The United States relies on two complementary types of satellite systems  for weather observations and forecasts: (1) polar-orbiting satellites that  provide a global perspective every morning and afternoon, and (2)  geostationary satellites that maintain a fixed view of the United States.  Both types of systems are critical to weather forecasters, climatologists,  and the military, who map and monitor changes in weather, climate, the  oceans, and the environment. Federal agencies are currently planning or  executing major satellite acquisition programs to replace existing polar  and geostationary satellite systems that are nearing the end of, or  beyond, their expected life spans. Specifically, NOAA is responsible for  the polar satellite program that crosses the equator in the afternoon and  for the geostationary satellite program, while DOD is responsible for the  polar satellite program that crosses the equator in the early morning orbit.  However, these programs have troubled legacies of cost increases,  missed milestones, technical problems, and management challenges that  have reduced functionality and delayed launch dates. As a result, the  continuity of weather satellite data is at risk.
NOAA officials acknowledge that there is a risk of a gap in polar satellite  data in the afternoon orbit, between the time that the current polar  satellite is expected to reach the end of its life and the time when the next  satellite is expected to be in orbit and operational. This gap could span up  to a year or more, depending on how long the current satellite lasts and  whether there are any delays in launching or operating the new one. In  addition, there is a risk of a gap in polar satellite data in the early morning  orbit because DOD has not yet replaced satellites that are nearing the  end of their life spans. While NOAA does not anticipate gaps in  geostationary satellite observations, such a gap could occur if the  satellites currently in orbit do not last as long as anticipated or if the major  satellite acquisition currently underway encounters schedule delays.
According to NOAA program officials, a satellite data gap would result in  less accurate and timely weather forecasts and warnings of extreme  events—such as hurricanes, storm surges, and floods. Such degraded  forecasts and warnings would endanger lives, property, and our nation’s  critical infrastructures. Similarly, according to DOD officials, a gap in  space-based weather monitoring capabilities could affect the planning,  execution, and sustainment of U.S. military operations around the world.  Given the criticality of satellite data to weather forecasts, the likelihood of  significant gaps, and the potential impact of such gaps on the health and  safety of the U.S. population and economy, we concluded that the  potential gap in weather satellite data is a high-risk area and added it to  the High-Risk List in 2013. It remained on the High-Risk List in 2015. the Geostationary Operational Environmental Satellite-R (GOES-R)  series. Moreover, the agency successfully launched this satellite in  November 2016 and is now better able to ensure continuous satellite  coverage.
In contrast, we are expanding the high-risk area to include a segment on  DOD’s polar-orbiting satellite program, which provides weather  observations in the early morning orbit. The department has been slow to  establish plans for its follow-on satellite program and has made little  progress in determining how it will meet selected weather satellite  requirements in the early morning orbit. Moreover, DOD is currently  relying on an older satellite that is well past its expected life span. As a  result, there is a real risk of a weather satellite data gap in the early  morning orbit. Such a gap could negatively affect military operations that  depend on weather data.
section_title: What GAO Found
paragraphs: The two federal agencies responsible for managing weather satellites,  NOAA and DOD, are in different stages in their efforts to ensure  continued weather satellite coverage in their respective satellite orbits.  NOAA’s efforts to strengthen mitigation planning for its polar-orbiting  satellites in the afternoon orbit have resulted in it meeting three of the five  criteria for removal from the high-risk area: leadership commitment,  capacity, and monitoring progress. Specifically, NOAA has demonstrated  leadership commitment in mitigating data gaps on its polar-orbiting  weather satellites by establishing gap mitigation action plans, improving  its computing capacity, and monitoring progress in implementing multiple  mitigation activities. However, the agency has not yet addressed key  shortfalls in its gap mitigation plans and several mitigation projects are not  yet complete. Moreover, the agency recently decided to delay the launch  date of the next polar-orbiting satellite due to problems in development.  These issues increase the likelihood of a data gap in the afternoon orbit.  The agency’s efforts to further improve its gap mitigation plans, complete  gap mitigation projects, and successfully launch the next polar satellite  will help ensure that it is in a good position to mitigate the possibility of  gaps in satellite data.
Aeronautics and Space Administration (NASA) successfully launched the  latest geostationary weather satellite in November 2016, a step which  improved the agency’s ability to ensure robust satellite coverage. In  recognition of the agency’s significant progress, we have narrowed the  scope of this high-risk area to remove the segment on NOAA’s  geostationary satellites.
On the other hand, DOD has been slow to establish a new satellite  program, selected high-priority capabilities are not addressed by the  department’s planned program, and problems with existing satellites have  increased the risk of a gap in satellite data in the early morning orbit. In  October 2016, over 6 years after the department was directed to establish  a program to launch new satellites in the early morning orbit, DOD  established a plan for its Weather Satellite Follow-on—Microwave  program. The department plans to launch the first operational satellite  under this program in 2022. However, this program does not address two  high-priority capabilities—cloud characterization and area-specific  weather imagery—and the department has not yet determined how it will  provide those capabilities. Further, DOD’s primary satellite in the early  morning orbit failed in February 2016, and the department is now using  an older satellite that is well past its expected life span. Until the  department launches its next satellite and establishes a plan to provide  the two high-priority capabilities, it faces a significant risk of a gap in  satellite data should the existing operational satellite fail. As a result of  DOD’s limited progress in developing and implementing a plan to fulfill its  weather satellite requirements, we are expanding this high-risk area to  include a segment on DOD’s progress in addressing the need for satellite  coverage in the early morning orbit.
Over the last 4 years, congressional committees have held multiple  hearings to address this high-risk area. Examples include:
Subcommittees of the House Science, Space, and Technology  Committee have held multiple hearings to provide oversight of major  satellite acquisitions and the risk of gaps in satellite coverage  (September 2013, February 2015, December 2015, July 2016) and on  private sector weather forecasting (May 2015, June 2016).
In March 2016, the Subcommittee on Commerce, Justice, Science,  and Related Agencies of the Senate Appropriations Committee held a  hearing on the President’s fiscal year 2017 budget proposal that  included a discussion of current and future satellite programs.
In July 2016, the House Science, Space, and Technology  Committee’s Subcommittee on Environment held a hearing to provide  oversight of DOD’s efforts to plan a new satellite acquisition and  address the potential for gaps in satellite coverage.
Also over the last 4 years, Congress has worked on legislation to address  this high-risk area. Examples include:
The Weather Research and Forecasting Innovation Act of 2015 was  introduced as a bill in the House of Representatives to advance  programs and activities related to improving weather warnings and  forecasts—including analysis of potential observing system gaps— and clarifying NOAA’s ability to access commercial weather data and  products.
Congress appropriated funds for satellite data gap mitigation activities  through the Disaster Relief Appropriations Act, 2013.
section_title: What Remains to Be Done
subsections: section_title: NOAA’s Weather Satellites
paragraphs: address residual shortfalls in its mitigation plan, including providing  key information about the cost and effects of the mitigation options,  and establishing when the testing of selected options would be  completed (this is a recommendation that we identified as a priority  recommendation to the Secretary of Commerce); and demonstrate progress by completing the remaining gap mitigation  projects identified in the polar satellite gap mitigation plan, including  addressing the technical challenges that delayed the scheduled  launch date for the next satellite, deciding when the next satellite will  be launched, and acting to ensure a timely and successful launch.
section_title: DOD’s Polar-Orbiting Weather Satellites
paragraphs: DOD has made limited progress in its efforts to replace aging satellites  and is now at risk of a gap in weather satellite data in the early morning  orbit. As a result, we are expanding this high-risk area to include DOD’s  polar-orbiting weather satellites. The department needs to demonstrate progress on its next generation of weather satellites,  called the Weather System Follow-on—Microwave (WSF-M) program,  to address the risk of a gap in the early morning orbit; and establish and implement plans to mitigate the risk of a gap in the high- priority capabilities that are not included in WSF-M .
section_title: Additional Details on What GAO Found
subsections: section_title: NOAA’s Polar-Orbiting Weather Satellites
subsections: section_title: Leadership Commitment
paragraphs: NOAA has met the criterion of demonstrating a strong leadership  commitment to mitigating potential gaps in polar-orbiting satellite data. In  April 2015, NOAA issued an updated polar satellite gap mitigation plan  which identifies the specific technical, programmatic, and management  steps the agency is taking to ensure that satellite mitigation options are  viable. Moreover, NOAA continues to oversee the implementation of 35  gap mitigation projects, including efforts to assimilate data from new  sources into weather models and to explore how manned and unmanned  aircraft observations could increase the accuracy of numerical weather  predictions for high-impact weather events. In addition, NOAA executives  oversee the acquisition of the next generation of polar-orbiting satellites  through monthly briefings on the cost, schedule, and technical risks  affecting the satellites’ development and planned launch dates.
section_title: Capacity
paragraphs: performance computing capacity resulted in reduced scope or delayed  work on other critical mitigation projects, and recommended that NOAA  investigate ways to prioritize the gap mitigation projects with the greatest  potential benefit to weather forecasting. NOAA agreed with this  recommendation, implemented it, and has since completed efforts to  improve its high-performance computing capacity. Specifically, in May  and December 2015, the agency completed upgrading its high- performance computers that support research and operations. These  upgrades allowed the agency to move forward on multiple other mitigation  activities, including experimenting with other data sources and  assimilating these data into its weather models.
section_title: Action Plan
paragraphs: NOAA has partially met the criterion for having a plan to address the risk  of a polar satellite data gap. In April 2015, NOAA issued an updated  satellite mitigation plan, which includes several improvements over its  prior plan. For example, in response to a recommendation we made in  December 2014 to address shortfalls in the mitigation plan, NOAA’s latest  plan includes an expanded list of mitigation projects and identifies  opportunities for accelerating the availability of satellite products after the  next satellite is launched. However, the agency has not yet addressed  residual shortfalls in its mitigation plan, including providing key  information about the cost and impact of the mitigation options, and  establishing when the testing of selected options would be completed.  Until NOAA fully addresses the shortfalls in its gap mitigation plan, it may  not be sufficiently prepared to mitigate potential gaps in polar satellite  coverage.
section_title: Monitoring
paragraphs: NOAA has met the criterion for monitoring progress on its gap mitigation  activities, which is an increase over its prior rating. In December 2014, we  reported that NOAA’s oversight of its many gap mitigation projects was  not consistent or comprehensive. For example, only one of three NOAA  organizations had briefed management on a monthly basis on the status  of its mitigation projects and the agency had not yet reported progress on  nine mitigation activities outlined in its plan. We recommended that NOAA  ensure that the relevant entities provide regular progress updates on all  mitigation projects and activities. NOAA agreed and implemented this  recommendation. All three responsible NOAA organizations are now  regularly briefing management on all active gap mitigation projects.
section_title: Demonstrated Progress
paragraphs: categories: (1) understanding the likelihood and impact of a gap, (2)  reducing the likelihood of a gap, and (3) reducing the impact of a gap. As  of May 2016, 16 projects had been completed; 18 were ongoing; and 1  was planned for the future. However, one of the most important steps in  reducing the likelihood of a gap—keeping the launch of the next polar  satellite on schedule—has had problems. While NOAA targeted a March  2017 launch date for the next polar-orbiting satellite, agency officials  recently decided to delay the launch by 4 to 6 months due to problems in  developing the ground system and a critical instrument on the spacecraft.  This launch delay exacerbates the probability of a gap in satellite data  since the current operational satellite is now past its expected 5-year life  span and one key instrument on that satellite has been experiencing  technical issues.
NOAA acknowledged that if this instrument fails before the next satellite is  launched and operational, it would result in degraded weather forecasts,  exposing the nation to a 15 percent chance of missing an extreme  weather event forecast. While NOAA has made progress on its many  mitigation projects, the agency acknowledges that no steps will  completely mitigate a sudden failure of the primary operational polar- orbiting satellite. Until NOAA demonstrates that it is making swift and  effective progress in mitigating potential near-term gaps in polar satellite  data, there will be a growing risk that degraded forecasts and warnings  will negatively impact the U.S. population and economy.
section_title: NOAA’s Geostationary Weather Satellites
subsections: section_title: Leadership Commitment
paragraphs: NOAA has met the criterion of demonstrating strong leadership  commitment to mitigating potential gaps in geostationary satellite data by  revising and improving its geostationary satellite contingency plans,  updating an assessment of the viability of the program schedule leading  up to the launch date, and taking steps to ensure that the GOES-R  satellite was successfully launched in November 2016.
section_title: Capacity
paragraphs: NOAA has met the criterion for ensuring it has the capacity to address the  risk of a gap in backup coverage, which is an increase over its prior  rating. Over the past several years, the agency has demonstrated its  ability to mitigate operational satellite outages by monitoring the health of  the satellites and by moving a backup satellite into operation when  needed. Moreover, we rated capacity as partially met in our 2015 report  due to concerns about NOAA’s ability to complete critical testing activities  because it was already conducting testing on a round-the-clock,  accelerated schedule. Since then, NOAA adjusted its launch schedule  from March 2016 to November 2016 to allow time to complete critical  integration and testing activities.
section_title: Action Plan
paragraphs: rating. In December 2014, we reported on shortfalls in the satellite  program’s gap mitigation/contingency plans and made recommendations  to NOAA to address these shortfalls. For example, we noted that the plan  did not sufficiently address strategies for preventing a launch delay,  timelines and triggers to prevent a launch delay, and whether any of its  mitigation strategies would meet minimum performance levels. NOAA  agreed with these recommendations and released a new version of its  geostationary satellite contingency plan in February 2015. The new plan  includes information on steps planned or underway to mitigate potential  launch delays, the potential impact of failure scenarios in the plan, and  the minimum performance levels expected under such scenarios.
section_title: Monitoring
paragraphs: NOAA has met the criterion for monitoring progress in addressing its  risks. Officials responsible for satellite operations actively monitor the  health of the satellite constellation and are prepared to implement  contingency operations if they are warranted. In addition, GOES-R  program officials actively monitored and analyzed the program schedule  in order to minimize changes to the launch date. Program officials also  regularly report to senior managers on progress and risks.
section_title: Demonstrated Progress
paragraphs: NOAA has met the criterion for demonstrating progress in mitigating risks,  which is an increase over its prior rating. In September 2013, we reported  that the agency had weaknesses in its schedule management practices  on its core ground system and spacecraft, and we made  recommendations to address those weaknesses. The weaknesses  pertained to the sequencing of all activities, ensuring there were adequate  resources for the activities, and conducting a schedule risk analysis.  NOAA agreed with the recommendations and the GOES-R program  made improvements to its schedule management practices. In early  2016, the program improved the links between remaining activities on the  spacecraft schedule, included needed schedule logic for a greater  number of activities on the ground schedule, and included indications in  the ground schedule that the results of a schedule risk analysis were  used in calculating the duration of its activities.
In addition, the GOES-R program made significant progress in developing  and testing the GOES-R satellite and successfully launched it in  November 2016. The agency now has a robust constellation of  operational satellites and backup satellites in orbit. As a result, the  agency has made significant progress in addressing the risk of a gap in  geostationary satellite data coverage.
section_title: DOD’s Polar-Orbiting Weather Satellites
paragraphs: In 2010, when the Executive Office of the President decided to disband a  tri-agency polar weather satellite program, DOD was given responsibility  for providing polar-orbiting weather satellite capabilities in the early  morning orbit. However, the department was slow to develop plans to  replace its existing satellites that provide this coverage. The department  conducted a requirements review and analysis of alternatives from  February 2012 through September 2014 to determine the best way  forward for providing needed polar-orbiting satellite environmental  capabilities in the early morning orbit. In October 2016, DOD approved  plans for the WSF-M program. Through this program, the department  plans to launch a demonstration satellite in 2017 and to launch its first  operational satellite in 2022.
However, DOD’s plans for the early morning orbit are not comprehensive.  The department did not thoroughly assess options for providing its two  highest-priority capabilities (cloud characterization and area-specific  weather imagery) due to an incorrect assumption about the capabilities  that would be provided by international partners. WSF-M does not include  these two highest-priority capabilities and the department has not yet  determined its long-term plans for providing them.
Due to DOD’s delay in establishing plans for its next generation of  weather satellites, there is now a significant risk of a satellite data gap in  the early morning orbit. The last satellite that the department launched,  called Defense Meteorological Satellite Program (DMSP)-19, stopped  providing recorded data used in weather models in February 2016. A prior  satellite, called DMSP-17, is now the primary satellite operating in the  early morning orbit. However, this satellite was launched in 2006 and is  operating with limitations due to the age of its instruments. DOD had  developed another satellite, called DMSP-20, but plans to launch that  satellite were canceled after the department did not certify that it would  launch the satellite by the end of calendar year 2016. As a result, the  department will need to continue to rely on the older DMSP-17 satellite  until (1) its new satellite becomes operational in 2022, and (2) it  determines how it will address the high priority capabilities that the new  satellite will not provide. Given the age of the DMSP-17 satellite and  uncertainty on how much longer it will last, the department could face a  gap in critical satellite data that lasts for years. options for acquiring and fielding new equipment, such as satellites and  satellite components, to provide the capabilities. In addition, the  department anticipates that the demonstration satellite to be developed  as a precursor to WSF-M could help mitigate a potential gap by providing  some data. However, these proposed solutions may not be available in  time or be comprehensive enough to avoid near-term coverage gaps.  Such gaps could negatively affect operations that depend on weather  data, such as long-range strike capabilities and aerial refueling.
Over the next 2 years, we will assess DOD’s progress in addressing  polar-orbiting weather satellites against the high-risk criteria and will  report this information as appropriate.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: Examples of benefits achieved over the last 4 fiscal years by  implementing our recommendations include the following actions by  NOAA:  Improving its gap mitigation/contingency plans for its polar-orbiting  weather satellites.
Prioritizing its gap mitigation efforts supporting its polar-orbiting  weather satellites.
Improving its oversight of its gap mitigation projects for its polar- orbiting weather satellites.
Improving its schedule management practices on its geostationary  satellite program.
Improving its outreach to key external users of geostationary satellite  data.
Addressing shortfalls in its geostationary gap mitigation plans. its plan in April 2015 and addressed several of the identified shortfalls.  However, we also reported that the plan does not include all elements  needed to fully implement our recommendation, such as a schedule with  meaningful timelines and linkages among mitigation activities. NOAA  plans to update its polar satellite contingency plan to address these  residual shortfalls in early 2017.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact David Powner  at (202) 512-9286, or pownerd@gao.gov.
section_title: Related GAO Products
paragraphs: Environmental Satellites: NOAA Needs to Ensure Its Timelines Are  Accurate, Clear, and Fully Documented.GAO-16-767. Washington, D.C.:  September 8, 2016.
Polar Satellites: NOAA Faces Challenges and Uncertainties that Could  Affect the Availability of Critical Weather Data. GAO-16-773T.  Washington, D.C.: July 7, 2016.
Defense Weather Satellites: DOD Faces Acquisition Challenges for  Addressing Capability Needs. GAO-16-769T. Washington, D.C.: July 7,  2016.
Polar Weather Satellites: NOAA Is Working to Ensure Continuity but  Needs to Quickly Address Information Security Weaknesses and Future  Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.
Defense Weather Satellites: Analysis of Alternatives Is Useful for Certain  Capabilities, but Ineffective Coordination Limited Assessment of Two  Critical Capabilities. GAO-16-252R. Washington, D.C.: March 10, 2016.
Environmental Satellites: Launch Delayed; NOAA Faces Key Decisions  on Timing of Future Satellites. GAO-16-143T. Washington, D.C.:  December 10, 2015.
Environmental Satellites: Improvements Needed in NOAA’s Mitigation  Strategies as It Prepares for Potential Satellite Coverage Gaps.  GAO-15-386T. Washington, D.C.: February 12, 2015.
Polar Weather Satellites: NOAA Needs To Prepare for Near-term Data  Gaps . GAO-15-47. Washington, D.C.:  December 16, 2014.
Geostationary Weather Satellites: Launch Date Nears, but Remaining  Schedule Risks Need to be Addressed. GAO-15-60. Washington, D.C.:  December 16, 2014.
section_title: DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management
subsections: section_title: Why Area Is High Risk
paragraphs: Since our high-risk report in February 2015, the Department of Energy  (DOE) continued to meet the leadership commitment criterion and to  partially meet the criterion for having a corrective action plan. DOE has  improved its monitoring of the effectiveness of corrective measures and  now partially meets this criterion. DOE did not meet the criterion for  having the capacity to resolve contract and project management  problems, nor did DOE meet the criterion for demonstrating progress  toward implementing measures to resolve high-risk areas.
DOE oversees a broad range of programs related to nuclear security,  science, energy, and nuclear waste cleanup, among other areas. To  support these missions, DOE has several offices, each of which oversees  numerous programs that often design and construct large capital asset  projects to meet the department’s mission needs. DOE relies primarily on  contractors to carry out its programs. It is the largest civilian contracting  agency in the federal government, and spends approximately 90 percent  of its fiscal year 2017 funding of more than $32 billion on contracts and  large capital asset projects. We designated DOE’s contract  management—which has included both contract administration and  project management—a high-risk area in 1990 because DOE’s record of  inadequate management and oversight of contractors has left the  department vulnerable to fraud, waste, abuse, and mismanagement.
In January 2009, to recognize progress made at DOE’s Office of Science,  we narrowed the focus of DOE’s high-risk designation to 2 DOE program  elements—the Office of Environmental Management (EM) and the  National Nuclear Security Administration (NNSA). Together, these 2  elements accounted for almost 60 percent of DOE’s annual budget. In  February 2013, we further narrowed the focus of the high-risk designation  to NNSA and EM’s major contracts and projects—those with an estimated  cost of $750 million or greater—to acknowledge progress made in  managing nonmajor projects, those with an estimated cost below $750  million. We continue to monitor DOE’s management of nonmajor projects  to ensure that progress in this area is sustained. implemented corrective actions that aim to identify and address root  causes of persistent project management challenges and implement  solutions. Since our 2015 assessment, we also observed progress in  DOE’s monitoring of the effectiveness and sustainability of corrective  measures. As in previous years, however, EM and NNSA struggled to  ensure they have the capacity (both people and resources) to mitigate  risks. They have also demonstrated limited progress in contract  management, particularly in the area of financial management, and have  struggled to stay within cost and schedule estimates for some major  projects.
section_title: What GAO Found
paragraphs: DOE has made progress in its contract and project management. DOE  continued to meet the criterion for demonstrating a strong commitment  and top leadership support for improving project management. The  Secretary of Energy issued two memorandums, in December 2014 and  June 2015, that lay out a series of changes to policies and procedures to  improve project management. These changes were included in DOE’s  revised project management order, DOE Order 413.3B, issued in May  2016. As noted in the memorandums, some of these changes are in  response to recommendations we made in prior years, such as requiring  that projects develop cost estimates and analyses of alternatives  according to our best practices.
According to DOE officials, the two memorandums serve as DOE’s  corrective action plan, but we note that this plan does not appear to be  comprehensive and, as such, DOE continues to partially meet this  criterion. Specifically, DOE’s corrective action plan does not address 1)  acquisition planning for its major contracts—a phase during which critical  contract decisions are made that have significant implications for the cost  and overall success of an acquisition; 2) the quality of enterprise-wide  cost information available to DOE managers and key stakeholders; 3)  DOE’s need for a program management policy; and 4) how DOE’s new  requirements will be applied to the department’s major legacy projects,  which receive billions of dollars in annual funding and often present the  most intractable project management challenges. executes its major projects and programs, but additional time is needed  for us to assess how effectively these recent monitoring improvements  will validate the sustainability of corrective measures. We have not yet  evaluated the operations of the newly created Project Management Risk  Committee (PMRC). In addition, DOE’s new oversight and monitoring  efforts are not comprehensive, as certain activities within EM are not  subject to review by the PMRC, even though together they cost billions of  dollars and last for numerous years. Finally, the effectiveness of DOE’s  monitoring of its contracts, projects, and programs depends upon the  availability of reliable enterprise-wide cost information on which to base  oversight activities.
DOE did not meet the criterion for having the capacity to mitigate risks  with project and contract management. Since 2015, DOE has taken steps  to improve capacity, such as increasing its number of contract specialists,  but even with these recent steps, capacity challenges remain. The  Secretary’s December 2014 and June 2015 memorandums were  generally silent on capacity issues. In several recently issued reports, we  found capacity shortfalls in key contract management functions, including  cost and schedule performance evaluation, as well as in oversight of  major projects and programs. For example, in May 2015, we found that  NNSA had not determined whether it has sufficient, qualified personnel to  ensure it used information from contractor assurance systems (CAS)  consistently, which include information on contractors’ cost and schedule  performance. In 2016, DOE issued a new Supplemental Directive on  NNSA Site Governance requiring NNSA to develop training for NNSA  organizations to help them implement the governance model that relied  on information from CAS for oversight, but it is unclear whether this  training has been developed and initiated. In November 2016, we found  that DOE and NNSA had not established training programs, such as a  career development program, for program managers. On December 14,  2016, the President signed the Program Management Improvement  Accountability Act. The act, among other things, requires that each  agency head appoint a Program Management Improvement Officer, who  must develop a strategy for enhancing the role of program managers  within the agency that includes enhanced training and educational  opportunities for program managers. Finally, in July 2016, we found  problems with DOE’s effort to evaluate the environment for raising  concerns without fear of reprisal. are in the early stages, and more time is needed to assess the  effectiveness of corrective measures and associated progress, especially  with respect to ongoing major projects. DOE has taken significant actions  regarding two of its six ongoing major projects but continues to encounter  significant project management challenges, cost increases, and schedule  delays on others. In addition, even though we removed nonmajor projects  from our High-Risk List, we continue to monitor how DOE manages these  projects to ensure that DOE sustains progress in this area. Finally, DOE’s  recent reforms do not address contract management, and our work since  the last high-risk report has identified several significant challenges with  DOE contract management on which DOE has taken little action.  Specifically, in May 2015, we found that NNSA had not established  policies or guidance specific to using information from CAS to evaluate  management and operations (M&O) contractor performance.
Congress has taken several actions related to this high-risk area. For  example, the fiscal year 2016 National Defense Authorization Act (NDAA)  was enacted with several provisions on the basis of our  recommendations, including modifications to requirements for cost-benefit  analyses for competing management and operating contracts and  additional requirements related to the oversight of the Hanford Waste  Treatment and Immobilization Plant (WTP). In addition, the Senate Armed  Services Committee report accompanying the fiscal year 2017 NDAA  included requirements for DOE relevant to many issues highlighted in our  high-risk report, including specific provisions for the Mixed Oxide (MOX)  Fuel Fabrication Facility, the Chemistry and Metallurgy Research  Replacement (CMRR) project, and the WTP. The Senate Armed Services  Committee also held hearings in 2015 and 2016 on challenges identified  in this high-risk area. We testified on our observations on DOE’s  management challenges and the steps taken to address them. The  House Energy and Commerce Committee also held a hearing in 2015 in  which we testified on the actions needed to improve DOE and NNSA  oversight of management and operating contracts.
section_title: What Remains to Be Done
paragraphs: Capacity: DOE will need to commit sufficient people and resources to  resolve its project, program, and contract management problems. DOE  must develop a strategy to address these needs. We note that the  initiatives DOE established in 2015, some of which we described in our  last high-risk report, are not yet complete. NNSA’s issuance of a new  Supplemental Directive on NNSA Site Governance is a good first step  toward addressing the recommendations we made with regard to the  agency’s capacity to conduct oversight activities using information from  CAS. Specifically, the Supplemental Directive includes requirements for  NNSA’s Office of Safety, Infrastructure and Operations to develop training  for NNSA organizations to assist their implementation of the site  governance model and to annually review and update the training as  needed to ensure continuous improvement. However, NNSA has not yet  established comprehensive guidance, beyond the general framework  described in the new Supplemental Directive, to consistently implement  the described governance model across the nuclear security enterprise,  and this is needed to ensure that the training developed is aligned with  the specifics of that governance model.
In addition, significant additional action is required by both EM and NNSA  to fully address our recommendations. DOE must implement program  management policies and develop a strategy for enhancing the role of  program managers, including for training, as required by the Program  Management Improvement Accountability Act, and address our and  others’ recommendations on whistleblower protection to ensure a safety- conscious work environment where staff are encouraged to use their  expertise, identify risks, and proactively mitigate them without fear of  workplace retaliation.
Action Plan: DOE will need to ensure that its corrective action plan is  comprehensive and addresses all root causes—including all front-end  planning challenges and contract and program management, as well as  capacity issues. To be considered a corrective action plan, DOE’s plan  must also set milestones and timelines, assign responsibilities for  implementing and completing corrective measures, and identify  mechanisms to monitor progress and provide measurable outcomes.  DOE must also ensure the corrective action plan includes steps  necessary to implement solutions we and others have recommended. address acquisition planning for its major contracts, the quality of  enterprise-wide cost information, and how DOE’s new requirements will  be applied to major legacy projects. Finally, we will monitor how DOE  applies—enterprise-wide—the standards, policies and guidelines for  program management that are to be established at federal agencies in  response to the Program Management Improvement Accountability Act.
Monitoring: DOE will need to continue to monitor and independently  validate the effectiveness and sustainability of its corrective measures,  particularly for major projects. Meeting the monitoring criterion will require  a comprehensive corrective action plan—as described above—against  which progress can be monitored. DOE has created the PMRC to track  progress of projects across the agency, but it is too early to assess its  effectiveness, especially on major projects. As a next step, DOE should  create a framework in which the PMRC and programs use existing and  other tools as needed to track progress against a comprehensive  corrective action plan and regularly update the plan with progress and  any newly identified root causes based on the PMRC’s validation of  completion.
DOE should also ensure it has the reliable, enterprise-wide cost  information that is needed to effectively monitor projects and programs.  DOE will also need to ensure that EM’s operations activities that are  currently outside of project management requirements are included in this  framework and are subject to comparable monitoring and oversight by the  PMRC or another body.
Demonstrated Progress: DOE will need to demonstrate progress in  implementing corrective measures, especially measures intended to  improve the performance of major projects and contracts. For example,  for projects, DOE must continue to show improvements on meeting cost  and schedule targets and a commitment to applying new requirements to  all of its major projects. DOE should also continue to monitor progress  and apply corrective measures to nonmajor projects. For contracts, once  DOE’s corrective action plan addresses contract management, DOE must  apply these measures to address its longstanding contract management  problems. More specifically, DOE should address some of the problems  we found, such as developing a contract management framework  addressing the use of CAS so that DOE staff have the ability to evaluate  contractor performance.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: The department continued to meet the criterion for demonstrating a  strong commitment and top leadership support for improving project  management in EM and NNSA. The Secretary of Energy issued two  memorandums, in December 2014 and June 2015, that lay out a series of  changes to policies and procedures to improve project management. The  Secretary’s changes were included in DOE’s revised project management  order, DOE Order 413.3B, issued in May 2016. As noted in the  memorandums, some of these changes are in response to  recommendations we made in prior years, as shown in the following  examples:
DOE added requirements for program offices to conduct a root cause  analysis if a major project is expected to exceed its approved cost or  schedule.
DOE added requirements for program offices to ensure that major  projects’ designs and technologies are sufficiently mature before  contractors are allowed to begin construction.
DOE added a requirement to its revised project management order for  program offices to conduct analyses of alternatives consistent with  industry best practices, independent of the contractor organization  responsible for managing the construction or constructing a capital  asset project.
DOE added a requirement to its project management order that  projects’ cost estimates be developed, maintained, and documented  in a manner consistent with industry best practices. DOE also  required that its cost estimating guidance and Acquisition Regulations  be consistent with cost estimating best practices reflected in our Cost  Estimating and Assessment Guide. responsible for reviewing all capital asset projects with a total project cost  of $100 million or more. DOE officials told us that the ESAAB met 16  times in fiscal year 2015 and 14 times in fiscal year 2016 after not  meeting at all during fiscal years 2013 and 2014. The Secretary also  created the PMRC, which includes senior DOE officials and is chaired by  a new departmental position—the Chief Risk Officer (CRO). According to  its charter, the committee meets biweekly to assess the risks of projects  across the department, as well as to advise DOE senior leaders and the  ESAAB on cost, schedule, and technical issues for projects.
We also continue to monitor nonmajor projects, and we note that the  Secretary’s December 2014 and June 2015 memorandums applied  project management reforms to nonmajor projects previously not subject  to such requirements. For example, DOE’s new project management  reforms require full upfront funding for projects costing $50 million or  less—a reform that should help deliver such projects on time and within  costs. Notably, DOE’s performance in meeting cost and schedule  milestones for nonmajor projects continues to improve, with nearly 95  percent of such projects meeting cost and schedule milestones over the  last 3 years, according to DOE officials.
section_title: Capacity
paragraphs: DOE did not meet the criterion for having the capacity to mitigate risks  with project and contract management. The department has long faced  challenges in ensuring it has the right number of qualified individuals in  crucial oversight areas. For example, we first noted capacity shortfalls in  the department’s contract management in our 1994 high-risk report. At  that time, we noted that the department did not have the necessary staff  expertise and information systems to monitor contractors. In our February  2015 high-risk report, we found that DOE did not meet this criterion and  noted that an internal DOE review determined that the department had an  extremely low number of contract specialists. We noted in our 2015 high- risk report that DOE had established the Acquisition Fellows Program to  recruit, acquire, develop, and retain contract specialists, and NNSA had  signed an agreement with the U.S. Army Corps of Engineers (USACE) to  supplement NNSA’s capacity needs.
Since 2015, DOE has taken the following steps to improve capacity:
DOE increased its number of contract specialists by 4, from 550 to  554. In November 2016, DOE officials told us that the department still  faces shortfalls of contract specialists. They noted that there are  statutory caps on the number of staff DOE can hire.
The Acquisition Fellows Program’s first class of 11 participants is  expected to graduate in January 2017. DOE is analyzing lessons  learned from the program’s first cohort and determining ways to  improve the program for the second cohort.
NNSA officials stated that they continue to use USACE specialists  because it helps NNSA manage its workload within the statutory  workforce caps. DOE officials also stated that, on the basis of a  USACE staffing model, NNSA recently increased the number of staff  on certain major projects, in some cases more than doubling the  number of staff responsible for project management activities.
Even with these recent steps, capacity challenges remain. The  Secretary’s December 2014 and June 2015 memorandums—which DOE  has stated serve as its corrective action plan—were generally silent on  capacity issues. The Secretary’s memorandums required the department  to create a Project Leadership Institute and both the ESAAB and PMRC  are to evaluate, among other things, issues related to organization and  staffing if such factors present a risk to a project; however, other capacity  issues, such as those related to contract oversight, were not explicitly  addressed.
In several recently issued reports, we found capacity shortfalls in key  contract management functions, including cost and schedule performance  evaluation, as well as in oversight of major projects and programs, as  shown in the following examples:  In May 2015, we found that NNSA had not determined whether it has  sufficient, qualified personnel to ensure it used information from CAS  consistently, which include information on contractors’ cost and  schedule performance. Federal field office officials raised concerns  that staffing levels and the mix of staff skills may not be adequate to  use information from CAS to conduct appropriate oversight, potentially  resulting in NNSA staff over relying on this information without the  ability to ensure it is reliable. project, field office, and functional managers, it appears that the scope  of this staffing assessment may not address all aspects covered by  the supplemental directive itself.
In May 2015, we found that DOE faced persistent and significant  technical and management challenges at its WTP at Hanford and,  consequently, we recommended that DOE take steps to augment its  capacity to oversee the contractor. External reviews found that  technical challenges continue to affect the facilities needed to treat  radioactive waste, and the extent of the challenges was beyond the  capacity of DOE to monitor and prevent recurrence. Under the WTP  construction contract, and as recommended by an external DOE  advisory group, DOE can employ an owner’s agent to help the  department review the contractor’s approach to design management  and mitigate design challenges.
We recommended that DOE enlist the services of another agency or  external entity to serve as an owner’s agent in reviewing and  evaluating the WTP contractor’s design and approach to mitigating  design challenges. Congress also included a provision in the 2016  NDAA requiring DOE to enlist the services of an owner’s agent who  was to have certain oversight responsibilities independent of the  contractor. In 2016, DOE instituted an owner’s representative, but the  responsibilities of the owner’s representative do not include key  elements of an owner’s agent’s responsibilities that we discussed in  our report, such as independence and authority to oversee the  contractor’s approach to design management.
In February 2016, we found that the B-61-12 Life Extension Program  faced staff shortfalls. We reported that NNSA may need about two or  three times more personnel in the federal program manager’s office to  ensure sufficient federal oversight. NNSA’s federal program office  employs about 20 people—8 federal FTEs and about 12 FTE- equivalent contractors—to manage NNSA activities. In contrast, the  Air Force office—the armed service office responsible for air-delivered  weapons such as the B61—employs about 80 federal FTEs and  contractors to manage comparable Air Force activities. with about $287 million in contract spending, compared with a federal  government average of $9 million per procurement employee.
In November 2016, we found that DOE faced capacity challenges in  program management. Program management can help ensure that a  group of related projects and activities are managed in a coordinated  way to obtain benefits not available from managing them individually.  This approach helps federal agencies get what they need, at the right  time, and at a reasonable price. We found that DOE and NNSA had  not established training programs, such as a career development  program, for program managers. In contrast, DOE has established a  training program for project managers, which the department said is  open to program managers. In the absence of a current DOE or  NNSA training program for program managers, most of the NNSA  program managers we interviewed did not have training related to  program management. As a result, NNSA may have difficulty  developing and maintaining a cadre of professional, effective, and  capable program managers. We recommended that DOE establish a  training program for program managers.
Notably, a new federal law may help NNSA address some of its  capacity challenges in program management. In December 2016, the  President signed the Program Management Improvement  Accountability Act. The act, among other things, requires the Director  of the Office of Personnel Management, in consultation with the  Director of the Office of Management and Budget, to issue regulations  that identify key skills and competencies needed for program and  project managers; establish a new job series, or update and improve  an existing job series; and establish a new career path for program  and project managers. The act also requires that each agency head  appoint a Program Management Improvement Officer, who must  develop a strategy for enhancing the role of program managers within  the agency that includes enhanced training and educational  opportunities for program managers. that several factors may limit the use and effectiveness of mechanisms  for contractor employees to raise concerns and seek whistleblower  protections. We also found that DOE infrequently used its enforcement  authority to hold contractors accountable for unlawful retaliation against  whistleblowers, issuing just 2 violation notices in the past 20 years.  Additionally, in 2013, DOE determined that it does not have the authority  to enforce a key aspect of policies that prohibit retaliation for nuclear  safety-related issues—despite having taken such enforcement actions  previously.
We made several recommendations, including that DOE independently  assess the environment for raising concerns, evaluate whether the  whistleblower pilot program will mitigate challenges with the existing  program, expedite time frames for clarifying regulations, and clarify  policies to hold contractors accountable. DOE concurred with most of  these recommendations. In August 2016, DOE issued a proposed rule to  change DOE’s nuclear safety rules to clarify the department’s authority to  assess civil penalties against certain contractors and subcontractors for  violating the prohibition against retaliating against whistleblowers. The  comment period closed in September 2016, and DOE is now considering  the comments that were submitted.
In September 2016, DOE also updated its Order 221.1B that establishes  the requirements and responsibilities for reporting fraud, waste, and  abuse. The revised order provides some additional specificity to its Office  of Inspector General’s role in processing employee allegations and  provides additional language intended to prohibit contractors from  deterring or dissuading employees from reporting concerns.
section_title: Action Plan
paragraphs: DOE partially met the criterion for having a corrective action plan that  defines root causes and identifies effective solutions. In issuing two  memorandums to improve project management, the Secretary required  project management reforms that—if fully implemented—will help ensure  that future projects are not affected by the challenges that have persisted  for DOE’s major projects. According to DOE officials, the memorandums  serve as DOE’s corrective action plan to address the root causes DOE  identified in its November 2014 report. DOE codified the memorandums’  reforms in its revised project management order, DOE Order 413.3B,  which includes instituting best practices we and industry have identified  for cost estimating, schedule estimating, and applying an analysis of  alternatives (AOA) framework to the early stages of project planning.
DOE also plans to publish a guide to instruct DOE staff on how to conduct  an AOA.
We are encouraged by DOE’s project management reforms but note that  the memorandums and the November 2014 report, as well as associated  changes to DOE’s project management order, do not fully include all  important elements of a corrective action plan. For example, these  documents do not identify goals and performance measures, establish  milestones and metrics for implementing plan goals, or establish  processes for reporting progress. In addition, DOE’s corrective action  plan does not appear to be comprehensive. For example, DOE’s plan  does not address challenges with (1) acquisition planning for its major  contracts, (2) the quality of enterprise-wide cost information, or (3) the  policy on program management. It also does not fully address how DOE  will apply these new requirements to major legacy projects. Specifically:
DOE’s corrective action plan does not address acquisition planning for  its major contracts—a phase during which critical contract decisions  are made that have significant implications for the cost and overall  success of an acquisition. In August 2016, we found that DOE did not  consider acquisition alternatives beyond continuing its longstanding  M&O contract approach for 16 of its 22 M&O contracts. Without  considering broader alternatives, DOE cannot ensure that it is  selecting the most effective scope and form of contract, raising risks  for both contract cost and performance. The size and duration of  DOE’s M&O contracts—22 M&O contracts with an average potential  duration of 17 years, representing almost three-quarters of the  agency’s spending in fiscal year 2015—underscore the importance of  planning for each M&O acquisition.
DOE’s corrective action plan does not address the quality of  enterprise-wide cost information available to DOE managers and key  stakeholders. Reliable enterprise-wide cost information is needed to  identify the cost of activities, to ensure the validity of cost estimates,  and to provide information to Congress to make budgetary decisions.  In January 2017, we found that NNSA’s recently developed plan to  improve and integrate financial data to better understand and  compare costs across NNSA programs, contractors, and sites did not  fully incorporate leading strategic planning practices, which limits its  usefulness as a planning tool as well as the effectiveness of NNSA’s  effort to provide meaningful financial information to Congress and  other stakeholders. NNSA’s plan also contains few details for all the  elements it must include, such as its feasibility assessment, estimated  costs, expected results, and an implementation timeline.
Consequently, NNSA’s plan does not provide a useful roadmap for  guiding NNSA’s effort. We recommended that NNSA develop a plan  for producing cost information that fully incorporates leading planning  practices. NNSA agreed with our recommendation.
DOE’s corrective action plan does not address its need for a program  management policy. For example, in November 2016, we found that  DOE had not established a department-wide program management  policy, and that NNSA had cancelled its program management policy  in 2013 without establishing a new policy in its place. We concluded  that having a policy that incorporates existing key internal control  standards and leading industry program management practices may  help ensure that EM and NNSA program offices are better able to  achieve their missions, goals, and objectives. For example, in an  August 2016 report examining NNSA’s plans to build the CMRR, we  found that the agency had not clarified whether the project would  satisfy the mission needs of other NNSA and DOE programs.
NNSA might have been better able to clarify this project’s mission  needs if DOE and NNSA had been operating under a DOE-wide  program management policy incorporating leading practices. DOE  and NNSA officials said they recognize the importance of establishing  a program management policy, but at the time DOE had not taken  steps to develop such a policy. We recommended that DOE establish  a program management policy addressing internal control standards  and leading practices. DOE had no comments on our  recommendation. After our report was issued, the President signed  the 2016 Program Management Improvement Accountability Act, also  requiring the development of standards, policies, and guidelines for  program and project management across the federal government. As  required in the act, we will continue to monitor and report on its  implementation in connection with our biennial high-risk updates,  including on the effectiveness of the standards, policies, and  guidelines that will be developed.
DOE’s corrective action plan also does not fully address how DOE’s  new requirements will be applied to the department’s major legacy  projects, which receive billions of dollars in annual funding and often  present the most intractable project management challenges. For  example, we found in May 2015 that DOE continues to allow  construction of certain WTP facilities before designs are 90 percent  complete and other facilities before establishing updated cost and  schedule baselines. before establishing cost and schedule baselines and (2) cost and  schedule estimates that meet industry best practices. The WTP is  DOE’s largest project, and it has faced numerous technical and  management challenges that have added decades to its schedule and  billions of dollars to its cost. We recommended in 2015 that DOE  consider limiting construction for certain waste treatment facilities until  technical challenges are addressed, but DOE did not implement our  recommendation. For DOE to fully meet the corrective action criterion,  it must demonstrate its willingness to apply project management  reforms to the projects that need them the most.
Moreover, the department still may not understand all of the root causes  of its contract and project management problems. The most recent  corrective actions taken by DOE represent the third such cycle since  2008, and the root causes DOE identified in November 2014 included  some issues that the department had declared it previously mitigated,  such as difficulties with front-end planning. Specifically, DOE  acknowledged in its November 2014 root cause analysis its longstanding  problems with front-end planning, stating that insufficient front-end  planning has consistently contributed to DOE projects not finishing on  budget or schedule. objectively consider all alternatives, without preference for a particular  solution, as it proceeds with its AOA process. NNSA neither agreed  nor disagreed with our recommendation.
In August 2016, we found problems with DOE’s front-end project  planning at the Waste Isolation Pilot Plant (WIPP) for the new  permanent ventilation system. This system is being built to enable  DOE to resume full operations of the geological nuclear waste  repository, which were suspended after a radiological release  accident in February 2014. DOE did not follow all best practices in  analyzing and selecting an alternative for the new ventilation system  at WIPP, which DOE estimated will cost between $270 million and  $398 million to build and will be completed by the end of March 2021.
For example, DOE did not select the preferred alternative based on  assessing the difference between the life-cycle costs and benefits of  each alternative, as called for by best practices and required by  DOE’s revised project management order. We recommended that  DOE require projects, including the WIPP ventilation system, to  implement recommendations from independent AOA reviews or  document the reasons for not doing so. DOE concurred with the  recommendation and planned to incorporate guidance in its updated  project review guide on how DOE offices should address  recommendations from independent reviews.
section_title: Monitoring
paragraphs: DOE made significant efforts to improve its performance in monitoring  and independently validating the effectiveness and sustainability of  corrective measures and now partially meets our monitoring criterion.  Changes DOE has made are important and can substantively improve  how DOE oversees and executes its major projects and programs. We  have not evaluated the effectiveness of the new monitoring measures  because it will take time for DOE to employ them, and we note that they  do not cover all aspects of contract management or certain EM activities  and depend upon the availability of reliable enterprise-wide cost  information. and it meets on a biweekly basis. According to DOE officials, during  2015, the committee reviewed 19 project milestones, 2 proposals for  updating major projects’ cost and schedule, and received 15 briefings  from independent project review teams. Also in 2015, the PMRC  reviewed multiple major projects, such as the Uranium Processing  Facility (UPF), the MOX facility, the CMRR project, WTP, and the Salt  Waste Processing Facility. The PMRC also prepared information on  these projects for ESAAB meetings in which most of these major  projects were discussed. In addition, according to senior DOE  officials, the PMRC focuses on all elements of project risk, not just  those elements related to DOE’s project management order but also  projects’ contract terms and regulatory compliance.
DOE has included the role of the PMRC in its updated project  management order, issued in May 2016, and created the CRO  position, which DOE plans to institutionalize. The CRO’s primary  function is to independently oversee capital asset projects and alert  the Secretary to any particular risks that may threaten projects’ on- time or on-budget delivery.
DOE enhanced oversight of projects during the commissioning  phase—the phase after construction is complete but before  operations begin. DOE did so in response to its experience with the  Sodium-Bearing Waste Treatment Facility at its Idaho site. In March  2016, DOE’s Office of Inspector General found major design and  construction problems during the commissioning phase of this facility.  The Inspector General’s investigation found that DOE had moved the  scope of work associated with the comprehensive performance test,  which demonstrates that the facility would perform its mission as  designed, from the construction phase of the project to the operations  phase of the project. The project modification prevented DOE from  rigorously testing the facility before construction was declared  complete. The Inspector General’s investigation concluded that the  total actual construction cost for this facility was likely understated by  about $181 million, and additional future costs to make the facility  operational could exceed $40 million. will be the Sodium-Bearing Waste Treatment Facility. Officials also  stated that the department intends to provide guidance to project  managers through a new Commissioning Guide to be issued in fiscal  year 2017.
DOE established project assessment offices, independent of line  management, which review projects at least annually. Through a May  2015 memorandum, NNSA elevated its Office of Project Assessment  to report directly to the Under Secretary, increasing the prominence of  this function and the likelihood that problems, if encountered, will  receive senior-level attention within NNSA. According to EM officials,  EM uses its Office of Project Management to conduct regular  independent project reviews for projects under $100 million, and since  July 2016, DOE’s Office of Project Management, Oversight, and  Assessments has reviewed EM projects with a cost greater than $100  million. key waste treatment facilities. DOE’s cost performance data shows  that the approved total project cost of $16.8 billion is underestimated,  and a senior DOE official recently informed Congress that the WTP’s  cost will increase significantly.
DOE’s efforts to improve monitoring are encouraging, but additional time  is needed for us to assess how effectively these recent monitoring  improvements will validate the sustainability of corrective measures. We  have not yet evaluated the operations of the PMRC, but according to its  charter this committee serves in an advisory role to the ESAAB and the  programs, while the program offices remain responsible for delivering  projects. DOE officials stated that the PMRC provides a list of its  recommendations for the ESAAB meetings, but DOE does not track  which PMRC recommendations are implemented. In our ongoing work,  we have identified an example that raises questions about whether the  programs are following the guidance of the PMRC. For the Tank Waste  Characterization and Staging facility at Hanford, DOE estimated a cost  range of $390 million to $690 million. However, we reported in May 2015  that this cost range was not reliable. We also found that EM officials had  estimated that the cost for this facility would range from $1 billion to $1.5  billion, making it a major project and subject to more rigorous oversight  requirements. The PMRC reviewed the cost estimates showing that this  facility should be classified as a major project, but the program office  responsible for the facility did not modify the cost range for the project at  inception, raising questions about the extent of the PMRC’s influence.
DOE’s new oversight and monitoring efforts are not comprehensive, as  certain activities within EM are not subject to review by the PMRC, even  though together they cost billions of dollars and last for numerous years.  Specifically, the PMRC does not review the cost and schedule  performance of operations activities within EM. These operations  activities include programs such as groundwater treatment at the Hanford  site, which has annually cost between about $140 million and $185 million  in recent years. of about $64 million and a schedule delay of nearly 9 months, in part  because DOE’s initial estimates to complete the recovery activities did not  follow all best practices and were therefore unreliable. Notably, DOE  estimated it would restart waste operations based on a schedule that  gave DOE less than a 1 percent chance of meeting its restart date. We  recommended that EM revise its protocol to require it to use best  practices in developing cost and schedule estimates. DOE concurred with  our recommendation and stated that EM plans to transition from the  operations activities protocol to a new directive for operations activities,  which will include guidance on using cost and schedule best practices.
Finally, the effectiveness of DOE’s monitoring of its contracts, projects,  and programs depends upon the availability of reliable enterprise-wide  cost information on which to base oversight activities. Such information is  needed to, among other things, identify the costs of activities and ensure  the validity of its cost estimates. However, meaningful cost analysis— including comparisons across programs, contractors, and sites—is not  possible because NNSA’s contractors use different methods of  accounting for and tracking costs. NNSA developed a plan to improve  and integrate its cost reporting structures; however, we found in our  January 2017 report that the plan did not provide a useful roadmap for  guiding NNSA’s effort. Until a plan is in place that incorporates leading  strategic planning practices, NNSA cannot be assured that its efforts will  result in a cost collection tool that produces reliable enterprise-wide cost  information that satisfies the information needs of Congress and program  managers, and enables DOE to effectively monitor its progress in  improving how it manages its contracts and programs.
section_title: Demonstrated Progress
paragraphs: As noted earlier, DOE implemented a series of changes to policies and  procedures to improve project management, but the department does not  yet meet the criterion for demonstrating progress. DOE’s recent reforms  are in the early stages, and more time is needed to assess the  effectiveness of corrective measures and associated progress, especially  with respect to ongoing major projects. DOE has taken significant actions  regarding two of its six ongoing major projects but continues to encounter  significant project management challenges, cost increases, and schedule  delays on others. In addition, DOE’s recent reforms do not address  contract management, and our work since the last high-risk report has  identified several significant challenges with DOE contract management  on which DOE has taken little action.
For two major projects, DOE has taken significant steps to address cost  and schedule problems. For example, NNSA proposed, in its fiscal year  2017 budget request, to terminate the MOX project and pursue an  alternative path for disposing of plutonium, under which DOE would dilute  plutonium for disposal in a geologic repository. For the UPF, NNSA has  cancelled its plans for a large uranium facility, and proposed to use both  existing and new smaller facilities and new technologies to meet its  needs. It is too early to determine the effects of these changes. DOE has  not developed a complete, reliable cost estimate for its new approaches  at the MOX or UPF facilities. NNSA officials believe the new approaches  will allow the agency to meet its mission needs at lower costs to the  taxpayer.
Our recent work has identified continuing challenges for two major  projects that DOE’s recent project management reforms in theory should  have addressed. For example,  In May 2015, we found that DOE continues with its design build  approach at the WTP, which is not consistent with DOE’s revised  project management order. DOE’s revised project management order  requires a facility’s design to be at least 90 percent complete before  establishing cost and schedule baselines. We found that construction  had outpaced design at some facilities at WTP, and external reviews  had identified hundreds of vulnerabilities in the waste treatment  facilities after assessing only half of the facilities’ systems. However,  EM has not applied DOE’s requirement to the WTP. We  recommended that DOE (1) limit construction on the WTP until risk  mitigation strategies are developed to address known technical  challenges, and (2) determine the extent to which the quality problems  exist, in accordance with its quality assurance policy, for the facilities’  systems that have not been reviewed to determine if additional  vulnerabilities exist. DOE neither agreed nor disagreed with these  recommendations and has not implemented them. analyzing plutonium for the revised CMRR project. NNSA neither  agreed nor disagreed with the recommendations.
As noted earlier, DOE’s corrective action plan does not address problems  with DOE’s oversight of major contracts. These problems have been  longstanding. For example, we noted in 1991 that DOE lacked assurance  that its oversight and control of contract expenditures will deter and detect  potential fraud, waste, and abuse. In addition to the contract management  issues noted earlier, such as acquisition planning for major contracts and  the quality of enterprise wide-cost information, our recent work identifies  additional challenges DOE continues to face in contract management. In  May 2015, we found that NNSA had not established policies or guidance  specific to using information from CAS to evaluate M&O contractor  performance. NNSA did not have policy or guidance on how or to what  extent NNSA officials should use information from CAS in evaluating  M&O contractors’ performance. We recommended that NNSA revise its  policy, guidance, and procedures for evaluating performance to fully  address how and under what circumstances those responsible for  evaluating M&O contractors’ performance should use information from  CAS. NNSA agreed with this recommendation and revised the policy in  2016. NNSA also created a website and held a summit to share CAS  lessons learned and strengthen the CAS community of practice.  However, NNSA has not established comprehensive guidance for  implementing this policy consistently.
Even though we removed nonmajor projects from our High-Risk List, we  continue to monitor how DOE manages these projects to ensure that  DOE sustains progress in this area. We note that the Secretary’s  December 2014 and June 2015 memorandums applied project  management reforms to nonmajor projects previously not subject to such  requirements, and DOE’s performance in meeting cost and schedule  milestones for nonmajor projects continues to improve, with nearly 95  percent of such projects meeting cost and schedule milestones over the  last 3 years, according to DOE officials. Our recent work, however, shows  that several nonmajor projects exhibit some of the challenges that have  long persisted for DOE’s major projects, such as incomplete front-end  planning and unreliable cost and schedule estimates, which means that  nonmajor projects still warrant our observation. waste in the tanks and (2) a tank waste characterization and staging  facility to stage, mix, sample, and characterize high-level waste from the  tanks prior to delivery to the pretreatment facility. They have a combined  total estimated cost of $633 million to at least $1 billion. We found DOE  excluded from its estimates the costs of some major activities necessary  to construct these facilities, and did not sequence activities to complete  them in accordance with schedule estimating best practices. We  recommended, among other things, that DOE revise cost and schedule  estimates for these two facilities in accordance with industry best  practices. DOE generally agreed with our recommendations but has not  yet implemented them.
section_title: Benefits Achieved from Implementing Our Recommendations
paragraphs: In 2014, we reviewed DOE’s request for fiscal year 2015 funding for the  WTP. We found that DOE requested an additional $23 million for the  design of a system to address technical problems the WTP had recently  encountered. We noted that because engineering and construction at key  WTP facilities had been stalled or slowed in fiscal year 2013, it was  unclear whether DOE needed the full funding for WTP plus the additional  amount to address technical problems. In the fiscal year 2015  appropriations bill, Congress provided $667 million for work at the WTP,  which was $23 million less than DOE’s budget request for the WTP for  that year.
DOE achieved some benefits by implementing several of our  recommendations in fiscal years 2015 and 2016. Specifically
DOE instituted requirements for projects and programs to follow cost- estimating best practices.
DOE instituted requirements for projects and programs to follow  analysis of alternatives best practices.
DOE analyzed root causes of the Plutonium Disposition Program cost  increases and instituted a department-wide requirement for root cause  analysis of cost and schedule breaches.
DOE’s Office of Environmental Management developed a  consolidated workforce plan.
DOE provided independent reviews of nonmajor projects, and defined  and tracked performance targets for nonmajor projects.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact David Trimble  at (202) 512-3841 or trimbled@gao.gov.
section_title: Related GAO Products
paragraphs: National Nuclear Security Administration: A Plan Incorporating Leading  Practices Is Needed to Guide Cost Reporting Improvement Effort,  GAO-17-141, Washington, D.C.: January 19, 2017.
Program Management: DOE Needs to Develop a Comprehensive Policy  and Training Program. GAO-17-51. Washington, D.C.: November 21,  2016.
Department of Energy: Actions Needed to Strengthen Acquisition  Planning for Management and Operating Contracts. GAO-16-529.  Washington, D.C.: August 9, 2016.
DOE Project Management: NNSA Needs to Clarify Requirements for Its  Plutonium Analysis Project at Los Alamos. GAO-16-585. Washington,  D.C.: August 9, 2016.
Nuclear Waste: Waste Isolation Pilot Plant Recovery Demonstrates Cost  and Schedule Requirements Needed for DOE Cleanup Operations.  GAO-16-608. Washington, D.C.: August 4, 2016.
Department of Energy: Whistleblower Protections Need Strengthening.  GAO-16-618. Washington, D.C.: July 11, 2016.
Department of Energy: Observations on Efforts by NNSA and the Office  of Environmental Management to Manage and Oversee the Nuclear  Security Enterprise. GAO-16-422T. Washington, D.C.: February 23, 2016.
Nuclear Weapons: NNSA Has a New Approach to Managing the B61-12  Life Extension, but a Constrained Schedule and Other Risks Remain.  GAO-16-218. Washington, D.C.: February 4, 2016.
DOE Project Management: NNSA Should Ensure Equal Consideration of  Alternatives for Lithium Production. GAO-15-525. Washington, D.C.: July  13, 2015.
Department of Energy: Actions Needed to Improve DOE and NNSA  Oversight of Management and Operating Contractors. GAO-15-662T.  Washington, D.C.: June 12, 2015.
National Nuclear Security Administration: Actions Needed to Clarify Use  of Contractor Assurance Systems for Oversight and Performance  Evaluation. GAO-15-216. Washington, D.C.: May 22, 2015.
Hanford Waste Treatment: DOE Needs to Evaluate Alternatives to  Recently Proposed Projects and Address Technical and Management  Challenges. GAO-15-354. Washington, D.C.: May 7, 2015.
National Nuclear Security Administration: Observations on Management  Challenges and Steps Taken to Address Them. GAO-15-532T.  Washington, D.C.: April 15, 2015.
National Nuclear Security Administration: Reports on the Benefits and  Costs of Competing Management and Operating Contracts Need to Be  Clearer and More Complete. GAO-15-331. Washington, D.C.: March 23,  2015.
Nuclear Waste: DOE Needs to Improve Cost Estimates for Transuranic  Waste Projects at Los Alamos. GAO-15-182. Washington, D.C: February  18, 2015.
section_title: NASA Acquisition Management
subsections: section_title: Why Area Is High Risk
paragraphs: The National Aeronautics and Space Administration (NASA) plans to  invest billions of dollars in the coming years to explore space, understand  Earth’s environment, and conduct aeronautics research. We designated  NASA’s acquisition management as high risk in 1990 in view of NASA’s  history of persistent cost growth and schedule delays in the majority of its  major projects. Our work has shown that NASA has made progress over  the past 5 years in a number of key acquisition management areas, but it  faces significant challenges in some of its major projects largely driven by  the need to improve the completeness and reliability of its cost and  schedule estimating, estimating risks associated with the development of  its major systems, and managing to aggressive schedules.
section_title: What GAO Found
paragraphs: NASA has continued to strengthen and integrate its acquisition  management functions, resulting in the agency continuing to meet three  criteria for removal from our High-Risk List: leadership commitment, a  corrective action plan, and monitoring. For example, NASA has  established metrics to monitor progress in improving acquisition  management, and in recent years, we have found that many of the  projects within the agency’s major project portfolio have improved their  cost and schedule performance. NASA’s metrics include cost and  schedule performance indicators and we have found that NASA’s  performance metrics generally reflect improved performance. These  actions have helped NASA to create better baseline estimates and track  performance such that NASA has been able to launch more projects on  time and within cost estimates.
Although NASA has taken steps toward meeting our criteria for capacity  by issuing guidance and implementing tools to reduce acquisition risk, our  reviews have found that these efforts have not always been consistent  with best practices in areas such as cost and schedule estimating and  earned value management (EVM). Finally, while the agency has taken  steps to demonstrate progress toward improving acquisition outcomes  overall, we found that NASA continues to face significant challenges in its  ability to manage and oversee its most expensive and complex projects,  most notably its human spaceflight development programs. NASA must  ensure that it conducts adequate and ongoing assessments of risks and  understands the long-term costs for its larger human exploration  programs, as the effects of any potential miscalculations could be felt  across NASA’s portfolio. Such efforts should help maximize  improvements and to demonstrate that the improved cost and schedule  performance will be sustained, even for the agency’s most expensive and  complex projects.
In our 2015 high-risk update, we found that NASA has satisfied our high- risk criteria for the areas of leadership commitment, monitoring, and an  action plan. We believe NASA’s progress in these areas is reflected in  the improved cost and schedule performance of NASA’s portfolio of major  acquisition projects, which includes projects with a life-cycle cost of more  than $250 million. For example, in 2016, overall development cost growth  for the portfolio of 12 development projects fell to 1.3 percent and launch  delays averaged 4 months. Both of these measures are at or near the  lowest levels we have reported since we began our annual assessments  in 2009. These measures exclude the James Webb Space Telescope  (JWST), which NASA rebaselined in September 2011 with significant cost  increase and schedule delays. As of December 2016, we found that  program continues to meet its revised cost and schedule commitments.
section_title: What Remains to Be Done
paragraphs: NASA manages a portfolio of projects that will always have inherent  technical, design, and integration risks because its projects are complex,  specialized, and often push the state of the art in space technology.  NASA has already taken steps to reduce acquisition risk from both a  technical and management standpoint. The next few years will certainly  test the extent to which these measures have taken hold in NASA’s  largest programs. However, more needs to be done with respect to  anticipating and mitigating risks—especially with regard to large  programs, estimating and forecasting costs for its largest projects, and  implementing management tools. Actions that will be critical to improving  NASA’s acquisition outcomes include the following:
Ensure that NASA conducts adequate and ongoing assessments of  risks for larger programs—JWST, Space Launch System (SLS), Orion  Multi-Purpose Crew Vehicle (Orion), and Exploration Ground Systems  (EGS)—especially since each of these programs is at a different  critical point in development and implementation, and the impacts of  any potential miscalculations will be felt across NASA’s portfolio.
Ensure that NASA understands long-term human exploration program  costs. While the three major exploration programs have been  baselined, none of the three programs have a baseline that covers  activities beyond the second planned flight. Long-term estimates,  which could be revised as potential mission paths are narrowed and  selected, would provide decision makers with a more informed  understanding of costs and schedules associated with potential  agency development paths.
Ensure that the Orion program analyzes the cost of deferred work in  relation to levels of management reserves and unallocated future  expenses, and actual contractor performance, and report the results  of that analysis to NASA management.
Ensure that rebaselined projects report cost and schedule growth  from original baselines in order to provide stakeholders and Congress  with a more accurate view of project performance and to enhance  accountability.
Ensure that program offices regularly and consistently update their  Joint Cost and Schedule Confidence Levels (JCL) across the  portfolio. As a project reaches the later stages of development,  especially integration and testing, its risk posture may change. An  updated project JCL would provide both project and agency  management with data on relevant risks that can guide project  decisions.
Ensure that NASA continues its efforts to build capacity in areas such  as cost and schedule estimating, and measuring contractor  performance.
Revisit schedules to ensure programs have fully considered the  effects of managing programs in order to meet aggressive schedule  dates.
Our ongoing work assessing Commercial Crew, EGS, Orion, SLS, JWST,  and the performance of the portfolio as a whole will provide insight into  how well NASA is performing over the next several years.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: We determined in our 2015 update that NASA had met our criteria in the  area of leadership commitment, which the agency continues to meet. We  believe that the agency’s efforts in this area—including the strengthening  of its acquisition policy and oversight functions—have resulted in improvement of major acquisition projects’ cost and schedule  performance.
section_title: Capacity
paragraphs: NASA has partially met our high-risk criteria for capacity. While NASA has  taken steps to issue guidance and implement tools to reduce acquisition  risk, our reviews have found that these efforts have not always been  consistent with best practices in areas such as estimating costs and  schedules and EVM surveillance.
In February 2015, NASA published a new version of its Cost Estimating  Handbook that includes an appendix on JCL analysis. But NASA does not  require its projects to update JCLs. Our prior work has found that projects  do not regularly update cost risk analyses to take into account newly  emerged risks. Our Cost Estimating and Assessment Guide recommends  that cost estimates should be updated to reflect changes to a program or  kept current as it moves through milestones.  As new risks emerge for a  project, updating the cost risk analysis can provide realistic estimates to  decision makers, including Congress.
Further, we have found that NASA’s three costliest acquisition  programs—JWST, SLS, and Orion—did not fully follow best practices  when developing their JCLs. For example, in July 2016 we found that the  Orion program’s cost estimate met or substantially met 7 of 20 best  practices and its schedule estimate met only 1 of 8 best practices. The  cost estimate lacked necessary support and the schedule estimate did  not include the level of detail required for high-quality estimates. Without  sound cost and schedule estimates, decision makers do not clearly  understand the cost and schedule risk inherent in the program and lack  important information they need to make programmatic decisions. In  October 2015, NASA decided to decentralize its independent assessment  function and deploy the staff to the agency’s centers, in part, to better use  its workforce to meet program needs in areas such as program  management, cost estimating, and resource analysis, and to fill gaps in  program analysis skills at the center level. It is too early to tell whether  this change will address skills gaps and ultimately improve the quality of JCLs in the future as programs will need to hold reviews under this  organization of the assessment function, and compare those reviews to  actuals in order to assess the change.
NASA has made progress implementing EVM analysis—another key  project management tool— but the agency has not yet fully implemented  a formal EVM surveillance plan in accordance with best practices. NASA  has made significant progress rolling out EVM to its centers and  supported these efforts with training, including classroom and online  training to projects. In November 2012, we recommended that NASA  update its procedural requirements to include a formal EVM surveillance  program in order to improve the reliability of EVM data collected by NASA  programs. While NASA agreed with our conclusion that EVM data  reliability needed improvement, it has yet to implement a formal  surveillance requirement due to resource constraints. In our December  2015 review of JWST, we found EVM data anomalies and recommended  that project officials require the contractors to explain and document all  such anomalies in their monthly EVM reports. A continuous surveillance  program could have identified these anomalies earlier, allowing the  project to pursue corrective action with its contractors. NASA has since  implemented this recommendation for the JWST program. Proper  surveillance of EVM contractor data is a best practice in the NASA  Earned Value Management Handbook and our Cost Estimating and  Assessment Guide.
section_title: Action Plan
paragraphs: In our 2015 high-risk update, we found that NASA had satisfied our high- risk criteria for an action plan and it continues to do so. NASA, which  reports its action plan metrics to us on a semiannual basis, continues to  perform within the parameters outlined in the plan—such as meeting  metrics for cost and schedule performance, and mission success  measures. These and other steps have enabled NASA to launch more  projects on time and within cost estimates.
section_title: Monitoring
paragraphs: We found in 2015 that NASA had met our high-risk criteria for monitoring  and it continues to do so. NASA has established metrics to monitor  progress in improving acquisition management, and we have found that  those metrics generally reflect improved performance. The NASA  Systems Engineering Handbook includes several technical indicators for  design maturity, and the agency’s project management policy and  systems engineering policy have been updated to require projects to track  these metrics. In March 2016, we found that NASA had sustained prior  improvement in design stability for its major acquisition projects.
section_title: Demonstrated Progress
paragraphs: NASA has partially met our criteria for demonstrating progress. The  agency has taken steps to improve acquisition outcomes, but we continue  to find that the agency faces significant challenges in its ability to manage  and oversee its most expensive and complex projects, most notably  regarding human spaceflight development. Other programs demonstrate  that NASA continues to face challenges accurately estimating or quickly  responding to risks. Also, NASA inconsistently reports on the  performance of some programs, which masks the full extent of cost and  schedule growth.
Together, NASA’s three human spaceflight efforts constitute more than  half of NASA’s portfolio development cost baseline, and helped make the  2016 portfolio the most expensive collection of NASA projects in  development since we began our annual assessment in 2009. Although  NASA’s human spaceflight programs are generally better positioned for  success than the agency’s most recent effort to replace the space shuttle,  managing weaknesses—including unreliable cost estimating, overly  ambitious internal deadlines, limited reserves, and operating for extended  periods of time without definitized contracts—have increased the  likelihood that it will incur overruns and schedule delays, particularly when  coupled with the broad array of technical risks that are inherent in any  human spaceflight development.
Moreover, all three human spaceflight projects will be significantly  challenged in the next 2 years as NASA aims to launch its first exploration  mission by November 2018. This mission, which will not have a crew, will  fly some 70,000 kilometers beyond the moon—using the SLS launch  vehicle, Orion, and EGS. During this time, the human spaceflight  programs will need to resolve a multitude of technical and design  challenges, complete fabrication and testing, and be delivered to the  Kennedy Space Center where they will be integrated with each other and  prepared for launch. Numerous activities along this development path are  sequential and cannot be rearranged to gain back time lost from prior  delays. Other activities can be deleted or performed concurrently, but not  without more risk to the program. If delays materialize during individual  systems integration and testing, they could cause a cascading effect of  cross-program problems. NASA has already made these later phases  more complicated by postponing key activities in order to keep pace with  internal deadlines. In addition, because the agency will be in the final  throes of other major programs, such as JWST, senior leaders’ attention  may be divided amongst many programs in the months leading up to the  first exploration mission.
Examples of management risk for human spaceflight programs that we  have recently identified include:
As we found in July 2016, each program manages to an aggressive  internal NASA launch readiness date, which creates an environment  for programs to make decisions based on reduced knowledge to meet  a date that is not realistic. For example, the EGS program has  consolidated future schedule activities to prepare the mobile  launcher—the vehicle used to bring SLS to the launch pad—to meet  this internal goal. The program acknowledged that consolidating  activities—which includes conducting verification and validation  concurrent with installation activities—increases risk because of  uncertainties about how systems not yet installed may affect the  systems already installed. Officials added, however, that this  concurrency is necessary to meet the internal schedule.
All three programs are operating with limited cost reserves, which limit  each program’s ability to address risks and unforeseen technical  challenges. For example, we found in July 2016 that the Orion  program will maintain very low levels of annual cost reserves until  2018. The lack of currently available cost reserves has caused the  program to defer work to address technical issues to stay within  budget. As a result, the Orion program’s reserves in future years  could be overwhelmed by deferred work—a practice that contributed  to the rebaseline of the JWST program, which included a $3.6 billion  cost increase and a 52-month schedule delay.
We found in July 2016 that the SLS program has not positioned itself  well to accurately assess progress with the core stage—SLS’s  structural backbone and fuel tank—because it did not have a  performance measurement baseline for that contract. Such a  baseline is necessary to support EVM reporting that can provide early  warning signs of impending schedules delays and cost overrun, and  provide unbiased estimates of anticipated costs at completion. The  lack of an accurate performance measurement baseline stemmed  from different assumptions between NASA and the contractor about  when funding would be available to start different work and ultimately  led to a contract modification. NASA and the contractor signed the  contract replan in May 2016—with a cost increase of approximately  $1 billion—and the program began receiving contractor EVM data in  July 2016, more than 4.5 years after NASA awarded the contract.
The cost and schedule baselines NASA has established for these  three programs provide little visibility into long-term planning and  costs. The baselines for SLS and EGS are applicable through the first  exploration mission, and the baseline for Orion extends through the  second exploration mission. However, the limited scope that NASA  has chosen for constructing these cost estimates means that these  estimates are unlikely to serve as a way to measure progress and  track cost growth over the life of the projects which are expected to  extend well beyond these first missions.
In addition to these human spaceflight programs, NASA plans to  reestablish a domestic capability to fly astronauts to the International  Space Station through its Commercial Crew program by the end of 2018.  This is also proving to be an aggressive schedule and NASA’s two  contractors are concurrently developing, testing, and producing their  vehicles in an effort to maintain schedule. Significant delays could lead to  a gap in U.S. access to the International Space Station as NASA has  acquired seats on the Russian Soyuz vehicle only through 2018.
NASA also continues to have trouble demonstrating progress in executing  two projects that we found in our 2015 high-risk update illustrated  instances in which the agency had either underestimated risks and  potential effects or had not reacted quickly enough to risks when they  worsened:  The Ice, Cloud, and Land Elevation Satellite-2 (ICESat-2) project—also  scheduled to launch in 2018—continues to experience issues with its sole  instrument, a laser altimeter. The project may require an additional 10  months or more to resolve technical challenges. The project already  underwent one rebaseline in 2014, resulting in a 37 percent higher  development cost than its original baseline—from $558.9 million to  $763.7 million—which NASA officials at the time primarily attributed to  underestimating the technical complexity of the project’s design.
The Space Network Ground Segment Sustainment (SGSS) project’s  contractor provided overly optimistic estimates, which—despite project  officials being aware of this issue during project confirmation— necessitated a rebaseline shortly after the project was confirmed. NASA  approved a new baseline in June 2015, which increased its estimated  cost by $345 million and delayed its estimated completion by 27 months.  In February 2016, NASA reclassified SGSS as a sustainment project  rather than a major project, which reduces reporting and oversight  requirements.
Finally, as we highlighted in the 2015 high-risk update, the inconsistent  way NASA measures its progress toward reducing acquisition risk masks  true cost and schedule growth for some programs. When NASA reports  on cost and schedule performance for individual projects or across its  portfolio, it uses rebaseline data rather than original project baseline data  for measuring outcomes. Cost and schedule growth that occurred prior to  the rebaseline of a troubled project are excluded from calculations of  overall progress. As a result, when the agency reports program  performance in this manner—as it has for JWST, ICESat-2, and others— it makes it difficult to track cost and schedule growth compared to the  agency’s original commitment levels.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In November 2012, we found that NASA employee skill sets available  to analyze and implement EVM vary widely from center to center, and  we recommended that NASA conduct an EVM skills gap analysis to  identify areas requiring augmented capability across the agency, and,  based on the results of the assessment, develop a workforce training  plan to address any deficiencies. NASA developed an EVM training  plan in 2014 based on the results of an EVM skills gap analysis that  was conducted in 2013.
In November 2012, we found that NASA faced cultural and technical  challenges that it must overcome to successfully implement an EVM  system and to use this data on a regular basis to inform decision  making. We recommended that the agency develop an EVM change  management plan to assist managers and employees throughout the  agency with accepting and embracing earned value techniques while  reducing the operational effect on the agency. In response to our  recommendation, in 2014, NASA developed an EVM change  management plan. This plan was approved by the EVM Steering  Committee, which is comprised of senior-level NASA officials who  provide guidance to the agency on implementing EVM. In addition, the  plan was briefed to the EVM Focal Points who are responsible for  implementing the plan within their respective organizations.
In November 2012, we found that 10 NASA major spaceflight projects  had not yet fully implemented EVM. As a result, NASA was not  taking full advantage of an important tool that could help reduce  acquisition risk. We recommended that NASA establish a time frame  by which all new spaceflight projects will be required to implement  NASA’s newly developed EVM system to ensure that in-house efforts  are compliant with ANSI/EIA-748, accounting for the need to increase  NASA’s institutional capability for conducting EVM and analyzing and  reporting the data. In fiscal year 2013, NASA started a phased rollout  at selected centers to increase the agency’s EVM capacity by  implementing its EVM Capability process at projects at those centers.  According to NASA officials, as future projects at those centers  implement EVM, they expect centers will follow the agency EVM  process, which will better ensure that they are using systems which  are compliant with ANSI/EIA-748.
In August 2014, NASA addressed concerns we raised about the SLS  by taking actions to balance the program’s cost and schedule risk in  line with agency policies. At the time of our report in July 2014, we  found that NASA’s funding plan for the first test flight of SLS in  December 2017 was insufficient to meet needs.  We recommended  that the program match resources to requirements that would result in  a level of risk in line with NASA policy by—for example—establishing  cost and schedule baselines that supported a joint cost and schedule  confidence level (JCL) of 70 percent. We indicated that NASA could,  for example, increase funding or delay the scheduled launch date to  reduce risks and meet the 70 percent JCL. In August 2014, the  program addressed our concerns by establishing its agency cost and  schedule baselines at a 70 percent JCL of $9.7 billion with a launch  readiness date of November 2018.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Cristina T.  Chaplain at (202) 512-4841 or chaplainc@gao.gov.
section_title: Related GAO Products
paragraphs: James Webb Space Telescope: Project Meeting Cost and Schedule  Commitments but Continues to Use Reserves to Address Challenges.  GAO-17-71. Washington, D.C.: December 7, 2016.
Orion Multi-Purpose Crew Vehicle: Action Needed to Improve Visibility  into Cost, Schedule, and Capacity to Resolve Technical Challenges.  GAO-16-620. Washington, D.C.: July 27, 2016.
NASA Human Space Exploration: Opportunity Nears to Reassess Launch  Vehicle and Ground Systems Cost and Schedule. GAO-16-612.  Washington, D.C.: July 27, 2016.
NASA: Assessments of Major Projects. GAO-16-309SP. Washington,  D.C.: March 30, 2016.
James Webb Space Telescope: Project on Track but May Benefit from  Improved Contractor Data to Better Understand Costs. GAO-16-112.  Washington, D.C.: December 17, 2015.
Space Launch System: Management Tools Should Better Track to Cost  and Schedule Commitments to Adequately Monitor Increasing Risk.  GAO-15-596. Washington, D.C.: July 16, 2015.
NASA: Assessments of Selected Large-Scale Projects. GAO-15-320SP.  Washington, D.C.: March 24, 2015.
section_title: DOD Contract Management
subsections: section_title: Why Area Is High Risk
paragraphs: The Department of Defense (DOD) obligated $273.5 billion in fiscal year  2015 on contracts for goods and services, including major weapon  systems, support for military bases, information technology, consulting  services, and commercial items. Contracts also include those supporting  contingency operations, such as those in Afghanistan. DOD is, by far, the  single largest contracting agency in the federal government, typically  accounting for about two-thirds of all federal contracting activity. Our work  and that of others, however, has identified challenges DOD faces within  three segments of contract management: (1) the acquisition workforce,  (2) service acquisitions, and (3) operational contract support (OCS).  Ensuring DOD has the people, skills, capacities, tools, and data needed  to make informed acquisition decisions is essential if DOD is to effectively  and efficiently carry out its mission in an era of more constrained  resources. We added this area to our High-Risk List in 1992.
section_title: What GAO Found
paragraphs: Senior DOD leadership remains committed to addressing its contract  management challenges and, in particular, has made significant progress  in addressing OCS issues since 2015. For example, DOD held meetings  of its senior executive level governance forum to institutionalize OCS,  issued revised guidance, and made progress in incorporating OCS  concepts into operational plans. Further, DOD has taken steps to address  education and training shortfalls and has dedicated additional training  resources to enhance OCS. DOD also updated its action plan for OCS,  which includes both revised and new tasks with measurable metrics and  milestones. As a result of these actions, for the OCS subarea, we have  raised our assessments for capacity to partially met and consider DOD to  have met our criterion for having an action plan.
DOD has also made some progress in managing its acquisition  workforce. Specifically, in October 2016, DOD issued its updated  acquisition workforce strategic plan which, among other things, assessed  the current capability of the workforce and identified risks that DOD  needed to manage to meet future needs. As a result of these actions, we  have raised the action plan criterion for the acquisition workforce subarea  to partially met. DOD acknowledged, however, that it will need to develop  and implement metrics to track progress toward meeting the four strategic  goals identified in its October 2016 strategic workforce plan. Further, the  workforce plan does not establish specific career field goals or targets,  which will hinder efforts to ensure DOD has the right people with the right  skills to meet future needs.
Congress has also taken action to help improve the acquisition workforce.  In the National Defense Authorization Act for Fiscal Year 2016, Congress  made permanent the requirement for the military departments and  defense agencies to remit $500 million for each fiscal year to the Defense  Acquisition Workforce Development Fund (DAWDF)—a fund used by  DOD to increase hiring and provide additional training. This enabled  critical support for acquisition workforce development initiatives for DOD.
While DOD continues to take action to improve how it manages services  acquisitions, demonstrated progress was more limited. In January 2016,  DOD issued a new instruction for service acquisitions that provides a  management structure for acquiring services and identifies the roles and  responsibilities of key leadership positions, but DOD still lacks an action  plan that will enable it to assess progress toward achieving its goals, and  efforts to identify goals and associated metrics are still in the early stages  of development.
One critical element in improving services acquisition is to know what the  department is buying today and what it intends to buy in the future. We  found that while data on future service acquisitions are generally  maintained by DOD program offices, DOD and military department  guidance does not require that data to be specifically identified in DOD’s  budget forecasts. In that regard, DOD’s January 2016 service acquisition  instruction includes requirements to generate data on anticipated future  service acquisition spending, but this requirement does not clearly identify  what level of detail should be collected, leaving DOD at risk of developing  inconsistent data between each military department.
section_title: What Remains to Be Done
paragraphs: To further improve outcomes on the billions of dollars spent annually on  goods and services, DOD needs to take the following actions.
Continue efforts, including strategic planning and aligning funding, to  increase the department’s capacity to negotiate, manage, and  oversee contracts by ensuring that its acquisition workforce is  appropriately sized and trained to meet the department’s needs.
Determine the appropriate mix of military, civilian, and contractor  personnel. To assist with this, DOD needs to make decisions about  the department’s approach for compiling its inventory of contracted  services and defining the roles and responsibilities of those involved  with the inventory.
Strategically manage how it acquires services by defining desired  outcomes, establishing goals and measures, and obtaining data  needed to measure progress. To enhance available information on  service acquisitions, the military departments should revise  programming guidance to collect information on how contracted  services will be used to meet requirements beyond the budget year.
Sustain efforts throughout the department to integrate OCS through  policy, planning, training, and application of necessary resources for  both current and future contingency operations.
Listed below are additional recommendations that need to be addressed:  In December 2015, we recommended that DOD update its acquisition  workforce plan, including revising career field goals. DOD concurred  with our recommendation. In October 2016, DOD issued an updated  acquisition workforce strategic plan which, among other things,  assessed the current capacity and capability of the workforce and  identified the risks that DOD needed to manage to meet future needs.  The updated workforce plan also established four strategic goals,  approved by the Defense Acquisition Workforce Senior Steering  Board, to guide future efforts, including shaping the acquisition  workforce to achieve current and future acquisition requirements. The  October 2016 plan did not, however, establish specific career field  goals or targets for its 13 career fields, including priority career fields  where it has not met its targets, such as contracting, business, and  auditing, which will hinder efforts to ensure that DOD has the right  people with the right skills to meet future needs.
In June 2013, we recommended that DOD identify baseline data on  the status of service acquisitions, develop specific goals associated  with their actions to improve service acquisitions, and establish  metrics to assess progress in meeting these goals. DOD concurred  with our recommendations and is developing service acquisition goals  and metrics as well as an action plan for improving service  acquisition.
In relation to strategic sourcing—a process of moving away from  numerous individual procurements to a broader aggregate  approach—in September 2012, we recommended that the department  issue direction that sets goals for spending managed through strategic  sourcing vehicles, establishes procedures for tracking strategic  sourcing efforts, and establishes metrics to track progress toward  these goals. We also recommended that DOD identify and evaluate  the best way to strategically source DOD’s highest spending  categories. DOD concurred with these two priority recommendations  and has been working with the Office of Management and Budget’s  Category Management Leadership Council to determine appropriate  strategic sourcing goals, but specific goals and corresponding metrics  have not yet been established. DOD officials stated that appointing  senior officials to manage the acquisition of services should help DOD  further expand strategic sourcing efforts for high-spend service  categories. As of October 2016, however, many of these efforts are in  the early stages of implementation.
We noted in our 2015 high-risk report that DOD’s top leadership has  taken significant steps to plan and monitor progress in the  management and oversight of contracting techniques and  approaches. For example, we noted that DOD had been using its  Business Senior Integration Group—the Under Secretary of Defense  for Acquisition, Technology, and Logistics’ executive-level leadership  forum for providing oversight in the planning, execution, and  implementation of DOD’s Better Buying Power initiatives—as a  mechanism to review ongoing and emerging issues, including  competition. It is important for DOD to continuously promote  competition, which is a critical tool for achieving the best possible  return on investment for taxpayers.
In addition, congressional action is needed to enhance visibility into  DOD’s planned spending on contract services. In February 2016, we  found that, unlike DOD budget exhibits for weapon systems, DOD’s other  budget exhibits which contain information on contracted services do not  include data on projected spending beyond the current budget year.  Without a roadmap of future projected service contract spending needs,  Congress has limited visibility into an area that constitutes more than half  of DOD’s annual contract spending. Given that the intent of section 235 of  Title 10 United States Code was to provide both DOD and Congress with  increased oversight of the procurement of services, we suggested that  Congress should consider amending reporting requirements to include  estimated spending on services beyond the budget year.
section_title: Additional Details on What GAO Found
subsections: section_title: DOD’s Management of Its Acquisition Workforce
subsections: section_title: Leadership Commitment
paragraphs: DOD has met this criterion by implementing its Better Buying Power  initiative—which included specific actions to improve the professionalism  of the acquisition workforce—and through continued efforts to sustain and  train the workforce in times of budget constraints and cost-cutting  pressures. For example, in June 2016, the Under Secretary of Defense  for Acquisition, Technology and Logistics stated that DOD intends to  sustain the acquisition workforce at current levels and continue to  improve its professionalism. Similarly, DOD’s October 2016 acquisition  workforce strategic plan stated that DOD must sustain the acquisition  workforce size, factoring in workload demand and requirements; ensure  its personnel continue to increase their professionalism, and continue to  expand talent management programs to include recruitment, hiring,  training, development, recognition, and retention incentives by using  DAWDF and other appropriate tools. DOD components plan to spend  more than $3.0 billion in DAWDF funding between fiscal years 2018  through 2022 in support of these objectives.
section_title: Capacity
paragraphs: DOD has partially met this criterion. Since 2015, DOD has continued to  increase the size of the acquisition workforce by about 2,000 acquisition  personnel. Overall, the size of its military and civilian acquisition  workforce grew by about 26 percent—from close to 126,000 to more than  158,000 between September 2008 and March 2016—or about 12,000  more than the target identified in DOD’s April 2010 acquisition workforce  plan. While DOD met the overall acquisition growth goal, it did not  accomplish the goals set for some career fields. The plan indicated that  targeted growth in 5 of these priority career fields—auditing, business,  contracting, engineering, and program management—would help DOD  strategically reshape its acquisition workforce. As of March 2016, our  analysis shows that DOD met or exceeded its planned growth for 8 career  fields by about 12,500 personnel, including the priority career fields of  program management and engineering, but fell short by about 2,800  personnel in 5 other career fields, including the priority career fields of  contracting, business, and auditing. DOD has also used DAWDF to  increase hiring and provide for additional training. In the National Defense  Authorization Act for Fiscal Year 2016, Congress further enabled critical  support for acquisition workforce development initiatives by making  permanent the requirement for the military departments and defense  agencies to remit $500 million for each fiscal year to the fund.
Increasing the number of people performing acquisition work is only part  of DOD’s strategy to improve the capability of its workforce; another part  is ensuring that the workforce has the requisite skills and tools to perform  their tasks. DOD developed a five-phase process that included surveys of  its employees to assess the skills of its workforce and to identify and  close skill gaps. DOD completed competency assessments for 12 of its  13 career fields and is developing new training classes to address some  skill gaps. However, DOD has not determined the extent to which  workforce skill gaps identified in initial career field competency  assessments have been addressed and what workforce skill gaps  currently exist. In our December 2015 report, we recommended that DOD  establish time frames to conduct follow-up career field competency  assessments so that it can determine if skill gaps are being addressed.  DOD agreed with the recommendation. The department’s October 2016  acquisition workforce strategic plan stated that career field competency  assessments should be conducted at a minimum of every 5 years, but it  is too soon to tell whether DOD will conduct these assessments as  recommended in its workforce plan.
section_title: Action Plan
paragraphs: DOD has now partially met this criterion. The National Defense  Authorization Act for Fiscal Year 2010 required DOD to develop and  submit to Congress a strategic plan for DOD’s acquisition workforce, to  be updated biennially. In a December 2015 report, we found that DOD  had exceeded its workforce growth target established in 2010 and was  focused on sustaining the size of its acquisition workforce. We noted that  an updated workforce plan that included revised career field goals,  coupled with guidance on how to use DAWDF, could help DOD  components focus future hiring efforts on priority career fields. Without an  integrated approach, we concluded that the department would be at risk  of using the funds to hire personnel in career fields that currently exceed  their targets or are not considered a priority. Therefore, we recommended  that DOD update its acquisition workforce plan, including revising career  field goals, so that it could ensure that the most critical acquisition needs  are being met. DOD officials agreed with our recommendation. In October  2016, DOD issued an updated acquisition workforce strategic plan which,  among other things, assessed the current capacity and capability of the  workforce and identified the risks that DOD needed to manage to meet  future needs. The updated workforce plan also established four strategic  goals, approved by the Defense Acquisition Workforce Senior Steering  Board, to guide future efforts, including shaping the acquisition workforce  to achieve current and future acquisition requirements. The October  2016 plan did not, however, establish specific career field goals or  targets, which will hinder efforts to ensure that DOD has the right people  with the right skills to meet future needs.
We also continue to find that DOD faces challenges in meeting its  statutory requirement to prepare an annual inventory of contracted  services—one that could help it make more strategic decisions about the  right workforce mix of military, civilian, and contractor personnel and  better align resource needs through the budget process to achieve that  mix. Specifically, in October 2016, we found DOD faced continued delays  in (1) deciding on the path forward for its underlying data collection  system for the inventory of contracted services, (2) staffing its inventory  management support office, and (3) formalizing roles and responsibilities  of that office and stakeholders. These continued delays hinder DOD’s  ability to use the inventory to inform workforce and budget decision- making processes.
section_title: Monitoring
paragraphs: DOD has partially met this criterion. DOD acknowledged that it will need  to develop and implement metrics to track progress toward meeting the  four strategic goals identified in its October 2016 strategic workforce plan,  including those related to shaping the future acquisition workforce. DOD,  however, has been tracking workforce growth against targets established  in 2010, as well as other metrics, such as those related to education and  training.
section_title: Demonstrated Progress
paragraphs: DOD has partially met this criterion. The metrics show that the  department has exceeded its overall acquisition workforce growth target  and education and training rates have increased significantly since 2008.  For example, in its October 2016 acquisition workforce plan, DOD  reported that the number of personnel with bachelor’s degrees or higher  increased from 77 percent in fiscal year 2008 to 84 percent in fiscal year  2015, while those with graduate degrees increased from 29 percent to 39  percent over the same period. DOD also reported that more than 96  percent of the acquisition workforce either met or was on track to meet  certification requirements within required time frames. DOD has not,  however, verified that the current composition of the workforce will meet  its future workforce needs.
section_title: Improving DOD’s Acquisition of Services
subsections: section_title: Leadership Commitment
paragraphs: DOD has demonstrated sustained leadership commitment in improving its  approach to managing the acquisition of services, which accounted for  more than 50 percent of DOD’s contract obligations in fiscal year 2015,  and has met this criterion. This commitment is reflected in DOD’s  issuance in January 2016 of a service acquisition instruction, which  established policy, assigned responsibilities, and provided procedures for  defining, assessing, reviewing, and validating requirements for the  acquisition of services. This instruction, which provides a management  structure for acquiring services, builds on DOD’s efforts to improve how it  acquires services that were contained in its Better Buying Power initiative.  We are currently assessing the actions the military departments are  taking to implement the service acquisition instruction.
section_title: Capacity
paragraphs: DOD has partially met this criterion by establishing a number of  management and oversight positions intended to address its capacity for  strategically managing the acquisition of services. These include  designating the Principal Deputy Under Secretary of Defense for  Acquisition, Technology, and Logistics as the department’s senior  manager for service acquisition in 2013, as well as building capacity to  address service acquisition issues by designating a senior manager for  service acquisitions in each military department. We are currently  assessing the effects of these new positions.
section_title: Action Plan
paragraphs: DOD has not met this criterion. DOD does not have an action plan that  would enable it to assess progress toward achieving its goals, and its  efforts to develop goals and associated metrics unique to each category  of service it acquires are also in the early stages of development.
section_title: Monitoring
paragraphs: DOD has partially met this criterion. Because DOD lacks an action plan, it  is not yet positioned to fully assess its progress in improving service  acquisition. A key element to being more strategic in acquiring services is  knowing how and where service acquisition dollars are currently being  spent and how those dollars will be spent in the future. We found in  February 2016 that program offices within each of the military  departments that we met with maintained data on current and estimated  future spending needs for contracted service requirements, but they did  not identify service contract spending needs beyond the next year, as  they were not required to do so. We recommended that the military  departments revise their programming guidance to collect information that  is already available on how contracted services will be used to meet  requirements beyond the budget year.
We also recommended that DOD establish a mechanism, such as a  working group of key stakeholders, to coordinate these efforts. DOD  partially concurred with these two priority recommendations, citing  challenges in estimating future spending, but as of July 2016, had  generally not taken action to address them. In February 2016, however,  the Army included service contract reporting requirements in its  Command Program Guidance Memorandum for fiscal years 2018-2022.  The memorandum instructs Army commands and operating agencies to  document all current and future requirements for contracted services for  fiscal years 2018-2022. In its memorandum, the Army noted that this data  will provide transparency over contracted services funding and  requirements and enable the Army to track dollars programmed for  services. Further, the Army stated that this effort will provide data that can  be used to make resource decisions and inform processes that determine  workload requirements and assess the appropriate mix of military, civilian,  and contractors to execute workload requirements.
In addition, DOD has made progress in acquiring services through  strategic sourcing but has more to do to improve monitoring. For  example, in September 2015, we found that each of the military  departments we reviewed had designated officials responsible for strategic sourcing and created offices to identify and implement strategic  sourcing opportunities, including those specific to information technology  services. The military departments did not monitor spending or establish  savings goals and metrics for the use of their preferred strategic sourcing  contracts for information technology services, which resulted in most of  their dollars for information technology services being obligated through  hundreds of potentially duplicative contracts that diminished the  government’s buying power and resulted in missed opportunities to  achieve savings and obtain other benefits.
section_title: Demonstrated Progress
paragraphs: DOD has partially met this criterion. The January 2016 DOD services  acquisition instruction included additional requirements to generate data  on past and anticipated future service acquisition spending, but did not  clearly identify what level of detail should be collected, leaving the  department at risk of developing inconsistent data between each military  department and limiting DOD leadership’s insight into future spending on  contracted services. DOD plans to develop service acquisition related  goals and metrics in fiscal year 2017 to develop additional baseline data  to gauge progress. As DOD and the military departments mature efforts  to develop more refined data on past and future service contract spending  and develop specific goals related to each, DOD will be better positioned  to assess its progress.
section_title: Addressing Challenges Related to Operational Contract Support
subsections: section_title: Leadership Commitment
paragraphs: DOD has met this criterion by continuing to demonstrate sustained  commitment and strong leadership support in addressing OCS issues.  DOD held its first OCS Summit in October 2015, attended by senior  leaders from across the department, to review and discuss strategies to  better formalize capability and capacity in the Joint Force. DOD officials  are planning to host a similar forum in 2017. Additionally, the Functional  Capabilities Integration Board serves as a single senior executive-level  governance forum for OCS issues. It convenes quarterly, or as required,  providing strategic leadership to multiple stakeholders working to  institutionalize OCS.
section_title: Capacity
paragraphs: DOD has partially met this criterion. Specifically, DOD has made progress  toward addressing agency capacity by identifying several actions to  develop its personnel and training resources since our last high-risk  update. The July 2014 update to the Joint Staff’s primary OCS guidance,  according to DOD officials, changed doctrine and obviated the results of  an earlier study that had found capacity shortfalls in OCS positions.  Subsequently, according to officials, in September 2016 the Office of the  Secretary of Defense established a joint OCS Policy Working Group to  clarify and refine OCS policy. Also, DOD officials told us, in October 2016,  that DOD is pursuing a joint OCS capacity review process to implement  corrective actions to address OCS shortfalls in personnel, education,  training, and materiel and to better incorporate OCS requirements. Joint  Staff also identified priority items that combatant commanders should  consider emphasizing in their training and exercise programs to improve  OCS capacity.
section_title: Action Plan
paragraphs: DOD has made significant progress in addressing the action plan criterion  and has met this criterion. In September 2016, DOD issued its fourth  iteration of the OCS Action Plan, which is organized around 10 capability  gaps that needed to be closed in order to effectively institutionalize OCS  capability and is DOD’s primary mechanism for monitoring and validating  the effectiveness and sustainability of those tasks. We found, in February  2015, that the 2014 Action Plan lacked performance measures or metrics  to evaluate if actions taken had filled the capability gaps. DOD’s 2016  action plan, however, revised tasks and added new tasks to include  measurable metrics and provided a cross-walk to show the status of the  tasks. For example, the 2016 plan shows 90 tasks completed or deleted  from the preceding years. Further, the 2016 plan highlighted a number of  other ongoing efforts, such as initiating a new joint capability  requirements document and process that, if approved, may accelerate  significant changes across DOD.
section_title: Monitoring
paragraphs: DOD has partially met this criterion. Each task identified in the 2016  Action Plan has a deliverable or outcome measured against a target  completion date, and a senior-level board serves as the primary monitor  for these performance targets. Moreover, the 2016 Action Plan included a  new annex managed by the Joint Staff logistics directorate to capture  subtasks that supplement the 36 overarching tasks in the DOD action  plan. However, some of these subtasks are not clearly defined and will be  difficult to monitor. For example, one subtask associated with a gap— personnel being insufficiently aware of the significance of OCS—suggests  the need for an enduring culture change, but it is unclear how DOD will  monitor this effort.
section_title: Demonstrated Progress
paragraphs: DOD has partially met this criterion. DOD continues to make progress in  incorporating OCS concepts into plans and addressing education and  training shortfalls. For example, we found, in December 2015, that U.S.  Africa Command developed some annexes to plans that generally  contained key considerations discussed in Joint Staff and other DOD  guidance such as force protection, host nation agreements, and  contractor oversight. Additionally, Joint Staff has revised the Universal  Joint Tasks—which support DOD in conducting training and exercises— incorporating lessons learned related to OCS and new doctrine identified  in Joint Publication 4-10.
However, DOD has not implemented several priority recommendations  related to OCS guidance. For example, we reported, in February 2013,  that the Navy, Marine Corps, and Air Force have not developed  comprehensive guidance, limiting the military departments’ planning  efforts to accurately reflect how they use contract support. We  recommended that DOD direct the Navy and Air Force to provide service- wide guidance for the Navy, Marine Corps, and Air Force that describes  how each service should integrate OCS into its respective organization to  include planning for contingency operations. DOD concurred with this  priority recommendation.
Since that time, the Marine Corps has developed guidance and definitions  within the Marine Corps Capabilities List, and the Air Force has issued a  memorandum on OCS integration and updated existing guidance to  include OCS concepts. OSD officials told us, in December 2016, that  Navy planners are drafting an OCS instruction for internal review, which  they estimate will be completed in the summer of 2017. However, the  September 2016 OCS Action Plan reflects the target publication date as  the first quarter of fiscal year 2017.
In March 2015, we recommended that DOD revise existing guidance to  detail the roles and responsibilities of the military departments in  collecting OCS lessons learned. We also recommended that DOD direct  the Navy and Air Force to include the military departments’ roles and  responsibilities to collect OCS lessons learned in military department  specific guidance on how the Navy, Marine Corps, and Air Force should  integrate OCS. DOD concurred with these priority recommendations, and,  according to senior DOD officials, the department is revising a DOD  instruction and directive to address these recommendations.
In addition, the 2016 action plan identified foreign vendor vetting as a  significant issue that should replace base access as a capability gap.  DOD also noted that addressing this potential gap will likely require  support from beyond the OCS community. Specifically, according to DOD  officials, the OCS community of interest determined that the issue of  vendor vetting is outside the responsibility and expertise of the OCS  community. DOD established a separate working group on vendor vetting  to address this issue. However, DOD has not developed comprehensive  guidance on foreign vendor vetting, as we previously recommended.
In December 2015, we recommended that the department develop  guidance that clarifies the conditions under which combatant commands  should have a foreign vendor vetting process or cell in place to determine  whether potential vendors actively support any terrorist, criminal, or other  sanctioned organization. DOD concurred with this priority  recommendation, stating that the Office of the Secretary of Defense in  collaboration with the Joint Staff had established a joint working group to  identify key stakeholders and develop DOD policy requiring combatant  commands to develop processes for vetting foreign vendors. As of  December 2016, the department was in the process of preparing a  directive type memorandum to the military departments and combatant  commands with additional information. According to officials, DOD  continues to gain stakeholder support and assess and analyze vendor  vetting issues, in order to develop comprehensive guidance, as we  previously recommended.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: In February 2016, we recommended that the military departments  revise their programming guidance to collect information on how  contracted services will be used to meet requirements beyond the  budget year. DOD partially concurred with this recommendation, citing  challenges with accurately quantifying service contract requirements  beyond the budget year. In its February 2016 Command Program  Guidance Memorandum, the Army required all its organizations to  provide contract service requirements data for fiscal years 2018-2022,  including all current and planned requirements. The Army recognized  that this will enable the Army and its commands to analyze contract  service requirements and execution trends and allow the Army to  prioritize growth or reductions to specific contract service  requirements.
In March 2010, we recommended that DOD update its planning  guidance to address the potential need for contractor support where  appropriate. DOD concurred with this recommendation. In October  2012, the Chairman of the Joint Chiefs of Staff issued updated  guidance on operational planning which contains information related  to planning for contracted support. As a result of this change in  guidance, senior DOD leaders will have a better understanding of how  the department relies on contractors as it undertakes contingency  operations, and will be more attuned to the potential risks of using  contractors and better prepared to manage those risks.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Timothy J.  DiNapoli at (202) 512-4841 or dinapolit@gao.gov.
section_title: Related GAO Products
paragraphs: DOD Inventory of Contracted Services: Timely Decisions and Further  Actions Needed to Address Long-Standing Issues. GAO-17-17.  Washington, D.C.: October 31, 2016.
DOD Service Acquisition: Improved Use of Available Data Needed to  Better Manage and Forecast Service Contract Requirements.  GAO-16-119. Washington, D.C.: February 18, 2016.
Operational Contract Support: Additional Actions Needed to Manage,  Account for, and Vet Defense Contractors in Africa. GAO-16-105.  Washington, D.C.: December 17, 2015.
Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts  and Improve Workforce Capability. GAO-16-80. Washington, D.C.:  December 14, 2015.
DOD Inventory of Contracted Services: Actions Needed to Help Ensure  Inventory Data are Complete and Accurate. GAO-16-46. Washington,  D.C.: November 18, 2015.
DOD Contract Services: Improvements Made to Planning and  Implementation of Fiscal Controls. GAO-15-780. Washington, D.C.:  September 30, 2015.
Strategic Sourcing: Opportunities Exist to Better Manage Information  Technology Services Spending. GAO-15-549. Washington, D.C.:  September 22, 2015.
Operational Contract Support: Actions Needed to Enhance the Collection,  Integration, and Sharing of Lessons Learned. GAO-15-243. Washington,  D.C.: March 16, 2015.
Contingency Contracting: Contractor Personnel Tracking System Needs  Better Plans and Guidance. GAO-15-250. Washington, D.C.: February  18, 2015.
section_title: Enforcement of Tax Laws
subsections: section_title: Why Area Is High Risk
paragraphs: The Internal Revenue Service (IRS) continues to demonstrate top  leadership support for improving tax compliance and addressing the tax  gap. However, IRS’s capacity to implement new initiatives, carry out  ongoing enforcement and taxpayer service programs, and combat identity  theft (IDT) refund fraud under an uncertain budgetary environment  remains a challenge. Enforcement of the tax laws helps fund the U.S.  government. IRS enforcement collects revenue from noncompliant  taxpayers and, perhaps more importantly, promotes voluntary compliance  by giving taxpayers confidence that others are paying their fair share. In  2016, IRS estimated that the average annual gross tax gap—the  difference between taxes owed and taxes paid on time—was $458 billion  for tax years 2008-2010. IRS is able to recover a portion of the tax gap. In  2016, IRS estimated that it will eventually collect $52 billion of the tax gap  through enforcement actions and late payments, leaving an annual  estimated net tax gap of $406 billion for tax years 2008-2010.
In 2015, we expanded the enforcement of tax laws high-risk area to  include IRS’s efforts to address tax refund fraud due to IDT, which occurs  when an identity thief files a fraudulent tax return using a legitimate  taxpayer’s identifying information and claims a refund. According to IRS, it  estimates that at least $14.5 billion in IDT tax refund fraud was attempted  in tax year 2015, of which it prevented at least $12.3 billion (85 percent).  Of the amount attempted, IRS estimated that at least $2.2 billion (15  percent) was paid.
section_title: What GAO Found
paragraphs: As previously mentioned, IRS continues to demonstrate top leadership  support for improving tax compliance and addressing the tax gap. For  example, it continues to research the extent and causes of taxpayer  noncompliance, and released an updated tax gap estimate in April 2016.  The agency has also taken steps to address IDT refund fraud, such as  increasing the number of staff and resources dedicated to combating this  issue. IRS has now partially met the criterion for capacity with respect to  combating IDT refund fraud. But as also cited above, IRS’s capacity to  implement new initiatives, carry out ongoing enforcement and taxpayer  service programs, and combat IDT refund fraud under an uncertain  budgetary environment remains a challenge. Annual appropriations  increased by $290 million between fiscal years 2015 ($10.9 billion) and  2016 ($11.2 billion), but remain about $900 million (about 7 percent)  below fiscal year 2011 levels ($12.1 billion).
IRS continues to take actions toward meeting three other criteria for  removal from our High-Risk List: developing a corrective action plan,  monitoring, and demonstrating progress. For example, IRS’s strategic  plan includes general approaches to make voluntary compliance easier  for taxpayers. IRS also has a strategic plan that identifies refund fraud  and IDT as challenges facing the nation’s tax system over the next  several years. However, IRS has not yet implemented some of our  recommendations highlighted in the 2015 high-risk report that could help  it improve its corrective action plan, such as better measuring return-on- investment (ROI), better leveraging automated processes, and improving  enforcement data. Also, for some compliance initiatives, such as those  related to the Foreign Account Tax Compliance Act or the Patient  Protection and Affordable Care Act (PPACA), IRS will need to continue to  focus on measuring results and the effect of these initiatives on the tax  gap.
While IRS has developed research efforts to assess its IDT defense  effectiveness, the agency needs to do more to demonstrate progress.  Due in part to substantial methodological changes used to estimate the  amount of IDT refund fraud prevented, year over year comparisons in  IRS’s estimates of IDT refund fraud prevented and paid are not  comparable. In addition, the agency has yet to address key weaknesses  in authenticating taxpayers. While IRS is taking steps to improve  authentication, it will still be vulnerable until it completes and uses the  results of its analysis of costs, benefits, and risk to inform decision- making.
Although more needs to be done, Congress and IRS have taken steps to  implement a number of our recommendations that have resulted in  benefits. For example, Congress passed legislation targeted at further  strengthening tax law enforcement, including the Tax Equity and Fiscal  Responsibility Act (TEFRA), which will improve the efficiency of  partnership audits. Congress also passed legislation that will increase tax  compliance through improved third-party reporting requirements,  strengthened controls over higher education tax benefits to reduce  inaccurate claims, and provided IRS with authority to correct errors  related to the First-Time Home Buyer’s Credit. IRS and congressional  actions based on our work in this area resulted in a total financial savings  of approximately $7.8 billion between 2011 and 2016 and an estimated  $12.5 billion in additional revenue over the next 8 years.
section_title: What Remains to Be Done
subsections: section_title: Enforcing Tax Laws
paragraphs: IRS should implement our open recommendations, especially those that  focus on improving audit effectiveness, taxpayer services, and resource  investment decision making and oversight. Specifically, IRS should:  continue to develop and implement a long-term strategy to address  operations amidst an uncertain budget environment; determine resource allocation strategies for its enforcement efforts  such as large partnership audits; assess the performance of its information technology (IT) investments  as well as improve its IT security and online web services; develop a strategy for better identifying partnership noncompliance  and assessing the effectiveness of exam selection;  strengthen referral programs so whistleblowers and other  stakeholders can more easily submit information to IRS about tax  noncompliance; and enhance taxpayer services by developing a long-term strategy for  providing web-based services to taxpayers, and improve telephone  service by establishing a customer service standard and identifying  resources needed to achieve that standard.
section_title: IDT Refund Fraud
paragraphs: With regard to IDT refund fraud, IRS should implement our open  recommendations, including  identifying and addressing authentication risks associated with the  Taxpayer Protection Program; estimating and documenting the costs, benefits, and risks of possible  options for taxpayer authentication; and  improving third-party partnership programs.
section_title: Congressional Actions Needed
paragraphs: Given that the tax gap has been a persistent issue, we have previously  reported that reducing it will require targeted legislative actions, including  the following:
Additional third-party information reporting. Taxpayers are much  more likely to report their income accurately when the income is also  reported to IRS by a third party. In 2008 and 2009, we suggested  Congress consider expanding third-party information reporting to  include payments for services to rental real estate owners and  payments for services provided by corporations, respectively. In 2010,  the Joint Committee on Taxation estimated that, for a 10-year period,  tax compliance could potentially increase by $2.5 billion if third parties  reported rental real estate service payments, and $3.4 billion if third  parties reported service payments to corporations. Congress enacted  a more expansive regime in 2010 covering reporting of payments for  goods as well as services, and subsequently repealed these  provisions.
Enhanced electronic filing. Requiring additional taxpayers to  electronically file tax and information returns could help IRS improve  compliance efficiently. Current law requires entities that file more than  250 returns during a year or partnerships with more than 100 partners  to file electronically. In 2014, we suggested that Congress consider  expanding the mandate for partnerships and corporations to  electronically file their tax returns, as this could help IRS reduce return  processing costs, select the most productive tax returns to examine,  and examine fewer compliant taxpayers.
Increased electronic filing would also allow IRS to obtain timely, accurate  data from a significant number of additional employers, and could further  enhance the benefits IRS could obtain from the accelerated Wage and  Tax Statement (W-2) deadline and prerefund W-2 matching. Treasury has  requested authority to reduce the current 250-return threshold for  employers electronically filing information returns. In 2014, we suggested  that Congress consider authorizing Treasury to lower the threshold for  electronic filing of W-2s from 250 returns annually to between 5 to 10  returns, as appropriate.
Math error authority. Providing IRS with correctible authority with  appropriate safeguards to permit it to correct errors in cases where  information provided by the taxpayer does not match information in  government databases, among other things, could help IRS correct  additional errors and avoid burdensome audits and taxpayer  penalties. Congress enacted legislation in December 2015 that  expands the circumstances in which IRS may use math error authority  in some situations for selected refundable tax credits. While  expanding math error authority is consistent with what we have  previously suggested, we had suggested that math error authority be  authorized on a broader basis with appropriate controls rather than on  a piecemeal basis, and that controls may be needed to ensure that  this authority is used properly. Our prior work identified potential  controls, such as requiring IRS to report on its use of math error  authority.
Paid preparer regulation. Establishing requirements for paid tax  return preparers could improve the accuracy of the tax returns they  prepare. In 2014, we suggested Congress consider granting IRS the  authority to regulate paid tax preparers, if it agrees that significant  paid preparer errors exist. The Joint Committee on Taxation estimated  that legislation to regulate paid preparers would increase tax  compliance by $135 million in revenue through fiscal year 2025.
Tax reform and simplification. A broader opportunity to address the  tax gap involves simplifying the Internal Revenue Code, as complexity  can confuse taxpayers and provide opportunities to hide willful  noncompliance. Fundamental tax reform could result in a smaller tax  gap if the new system has fewer tax preferences or complex tax code  provisions; such reform could reduce IRS’s enforcement challenges  and increase public confidence in the tax system. Short of  fundamental reform, targeted simplification opportunities also exist.  Amending the tax code to define terms more consistently across tax  provisions could help taxpayers more easily understand and comply  with their obligations and get the maximum tax benefit for their  situations. For example, there are several provisions in the tax code  benefiting taxpayers’ educational expenses, but the definition of what  qualifies as a higher-education expense varies between these tax  expenditures.
section_title: Additional Details on What GAO Found
subsections: section_title: Enforcement of Tax laws
subsections: section_title: Leadership Commitment
paragraphs: IRS has met the criterion of demonstrating a strong commitment to, and  top leadership support for, improving tax compliance and addressing the  tax gap. Some steps IRS has taken include the following:  IRS adopted a new, more strategic approach to identifying and  selecting budget program priorities. IRS prioritized a subset of its 19  strategic objectives for action and established six themes that  represent its “future state” vision for tax administration. In the fiscal  year 2017 congressional justification, IRS linked requests for  increased funding to the themes and included details on how much  would be funded by each appropriation account. IRS also identified  enterprise goals to guide the IRS toward the future state. However, as  of December 2016, IRS has yet to set targets for meeting the goals,  but plans to have targets in place by June 2017.
IRS has continued to research the extent and causes of taxpayer  noncompliance. We have consistently stressed the importance of IRS  conducting tax compliance research.
IRS extended a program to encourage taxpayers to voluntarily report  their previously undisclosed foreign accounts and assets. IRS has  collected over $10 billion since this program was initiated in 2009, and  has implemented some of our recommendations on better managing  the program.
section_title: Capacity
paragraphs: IRS has not met the criterion of having the capacity to demonstrate  progress toward improving compliance and addressing the tax gap. IRS’s  ability to carry out ongoing enforcement programs and implement new  initiatives to improve tax law enforcement, such as those required by  PPACA, could be challenged under an uncertain budget environment.  IRS is further challenged because it does not calculate ROI estimates for  each enforcement program— information IRS could use to inform  resource allocation decisions. IRS has also not determined how to best  leverage automated processes and stakeholders such as whistleblowers.
Between fiscal years 2011 and 2016, IRS’s annual appropriations  declined about $900 million. Likewise, staffing has declined: full-time  equivalent staff members funded by annual appropriations declined by  12,000 between fiscal year 2011 and fiscal year 2016, a 13 percent  reduction. At the same time, IRS’s enforcement performance has  declined. For example, the individual examination (or audit) coverage rate  declined by 20 percent from fiscal years 2013 to 2015—the most recent  years available. Reductions in examinations can reduce revenue  collected and may indirectly reduce voluntary compliance. These declines  have also contributed to fluctuations in taxpayer service and longer wait  times on the phones than taxpayers have historically experienced.
section_title: Action Plan
paragraphs: IRS partially meets the criterion for having a corrective action plan to  improve tax compliance and address the tax gap. Specifically, IRS has a  strategic plan that discusses general approaches to make voluntary  compliance easier for taxpayers and to ensure taxes owed are paid.  However, in some areas, the plan does not include specific tactics for  improving compliance strategies. We have identified and made  recommendations in several areas that could help IRS improve its  corrective action plan. We subsequently designated several of these as  priority recommendations, because if implemented, they could yield  significant improvements to IRS’s operations.
Better measure return on investment. IRS’s budget environment  and increased workload underscore the importance of IRS maximizing  its resources in fulfilling its mission. By further refining direct revenue  ROI measures of its enforcement programs, IRS could improve how it  allocates resources across its programs. In 2012, we made various  recommendations advising IRS to make better use of ROI measures,  subject to other considerations of tax administration, such as  minimizing compliance costs and ensuring equitable treatment across  different groups of taxpayers.
IRS is taking steps to implement these priority recommendations. For  example, IRS has made progress developing a methodology for  estimating marginal ratios for a limited subset of cases within the  correspondence examination program. IRS officials are working to  apply this methodology more broadly; however, they expect this effort  will be complex and time consuming. As of November 2016, officials  do not have a timeline for full implementation. Until IRS takes into  account some measure of revenue yield per dollar of cost when  making allocation decisions, it may be missing opportunities to collect  significant amounts of additional revenue.
Better leverage automated processes. Taking greater advantage of  automated processes could enhance some IRS enforcement  programs. For example, IRS does not routinely match the K-1  information return—on which partnerships and S corporations report  income distributed to partners or shareholders—to income information  on tax returns for partners and shareholders that are themselves  partnerships and S corporations. Matching such information might be  another tool for detecting noncompliance by these types of entities. In  2014, we recommended that IRS test the feasibility of such matching.  IRS stated it would consider studying such testing if resources  become available.
Likewise, continuing to enhance automated taxpayer services, such  as web services, could result in lower-cost methods of interacting with  taxpayers. In 2013, we made various recommendations for IRS to  improve web services provided to taxpayers. IRS has made progress  in addressing these priority recommendations but has not yet  completed its efforts. IRS’s strategy has evolved from a singular focus  on online services to a more comprehensive strategy of taxpayer  interaction—the Future State Initiative—through all service channels.
We will continue to assess the new initiative as IRS continues its  development.
Improve enforcement data. More complete enforcement data could  help IRS better allocate resources across programs. For example, in  2014, we found that IRS did not know the full extent to which  partnerships and S-corporations misreported income, and that IRS  examinations and automated document matching have not been  effective at finding most of the estimated misreported income. Further,  IRS does not know how partnerships misreporting income affects  taxes paid by partners. We recommended, among other things, that  IRS (1) develop and implement a strategy to improve its information  on the extent and nature of partnership misreporting, and (2) use the  information to potentially improve how it selects partnership returns to  examine. IRS agreed with these priority recommendations and  developed a strategy, which will involve a multiyear examination effort  to collect audit data from a representative, statistical sample of  partnerships. Information from the full study will help IRS make better- informed data-based decisions on enforcement decisions. IRS  officials also reported that in January 2016, IRS launched a research  study on a subset of the population of partnerships with three or fewer  individual partners. The results of this study could improve IRS’s  ability to estimate the extent and nature of partnership misreporting,  and the effectiveness of partnership examinations in detecting  misreporting. However, as of December 2016, IRS had not fully  implemented the strategy or the research study on small partnerships.
section_title: Monitoring
paragraphs: IRS partially meets the criterion of having a program to monitor corrective  measures. As previously mentioned, IRS continues to research the extent  of taxpayer noncompliance, and periodically estimates the voluntary  compliance rate—the amount of tax for a given year that is paid on time.  However, IRS does not adequately measure the impact of some specific  compliance programs, such as the following:
Correspondence examinations. IRS does not have information to  determine how its program of examining tax returns via  correspondence affects the agency’s broader strategic goals for  compliance, taxpayer burden, and cost. Thus, it is not possible to tell  whether the program is performing better or worse from one year to  the next. In 2014, we made several recommendations, including a  priority recommendation, related to monitoring program performance.  IRS officials provided documents intended to establish  correspondence audit program objectives and measures, and link  them to the overall IRS goals and objectives; but the objectives,  measures, and links were not clear. As of January 2017, officials had  no planned date by which to clearly document the objectives,  measures, and links. They said they expect to describe the objectives  in program guidance changes anticipated in the next 12 to 18 months.
Compliance Assurance Process. IRS does not fully assess the  savings it achieves through its Compliance Assurance Process  (CAP)—through which large corporate taxpayers and IRS agree on  how to report tax issues before tax returns are filed. In 2013, we  recommended that IRS track savings from CAP and develop a plan  for reinvesting any savings to help insure the program is meeting its  goals. Although IRS has taken steps to track savings by analyzing  and comparing the workload inventory of account coordinators who  handle CAP cases against team coordinators who handle non-CAP  cases, it did not show how such a workload comparison demonstrated  savings from CAP. IRS has also not developed a plan for reinvesting  any savings. Without a plan for tracking savings and using the savings  to increase audit coverage, IRS cannot be assured that the savings  are effectively invested in either CAP or non-CAP cases with high  compliance risk. As of November 2016, IRS is evaluating the CAP  program to determine how it fits with IRS’s future vision for  examinations, but it has no timetable for completing this evaluation.  Also, IRS did not accept new CAP applications for 2016.
section_title: Demonstrated Progress
paragraphs: IRS has partially met the criterion of demonstrating progress in  implementing corrective measures to improve compliance and reduce the  tax gap. For example, IRS is taking steps to better leverage stakeholders  by strengthening its nine public referrals programs—which enable  individuals to submit information to IRS about tax noncompliance—but  has not yet determined how to measure results for other programs  intended to leverage third-party information to improve compliance.  Specifically,
Public Referral Programs. Public referral programs are an important  piece of IRS’s overall enforcement strategy and can help reduce the  tax gap. We made several recommendations to IRS, including that it  establish a coordination mechanism to communicate across the  multiple referral programs, develop an online referral submission  process, streamline the review process, and improve external  communication. IRS has taken some actions to establish a  mechanism to coordinate on a plan and timeline for developing a  consolidated, online referral submission, which is also a priority  recommendation. For example, IRS established a cross-functional  team in February 2016 to conduct a comprehensive review of IRS’s  referral programs. In November 2016, the cross-functional team  proposed creating an online submission referral application to simplify  access and filing of information referrals by the public. The team also  requested information technology resources for fiscal year 2019 to  develop an online system which it said could potentially replace four  separate referral forms, filter out incomplete referrals, and  electronically route referrals for further IRS action. IRS assessed  options for consolidating all forms for the various referral programs  and determined that a consolidated single form was not feasible at  this time due to the technical nature and complexity of the various  referral types. As of December 2016, IRS said it will consider further  consolidation of the referral programs once the online application is in  place.
Whistleblower Office. We also identified key problems specific to the  whistleblower program, which is the largest of IRS’s nine referral  programs. For example, few large awards have been paid, claims  take years to process, and communication with whistleblowers is  limited. IRS agreed with our 10 recommendations to strengthen the  whistleblower program, has already implemented several of them, and  is in the process of implementing the rest. Until IRS completes these  actions, it may be missing opportunities to assist the public, collect  billions in uncollected taxes owed, and leverage resources to  streamline processes, which could help it to better coordinate and  identify possible efficiencies, as well as better manage fragmentation  and overlap among its referral programs.
Efforts to Encourage Voluntary Compliance. Also, as previously  mentioned, IRS has collected more than $10 billion through its  program to encourage taxpayers to voluntarily report their previously  undisclosed foreign accounts and assets. However, for some  initiatives—such as those related to the Foreign Account Tax  Compliance Act or using payment data from credit card companies to  improve compliance among small businesses—IRS is still determining  how to best measure results, including the effect on the tax gap.
section_title: Refund Fraud Related to Identity Theft
subsections: section_title: Leadership Commitment
paragraphs: IRS has met the criterion for demonstrating leadership commitment for  combating IDT refund fraud. The agency has taken steps to address IDT  refund fraud, including recognizing the challenge of IDT refund fraud in its  fiscal year 2014-2017 strategic plan, and expanding its automated fraud  filters to detect IDT and prevent fraudulent refunds. The IRS  Commissioner has testified numerous times about the challenges from  IDT refund fraud and the agency’s progress on the issue. Further, the IRS  Commissioner convened a Security Summit in March 2015 to bring  together representatives of the tax preparation and software industry and  state tax administrators to launch a collaborative effort to combat IDT  refund fraud. According to IRS officials, this collaboration has resulted in  enhanced authentication procedures and data sharing. IRS’s Identity  Theft Tax Refund Fraud Information Sharing and Analysis Center—where  IRS, states, and industry can share information—is intended to become  operational at the start of the 2017 Filing Season in January.
section_title: Capacity
paragraphs: IRS has partially met the criterion for having the capacity to combat IDT  refund fraud. In fiscal year 2016, IRS reported that it staffed more than  4,000 full-time equivalents (FTE) and spent about $516 million on all  refund fraud and IDT activities. Under the Consolidated Appropriations  Act 2016, IRS received an additional $290 million to improve customer  service, IDT identification and prevention, and cybersecurity efforts. The  agency requested an additional $90 million and an additional 491 FTEs  for fiscal year 2017 to help prevent IDT refund fraud and reduce other  improper payments. At the same time, IRS’s ability to combat IDT refund  fraud will continue to be challenged by “adaptive adversaries” that  continuously change their methods as IRS improves its defenses. For  example, recent schemes have involved fraudsters targeting sources of  personal and financial information—such as payroll providers and IRS’s  Get Transcript service—in order to file returns that look like past returns  filed by legitimate taxpayers. IRS is also constrained in its ability to  combat IDT refund fraud because it must balance the need to prevent  fraud against increasing the burden on legitimate taxpayers filing their  taxes.
section_title: Action Plan
paragraphs: IRS has met the criterion for having an action plan to address IDT refund  fraud. IRS has a strategic plan that identifies refund fraud and IDT as  major challenges facing the nation’s tax system over the next several  years. IRS has also identified several strategic objectives relevant to its  efforts to combat IDT, including balancing the speed of refund delivery  with the need to verify taxpayers’ identities; and using third-party data,  risk modeling, and a historical view of taxpayer interactions to prevent  fraud before issuing refunds. In addition, IRS developed a more detailed  Refund Fraud & IDT Strategy in January 2015 and updated it in January  2016. The strategy identifies and assesses the costs and benefits of  actions IRS can take to combat IDT refund fraud (both with and without  legislative change or a significant change in taxpayer expectations). The  strategy has not been updated to reflect new, earlier W-2 filing deadlines  enacted in December 2015 as part of the 2016 Consolidated  Appropriations Act. However, officials told us that the agency is working  with the Social Security Administration to accommodate earlier W-2 data,  and plans to use the data, when available, to match to information  reported on tax returns. According to IRS, prerefund matching using  earlier W-2 data would potentially save a substantial part of the billions of  taxpayer dollars currently lost to fraudsters.
section_title: Monitoring
paragraphs: IRS has partially met the criterion of having a program to monitor  corrective measures. IRS’s Identity Theft Taxonomy (Taxonomy) is a  research-based effort to provide information to internal and external  stakeholders about the effectiveness of IRS’s IDT defenses and help IRS  identify IDT trends and evolving risks. While IRS has implemented a new  methodology to improve its 2014 estimates in response to our past  recommendations, additional action is needed. We will analyze the 2015  Taxonomy estimates to determine the extent to which our  recommendations have been implemented.
section_title: Demonstrated Progress
paragraphs: IRS has partially met the criterion for demonstrating progress in  implementing corrective measures to address IDT refund fraud. IRS has  developed tools and programs to further detect and prevent IDT refund  fraud. IRS has also enhanced its authentication efforts for some online  services, such as the Get Transcript application. However, IRS could  further demonstrate progress by, for example, implementing our previous  priority recommendation related to authentication weaknesses. While IRS  has taken steps to address this recommendation, the agency has not  used cost-benefit-risk analysis to select which authentication tools to use  for certain taxpayer interactions. Without analysis of costs, benefits, and  risks, IRS and Congress may not have quantitative information that could  inform decisions about whether and how much to invest in the various  authentication options.
While IRS has developed research efforts to assess the effectiveness of  its IDT defenses, it is unclear whether yearly changes in the amount of  estimated IDT refund fraud prevented and paid are due to: methodological changes (i.e., using a different data source); overall changes in fraud patterns (i.e., an increase or decrease in  improvements in IRS IDT defenses; or  fraudsters’ ability to file returns using schemes IRS has not yet  learned to detect.
Specifically, IRS’s 2014 estimates cannot be compared to 2013 estimates  because of substantial methodology changes that better reflect new IDT  refund fraud schemes and improve the accuracy of its estimates,  according to IRS officials.
section_title: Benefits Achieved by Implementing our Recommendations
paragraphs: Improving Efficiency of Partnership Audits. Congress enacted  legislation that alters the Tax Equity and Fiscal Responsibility Act  (TEFRA) audit procedures, as we suggested in September 2014. The  Bipartisan Budget Act of 2015, which was enacted in November 2015,  repeals TEFRA audit procedures and mandates audit procedures that  require partnerships with more than 100 partners to pay audit  adjustments at the partnership level, among other changes. The  legislative changes enacted to TEFRA we suggested could help with  the time constraints of large partnership audits as well as reduce the  resource demands of those audits. The Joint Committee on Taxation  estimates this should raise $9.3 billion in additional revenue from  fiscal years 2019 to 2025.
Increasing Tax Compliance through Third-Party Reporting. Our  past work underscored that data reported to IRS by third parties about  taxpayers’ income is a powerful tool to improve taxpayer compliance.  In response, Congress passed legislation in 2008—effective in 2011,  which required banks and others to report income that merchants  received through certain payment methods such as credit cards or  third-party networks like PayPal. IRS compares this information to  the merchants’ tax returns to help verify taxpayer compliance, which  the Joint Committee on Taxation estimated would increase tax  compliance by $3.9 billion between 2013 and 2016.
Improving Tax Reporting on the Sale of Securities. We reported  that many taxpayers misreported their capital gains or losses from the  sale of securities. This often happened because taxpayers failed to  accurately report the cost of the securities they sold. We suggested  that Congress require brokers to report to both taxpayers and IRS the  adjusted cost of the securities sold by taxpayers. In response,  Congress enacted this requirement in 2008, which the Joint  Committee on Taxation estimated would increase tax compliance by  $3.2 billion between 2012 and 2016.
Reporting Additional Mortgage Debt Information to Increase Tax  Compliance. In 2015, Congress enacted the Surface Transportation  and Veterans Health Care Choice Improvement Act. Section 2003 of  the act requires taxpayers receiving mortgage interest payments to  report the origination date of the mortgage, the amount of outstanding  principal at the beginning of the calendar year, and the property’s  address. In response to the legislation, IRS updated Form 1098  Mortgage Interest Statement for 2016, which is available for the 2017  filing season. The Joint Committee on Taxation estimated that this  change would increase tax compliance by $1.8 billion between 2015  and 2025.
Strengthening Controls Over Higher Education Tax Benefits.  Congress enacted three provisions in 2015 to strengthen controls  over higher education tax benefits to reduce inaccurate claims. These  provisions: 1) require educational institutions to report only the  aggregate amount of qualified tuition and related expenses actually  paid to the educational institution during the calendar year; 2) require  taxpayers to receive a completed Form 1098-T to claim a credit or  deduction for education expenses for tax years beginning after the  date of enactment; and 3) require educational institutions to provide  their employer identification number on the Form 1098-T, and  taxpayers claiming a credit for qualified tuition and educational  expenses to provide this employer identification number. The Joint  Committee on Taxation estimated that these changes would increase  tax compliance by $2 million, $576 million, and $837 million,  respectively, between fiscal years 2016 and 2025.
Reducing Funding Requests by Modifying Cost Calculation of  New Hires. Prior to the fiscal year 2015 budget request, IRS assumed  all new staff requested for new initiatives in the budget request would  be hired at the start of the fiscal year, although actual hiring patterns  indicated new staff were brought on throughout the fiscal year and  primarily in the 3rd and 4th quarters. As a result, IRS modified its  calculation for new hires using a later estimated hire date. In the fiscal  year 2015 and 2016 request, the estimated hire date was January  1st—the end of the 1st quarter. In the fiscal year 2017 request, the  estimated hire date was April 1st—the start of the 3rd quarter. As a  result, the funding requests for fiscal years 2015, 2016 and 2017 were  approximately $518 million less than if IRS used its prior methodology  for calculating FTE costs associated with new initiatives.
Expanding Math Error Authority to Enforce First-Time  Homebuyer Credit (FTHBC) Repayment Provision. In 2009, we  found that IRS lacked math error authority, which must be provided by  statute, to automatically correct tax returns on which taxpayers  claimed the 2008 version of the FTHBC but did not repay it as  required. We suggested that IRS be granted math error authority to  enforce the FTHBC repayment provision. In response, Congress  enacted legislation in 2009 granting IRS math error authority for this  purpose, which we estimate has increased tax compliance by  approximately $206 million between 2011 and 2014, after accounting  for IRS costs.
Redirecting Resources to Improve Taxpayer Services. In  December 2012, we reported that IRS had made incremental  efficiency gains in delivering taxpayer services, but the agency  needed to do more to combat the imbalance between taxpayer  demand for services and available resources. IRS acknowledged it  needed to adjust its taxpayer service delivery because the agency  lacked sufficient resources to answer every telephone call and serve  every taxpayer who visits a walk-in site. Consistent with our finding  that a more dramatic revision in providing service was necessary, IRS  implemented six service initiatives in fiscal year 2014 that shifted  taxpayers from using telephone and walk-in services to more cost- effective self-service options. As a result of these initiatives, IRS  realized about $50.6 million of IRS resources in fiscal year 2016  dollars.
Identifying Taxpayers Using Quiet Disclosures to Circumvent  Taxes. In March 2016, IRS officials reported completing research to  determine and implement the best option for identifying and pursuing  potential quiet disclosures, as we recommended in March 2013. IRS  reported that it identified more than 350 cases using its new  methodology and as of October 2016 had completed examinations of  179 taxpayers, resulting in approximately $9.1 million in additional tax  assessments.
Using Data to Improve Taxpayer Services. IRS officials analyzed  correspondence response timeliness data through the end of fiscal  year 2014 and found that delays were continuing and more  improvements were needed, including further revisions to notices and  a revised automated recorded telephone message for taxpayers  calling about the status of an audit. By analyzing the data as we  recommended in June 2014, and using that data to change outgoing  recorded messages starting in January 2015, IRS is better able to  improve taxpayer service, reduce the need for taxpayer calls, and  more efficiently use IRS resources.
Taking Steps to Improve Claims Process and Communications to  Encourage Tax Whistleblowers. Our 2015 review of the IRS  whistleblower program resulted in ten recommendations. IRS  concurred with these recommendations and has already implemented  several of them. Both whistleblowers and IRS stand to benefit greatly  as a result of actions IRS has taken such as streamlining the intake  and initial review process of whistleblower claims and improving  communications. For example, having a more streamlined staffing  strategy will allow the Whistleblower Office to review more claims in a  timely manner and get information to examiners more quickly to help  IRS collect additional revenue. Also, communicating relevant  information earlier to whistleblowers will help address a common  complaint of the whistleblower community about the lack of timely  communication from the Whistleblower Office and could encourage  more whistleblowers to come forward with information.
Using Employer Wage Data to Prevent Identity Theft Fraud. In  2014, we found that fraudsters take advantage of IRS’s “look back”  compliance model, where the agency issues refunds before  completing all compliance checks. If IRS matched employer wage  data to tax returns earlier, before issuing refunds, it could help prevent  fraud. We recommended that IRS assess the costs and benefits of  accelerating W-2 deadlines and provide this information to Congress.  Based on our review, in September 2015, IRS presented Congress  with a document detailing the costs and benefits of W-2 acceleration.  The document discusses the IRS systems and work processes that  will need to be adjusted to accommodate earlier, prerefund matching  of W-2s, the time frames for when these changes could be made;  potential impacts on taxpayers, IRS, other parties; and what other  changes will be needed (such as delaying refunds) to ensure IRS can  match tax returns to W-2 data before issuing refunds. Congress  accelerated W-2 filing deadlines to January 31 as part of the 2016  Consolidated Appropriations Act. This change will provide IRS with  earlier access to W-2 data. According to IRS, prerefund matching  would potentially save a substantial part of the billions of taxpayer  dollars currently lost to fraudsters.
Improving IRS’s estimates of IDT refund fraud. Based on our  review, in August 2014 IRS changed its methodology for counting  fraudulent IDT refunds paid, which increased the estimate of IDT  refunds paid in 2013 by about $1 billion (from its original estimate of  $4.8 billion to $5.8 billion).The research IRS used to develop these  refund fraud estimates is important as it helps IRS better understand  how IDT refund fraud is bypassing agency defenses to improve IDT  controls. In June of 2016, we made additional recommendations that  IRS improve its IDT cost estimates by removing refund thresholds and  using return-level data where available.
Improving the design and implementation of exempt organization  examination selection. The Exempt Organizations Exam unit within  IRS completed an action plan for the process of reviewing and  updating its Internal Revenue Manual sections on an ongoing basis,  as we recommended in July 2015. Implementation of the plan began  at the end of 2015. Updated and accurate procedures help ensure  that employees follow correct procedures and consistently administer  tax laws.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact James R.  McTigue, Jr., or Jessica Lucas-Judy at 202-512-9110 or  mctiguej@gao.gov or lucasjudyj@gao.gov.
section_title: Related GAO Products
paragraphs: Refundable Tax Credits: Comprehensive Compliance Strategy and  Expanded Use of Data Could Strengthen IRS’s Efforts to Address  Noncompliance. GAO-16-475. Washington, D.C.: May 27, 2016.
GAO Series of Reports on Identity Theft: Identity Theft and Tax Fraud:  IRS Needs to Update Its Risk Assessment for the Taxpayer Protection  Program. GAO-16-508; Washington, D.C.: May 24, 2016; Identity Theft  and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud,  but IRS Lacks an Estimate of Costs, Benefits and Risks. GAO-15-119.  Washington, D.C.: January 20, 2015; and Identity Theft: Additional  Actions Could Help IRS Combat the Large, Evolving Threat of Refund  Fraud. GAO-14-633. Washington, D.C.: August 20, 2014.
IRS Referral Programs: Opportunities Exist to Strengthen Controls and  Increase Coordination across Overlapping Programs, GAO-16-155.  Washington, D.C.: February 23, 2016.  2015 Tax Filing Season: Deteriorating Taxpayer Service Underscores  Need for a Comprehensive Strategy and Process Efficiencies.  GAO-16-151. Washington, D.C.: December 16, 2015.
IRS Whistleblower Program: Billions Collected, but Timeliness and  Communication Concerns May Discourage Whistleblowers. GAO-16-20.  Washington, D.C.: October 29, 2015.
Small Businesses: IRS Considers Taxpayer Burden in Tax  Administration, but Needs a Plan to Evaluate the Use of Payment Card  Information for Compliance Efforts. GAO-15-513. Washington, D.C.: June  30, 2015.
Large Partnerships: With Growing Number of Partnerships, IRS Needs to  Improve Audit Efficiency. GAO-14-732. Washington, D.C.: September 18,  2014.
IRS Correspondence Audits: Better Management Could Improve Tax  Compliance and Reduce Taxpayer Burden. GAO-14-479. Washington,  D.C.: June 5, 2014.
Partnerships and S Corporations: IRS Needs to Improve Information to  Address Tax Noncompliance. GAO-14-453. Washington, D.C.: May 14,  2014.
section_title: Medicare Program
subsections: section_title: Current State of the Medicare Program
subsections: section_title: Overview of Medicare’s Challenges
paragraphs: We designated Medicare as a high-risk program in 1990 due to its size,  complexity, and susceptibility to mismanagement and improper  payments. Addressing Medicare’s short-term and long-term challenges is  vitally important, not only for the millions of aged and disabled individuals  who depend upon the program for health care coverage, but also for the  families of these individuals who might otherwise bear the cost of their  health care, the taxpayers who finance the program, and the health care  providers who depend upon receiving fair compensation for their services.  The aging of the population, coupled with the growth in per capita health  care costs, will magnify these challenges over time. Therefore, continued  close attention will be necessary to ensure that Medicare is sustainable  for generations to come.
subsections: section_title: Ongoing Challenges
paragraphs: Medicare continues to pose challenges to the federal government for  many of the same reasons we designated it a high-risk program.  Specifically, Medicare’s substantial size and scope result in the current  program having wide ranging effects on beneficiaries, the health care  sector, and the overall U.S. economy. In 2016, Medicare was projected to  spend $696 billion and provide health care coverage to over 57 million  beneficiaries. Medicare pays about 60 percent of the health care costs of  beneficiaries enrolled in fee-for-service (FFS) who do not reside in  institutions. Over 1 million health care providers, contractors, and  suppliers—including private health plans, physicians, hospitals, skilled  nursing facilities, durable medical equipment (DME) suppliers, ambulance  providers, and many others—receive payments from Medicare. Every  year, Medicare pays over a billion claims submitted by these health care  providers. Consequently, Medicare must be closely monitored because  even relatively small changes can have large short-term effects in the  aggregate. For example, Medicare provider payment rates that are set  too high unnecessarily financially burden beneficiaries—through higher  premiums and cost sharing—taxpayers, and the federal budget. Payment  rates that are set too low may diminish providers’ willingness to treat  Medicare beneficiaries and adversely affect their access to appropriate,  high-quality health care.
Medicare also has an outsize effect on the federal budget, which creates  challenges when the federal government is determining how to prioritize  its spending. The program’s expenditures currently account for about 3.6  percent of the country’s gross domestic product (GDP).The  Congressional Budget Office (CBO) projects that in fiscal year 2016,  Medicare outlays will total more than is projected to be spent on defense  ($579 billion) and almost double federal spending on Medicaid ($365  billion). Medicare spending will account for approximately 17.8 percent of  the approximately $3.9 trillion in federal outlays.
section_title: Long-Term Challenges
paragraphs: Medicare also poses substantial long-term financial challenges for the  federal government. Program spending is expected to increase  significantly over time as the number of beneficiaries grows and per  capita health care costs increase. CBO projects that, in just 10 years (in  2026) under current law, Medicare spending will reach almost $1.3 trillion.  The Medicare Trustees 2016 report stated that, under current law,  Medicare’s share of GDP would rise to 5.6 percent by 2040. As Medicare  spending grows disproportionately to other federal spending and the  economy, it will put increasing pressure on the federal budget and tend to  squeeze out spending for other programs.
However, the Trustees have stated that Medicare spending projections,  especially those stretching out over decades, are highly uncertain and  cautioned that future Medicare spending could be substantially higher  than projected. In their 2016 report, they noted that some Medicare cost- reduction provisions may be difficult to sustain.  For example, one set of  Medicare provisions affecting many types of health care providers  reduces the annual payment rate updates to account for economy-wide  productivity growth. However, the productivity growth rates historically  achieved by health care providers have been lower than the economy- wide rates. If health care providers do not realize sufficiently high  productivity growth and these cost-reduction measures are not sustained,  Medicare projected spending could rise to 6.2 percent of GDP in 2040  and 9.1 percent in 2090, according to the Trustees.
Another uncertainty is whether advances in medical technology will tend  to slow or accelerate Medicare spending growth. Technological advances  may enhance the ability of providers to diagnose, treat, or prevent health  problems. Examples include new drugs, devices, procedures, and  therapies, as well as new applications of existing technologies. Although  new technologies may decrease or increase health care costs, in 2013  we reported that technological change had likely been the dominant  cause (accounting for 36 to 55 percent) of the increases in overall U.S.  health care per capita spending over the past several decades. It should  be noted, however, that a complete assessment of health care spending  for new technologies should also consider the associated value for  individuals, often measured by improved health functioning, increased life  expectancy, or improved economic productivity.
In the past few years, growth in Medicare spending has slowed, as overall  health care spending has also slowed. Analysts debate whether this  slowdown can be attributed to transitory effects, such as the recent  economic turndown, or broader changes in the health care system that  may be longer lasting. Nonetheless, Medicare’s historical trends, the  aging of the population, and the uncertainties associated with recent  reforms and the effects of advances in medical technology all underscore  the need for continued efforts to moderate spending growth while  ensuring that beneficiaries have appropriate access to high-quality health  care. Achieving these goals will likely remain an important challenge and  require a continued focus on the Medicare program.
section_title: Highlights of Recent Key Legislation and Significant Reform Efforts
paragraphs: In March 2010, the Patient Protection and Affordable Care Act (PPACA)  was enacted, which, among other things, made numerous statutory  changes to Medicare. CBO estimated that PPACA would reduce  Medicare spending by about $400 billion over 10 years from fiscal year  2010 to fiscal year 2019. Major savings were expected from several  actions, including constraining annual payment updates to certain  Medicare providers, tying Medicare Advantage (MA)—Medicare’s private  plan alternative to the traditional Medicare FFS program—maximum  payment amounts to near or below FFS spending, reducing payments to  hospitals that serve a large number of low-income patients—reflecting the  expectation that PPACA’s health insurance expansion provisions would  result in far fewer uninsured hospital patients—and modifying the high- income threshold for adjusting beneficiary Part B premiums, among other  changes.
Some PPACA provisions sought to establish financial incentives for  providers to increase the efficiency and quality of Medicare services, or to  test new ways of achieving those goals. For example, PPACA required  the establishment of a national, voluntary pilot program to bundle  payments for physician, hospital, and post-acute care services to improve  patient care and reduce spending. Another provision modified payments  to hospitals that experience patient readmissions related to certain  potentially preventable conditions. Certain PPACA payment changes  seek to provide a strong financial incentive for health care providers to  enhance productivity, improve efficiency, or otherwise reduce their costs  per service. Notably, several of PPACA’s changes seek to implement  value-based purchasing of health care and transform the program into  one that encourages efficiency and quality, instead of simply  compensating providers for the volume of health care services.
In April 2015, the Medicare Access and CHIP Reauthorization Act of 2015  (MACRA) was enacted, bringing additional changes to the way Medicare  reimburses physicians, among other changes to Medicare. MACRA  repealed the sustainable growth rate (SGR) system—which was first  implemented in 1998 to moderate spending for physician services—and  established a new payment framework to encourage efficiency in the  provision of health care and to reward health care providers for higher  quality of care. Specifically, MACRA created a Merit-based Incentive  Payment System (MIPS) that will be used to increase or decrease certain  physicians’ payments based on their performance. Under MIPS, the  Centers for Medicare & Medicaid Services (CMS) will assess physician  performance in four categories: quality; cost; clinical practice  improvement activities; and advancing care information through the  meaningful use of electronic health records technology. MACRA also  included provisions to incentivize Medicare providers to participate in  alternative payment models, such as qualifying accountable care  organizations. In addition to reforming physician payment, MACRA made  several other changes to Medicare, including making income-related  adjustments to premiums in Medicare Parts B and D.
It is too early to tell the extent to which these changes in PPACA and  MACRA may help constrain Medicare spending over the long run, as the  changes have only recently been implemented, or their implementation is  ongoing. Moreover, future legislation could modify payment reforms, such  as those established by PPACA and MACRA, and affect their impact on  program spending. In addition, uncertainty about PPACA’s and MACRA’s  effects on spending exists because future spending may also depend on  changes in the rest of the health care system. For example, provisions of  PPACA are designed to increase the number of individuals with health  insurance and reduce the number of uninsured. In 2013, we found that  Medicare beneficiaries who had continuous health insurance coverage  before enrollment in Medicare reported being in better health in the 6  years after Medicare enrollment and, in the first year of Medicare  coverage, had significantly lower Medicare spending.
Additional spending uncertainty stems from concerns raised by the  Medicare Trustees, CBO, and the Office of the Actuary (OACT) about  whether some of the Medicare cost-containment mechanisms included in  PPACA can be sustained over the long term, such as the provider  productivity payment adjustment, and physician payment updates and  incentives included in MACRA. For example, additional payments for  alternative payment models provided under MACRA will expire in 2025,  and physician payment update amounts, which are not tied to economic  conditions, are not expected to keep pace with average physician cost  increases. The Medicare Trustees report for 2016 projected that,  beginning in 2048, physician payment rates will be lower than they would  have been under the SGR formula and will continue to be lower after that.  CBO and OACT both produced alternative projections of future spending  that assume that certain cost-containment mechanisms are not fully  maintained over the long term.
section_title: Our Work Suggests the Need for Continued Attention in Five Principal Areas
subsections: section_title: Payments and Provider Incentives in Traditional Medicare
paragraphs: Medicare is transitioning from a payment system that largely rewards the  volume and complexity of health care services provided to a system that  explicitly rewards quality and efficiency. Many of the broad-based reforms  being implemented to Medicare’s payment systems in the traditional FFS  program have introduced financial incentives into payment structures to  explicitly reward quality and efficiency, such as creating the Merit-based  Incentive Payment System discussed previously. To help ensure that  physicians are able to respond to these new incentives and are able to  improve their performance, CMS recently began to provide more frequent  feedback to physicians on their performance, as we recommended, to  help them identify opportunities to reduce costs and pinpoint high-cost  beneficiaries who may benefit from enhanced care coordination. MACRA  also required that CMS consider physician and other providers’  improvement and their opportunity for continued improvement when  establishing benchmarks for Merit-based Incentive Payment System  performance measures. As CMS progresses toward fully implementing its  value-based payment system, it will be important for the agency to use  reliable quality and cost measures and methodological approaches that  maximize the number of physicians for whom value can be determined.
As CMS implements these broad-based payment reforms, we have  identified additional areas where continued monitoring of payment  methods is warranted to encourage efficiency and reduce the risk of  overspending.
Payment methods for cancer hospitals. Currently, 11 cancer hospitals,  designated in the 1980s and 1990s, that meet certain statutory criteria are  exempt from Medicare’s inpatient prospective payment system (PPS) and  are also receiving payment adjustments under the outpatient PPS. The  Medicare PPS introduced better control over program spending and  provided hospitals with an incentive for efficient resource use. Yet for  decades, as required by law, Medicare has paid these cancer hospitals  differently than PPS hospitals in recognition of their specialized focus and  concerns that reimbursements under PPS would be inadequate to cover  costs for the types of care provided at cancer hospitals. This has  remained the case even as the inpatient PPS methodology has been  refined to better account for variation in the severity and complexity of  beneficiaries and the resource intensity of hospital care.
The 11 cancer hospitals currently exempted from the inpatient PPS and  receiving payment adjustments under the outpatient PPS are reimbursed  largely based on their reported costs and as such have little incentive for  containing costs. In 2012, we estimated that PPS-exempt cancer  hospitals received, on average, about 42 percent more in Medicare  inpatient payments per discharge than what Medicare would have paid a  local PPS teaching hospital to treat cancer beneficiaries with the same  level of complexity. Similarly, Medicare outpatient payment adjustments  to these cancer hospitals resulted in overall payments that were about 37  percent higher, on average, than payments Medicare would have made to  PPS teaching hospitals for the same set of services. Had beneficiaries of  PPS-exempt cancer hospitals received services at nearby PPS teaching  hospitals in 2012, the Medicare program may have saved almost $500  million. We suggested that Congress require Medicare to pay PPS- exempt hospitals as it pays PPS teaching hospitals, or provide the  Secretary of Health and Human Services the authority to otherwise  modify how Medicare pays these PPS-exempt hospitals. To generate  cost savings, we also suggested that Congress provide that all forgone  outpatient payment adjustment amounts be returned to the  Supplementary Medical Insurance Trust Fund, which funds Medicare Part  B services, such as physician visits, and Medicare Part D services, such  as prescription drugs. The 21st Century Cures Act, enacted in December  2016, slightly reduces the additional payments cancer hospitals receive  for outpatient services and returns savings to the Supplementary Medical  Insurance Trust Fund. However, the law keeps in place the payment  system for outpatient services that differs from how Medicare pays PPS  teaching hospitals. Moreover, the law does not change how PPS-exempt  cancer hospitals are paid for inpatient services. Until Medicare pays  PPS-exempt cancer hospitals in a way that encourages efficiency, rather  than largely on the basis of reported costs, Medicare remains at risk for  overspending.
Hospital-physician consolidation. Because Medicare often pays more  for services when they are performed in a hospital outpatient department  than when they are performed in a physician’s office, hospitals may have  an incentive to acquire physician practices, hire physicians as salaried  employees, or both—financial arrangements commonly referred to as  vertical consolidations. After hospitals and physicians vertically  consolidate, the same services that were once reimbursed by Medicare at  a lower total payment rate could be classified as hospital outpatient  department services and reimbursed at a higher rate. In our work, we  found that the number of vertically consolidated hospitals increased by  about 20 percent from 2007 through 2013 and the number of physicians  in these arrangements nearly doubled. Some have questioned whether  or to what extent vertical consolidations have contributed to the rapid rise  in Medicare expenditures for hospital outpatient departments, which  increased by more than eight percent annually from 2007 through 2013.  We found that the percentage of evaluation and management (E/M) office  visits performed in hospital outpatient departments was generally higher  in counties with higher levels of vertical consolidation.
The rise in vertical consolidation exacerbates a financial vulnerability in  Medicare’s payment policy—paying different rates for the same service,  depending on where the service is performed. Estimates from entities  such as the Bipartisan Policy Center and the Medicare Payment Advisory  Commission suggest that equalizing payments rates for E/M office visits  could save nearly $1 billion to $2 billion a year for the Medicare program  and beneficiaries. We suggested that Congress direct the Secretary of  Health and Human Services to equalize payment rates between settings  for E/M office visits and other services as appropriate. Until the disparity  in payment rates for E/M office visits is addressed, Medicare could be  expending more resources than necessary.
Payments for hospital uncompensated care. Hospital uncompensated  care costs are a long-standing concern because of their potential to  weaken hospitals’ financial stability and thereby hospitals’ abilities to  serve their communities. Both Medicare and Medicaid provide funds to  help offset hospitals’ uncompensated care costs. In fiscal year 2014,  Medicare made over $14 billion in payments to hospitals for  uncompensated care through a variety of payment types, including a  relatively new type of payment called Medicare Uncompensated Care  (UC) payments. We have raised concerns that Medicare UC payments  are largely based on hospitals’ Medicaid workload rather than hospitals’  actual uncompensated care costs, which can result in poor alignment  between payments and uncompensated care costs. This may be  particularly true in states that have expanded Medicaid—that is, coverage  expanded through PPACA to nearly all adults with incomes up to 133  percent of the poverty level—and therefore where lower uncompensated  care costs are expected.
In an April 2016 proposed rule, CMS announced that it is considering  making hospitals’ actual uncompensated care costs the sole basis for  making Medicare UC payments by fiscal year 2020. Another concern,  however, is that when making Medicare UC payments, CMS does not  account for payments hospitals received from Medicaid, even though the  bulk of Medicare’s payments are made on the basis of Medicaid  workloads, for which hospitals may have also received Medicaid  payments. We recommended that CMS improve the alignment of  Medicare UC payments with hospital uncompensated care costs and  account for Medicaid payments received when making Medicare UC  payments to individual hospitals. HHS concurred with these  recommendations and in its final rule indicated that it planned to  implement them beginning in fiscal year 2021 to allow time for hospitals to  collect and report reliable uncompensated care cost data.
Physician self-referral. Our work has identified opportunities for CMS to  introduce additional payment method refinements and controls in  Medicare FFS to encourage appropriate use of services. For example,  self-referral—when a provider refers patients to entities in which the  provider or the provider’s family members have a financial interest— continues to be a concern in relation to the rapid growth of Medicare FFS  expenditures. In recent years, we found that certain services—including  diagnostic imaging, certain cancer treatments, and diagnostic pathology  services—performed by self-referring groups have increased  dramatically. For example, from 2004 through 2010, the number of self- referred magnetic resonance imaging (MRI) services increased by more  than 80 percent; in comparison, the number of non-self-referred MRI  services increased by 12 percent during this time period. We have recommended that CMS determine and implement an approach to ensure  providers appropriately self-refer for advanced imaging services. HHS did  not concur with this recommendation but is in the process of establishing  an appropriate use criteria program for advanced imaging services that  would apply to all physicians—including those that self-refer—and which,  depending on implementation, could address our recommendation. CMS  has yet to take definitive steps to monitor physician self-referral for certain  cancer treatment and diagnostic pathology services, and until it does so,  the Medicare FFS program and its beneficiaries will continue to be at risk  for these rapidly increasing expenditures.
High-expenditure Part B drugs. In 2014, Medicare spent over $24  billion on drugs covered under Part B. Part B drugs are those commonly  administered by a physician or under a physician’s close supervision,  such as vaccines or some oral cancer drugs. The vast majority of these  expenditures ($21 billion) were based on the drug’s average sales price  (ASP), the amount physicians and other purchasers pay manufacturers  for the drug, which CMS calculates based on sales data reported by drug  manufacturers. Ensuring the accuracy of the data on which CMS bases  payment rates for part B ASP drugs is important given Medicare’s  substantial expenditures for these drugs and given beneficiaries’ general  responsibility to cover 20 percent of Medicare’s payment for these drugs  via cost-sharing requirements, which amounted to about $4 billion in  2014. We found, however, that CMS is not able to assess the accuracy of  all sales price data because not all manufacturers are required to submit  these data. Further, while CMS conducts certain checks to assess the  completeness of the sales data it does receive, the agency does not  verify the accuracy of the data by tracing it to source documents, such as  sales invoices. We suggested that Congress require all manufacturers of  Part B drugs to submit sales price data to CMS and to ensure CMS has  the authority to request source documentation and periodically validate  such data.
Additionally, the ASP does not account for drug coupon discounts that  manufacturers provide to privately insured patients, which reduce the  effective market price for these drugs. In our work, we found that the ASP  for several part B drugs with drug coupon discounts exceeded the  effective market price that manufacturers ultimately received. As a  result, Medicare may be paying more than necessary for these drugs.  Regular monitoring of the implications of coupon programs for Medicare’s  payment methodology for part B drugs is needed as CMS works to  propose an alternative payment system. CMS, however, lacks the  authority to collect data from drug manufacturers on coupon discounts to  patients because the authority to collect information relating to ASP is  based on manufacturer sales to purchasers. We suggested that Congress  consider granting CMS authority to collect data from drug manufacturers  on coupon discounts for Part B drugs based on ASP and require the  agency to periodically collect these data and report on the implications of  coupon programs for Part B drug payment rate methodology.
Low-volume payment adjustments. Medicare’s payment adjustment for  low-volume dialysis facilities is one of several modifications in Medicare’s  payment systems designed to help maintain beneficiaries’ access to care.  Low-volume providers in areas where other care options are limited may  warrant higher payments, and CMS intended this low-volume payment  adjustment (LVPA) to encourage small dialysis facilities to continue  operating in areas where beneficiary access might be jeopardized if such  facilities closed. However, in 2013 we found that, as designed, the LVPA  did not effectively achieve this goal because it did not target all relatively  low-volume, high-cost facilities that were in areas where beneficiaries  may have lacked other dialysis care options, and it targeted some  facilities that appeared unnecessary for ensuring access to dialysis, such  as dialysis facilities located in close proximity to other facilities. In  response to our report, CMS revised the LVPA, beginning in 2016, to  more effectively target low-volume facilities necessary for ensuring  access to care; and in 2015, CMS issued clarifying guidance on the LVPA  in a final rule and held outreach calls to dialysis facilities and Medicare  contractors to ensure their understanding of the guidance. The agency  has not acted, however, to implement an improvement we recommended  to change the design of LVPA to reduce the incentive for facilities to  restrict the services they provide in order to avoid reaching treatment  thresholds that determine eligibility for the program.
Physician payment rates. The accuracy of Medicare’s payment rate for  physician services has major implications for the health care system  given spending on these services—$70 billion in fiscal year 2015—and  the fact that other payers, such as private insurers, base their payment  rates at least in part on Medicare rates. Inaccurate payment rates can  create distorted incentives for physicians to either over- or underprovide  services or to pursue certain specialties. We and others have identified  several weaknesses in CMS’s processes for setting physician payment  rates. This process involves CMS assigning relative values to each  service by taking into account recommendations made by the American  Medical Association’s Specialty Society Relative Value Scale Update  Committee (RUC).
Some of our concerns with this process include issues with the survey  data the RUC uses in part to develop relative value recommendations,  including low survey response rates. In 2015, the median survey  response rate for over 200 physician services was about 2 percent.  Additionally, although CMS officials state that all Medicare services are  reviewed every 5 years as required by statute, the agency does not  maintain a database to track when services were last valued. CMS  officials acknowledge that the agency relies heavily on RUC  recommendations. Given the process and data-related weaknesses  associated with the RUC’s recommendations, this process could  potentially result in inaccurate payment rates. To address these concerns,  we recommended that CMS incorporate data and expertise from  physicians and other relevant stakeholders into the process for  establishing relative values. CMS concurred with this recommendation  and has begun to research ways to develop an approach for validating  relative values, but until it develops a timeline and a plan for determining  its approach, CMS risks continuing to use payment rates that may be  inaccurate.
section_title: Medicare Advantage and Other Medicare Health Plans
paragraphs: The MA program, an alternative to the traditional Medicare FFS program,  provides health care coverage to Medicare beneficiaries through private  health plans. The number and percentage of Medicare beneficiaries  enrolled in MA has grown steadily over the past several years, increasing  from 8.1 million (20 percent of all Medicare beneficiaries) in 2007 to 15.8  million (30 percent of all Medicare beneficiaries) in 2014. Congress has  taken a number of steps to introduce financial incentives to explicitly  reward quality and efficiency in the MA program. For example, PPACA  provided that MA plans with a quality rating of four or more stars—with  five stars indicating the highest quality—receive bonus payments, and  required MA maximum payment amounts to be adjusted to near or below  FFS spending. Moreover, in January 2013, Congress enacted the  American Taxpayer Relief Act of 2012 (ATRA), which increased the  statutory minimum for the annual MA coding intensity adjustment in order  to account for differences in the comprehensiveness with which MA plans  and FFS providers code medical diagnoses. CBO estimated that this  change alone would save Medicare about $1.4 billion over 5 years. The  recently enacted 21st Century Cures Act also includes several changes to  the MA risk adjustment model that must be implemented beginning in  2019. For example, the MA risk adjustment model will be required to take  into account the number of diseases or conditions of enrollees and allows  CMS to use 2 years of diagnosis data when determining the health  condition of beneficiaries.
CMS has yet to take action to improve the accuracy of its payments to  MA programs or to ensure that MA beneficiaries have sufficient access to  providers. We have identified additional opportunities for CMS to improve  the accuracy of MA payments, such as adjusting its methodology to  account for diagnostic coding differences between MA and FFS, and  improve CMS’s oversight of MA network adequacy.
MA plan payment adjustments. Concerns remain about the discrepancy  between FFS and MA payments because CMS has yet to improve the  accuracy of the adjustment to account for excess payments due to  differences in how MA plans and FFS providers code medical diagnoses.  We have found that CMS’s risk adjustment model—which uses one  year’s diagnoses to predict the following year’s health care costs for each  MA enrollee—has led it to overpay MA organizations because of different  diagnostic coding patterns between the FFS and MA programs. In 2013,  we estimated that these overpayments ranged from at least $3.2 billion to  $5.1 billion from 2010 through 2012. We have recommended that CMS  take steps to improve the accuracy of its risk score adjustments by, for  example, accounting for additional beneficiary characteristics such as  sex, health status, and Medicaid enrollment status, as well as including  the most recent data available. In April 2016, CMS indicated that after  analyzing MA data, the agency planned to implement the statutory  minimum for the annual MA coding adjustment mandated in ATRA.  However, as of October 2016, CMS had not provided documentation of  its analysis to determine, for example, the extent to which the agency’s  methodology accounted for additional beneficiary statistics, as we  recommended.
In addition, CMS has taken steps to collect encounter data—information  on the services and items furnished to enrollees—which are more  comprehensive than the beneficiary diagnosis data the agency currently  uses to risk adjust payments to MA organizations, and has reported that it  will use these data in calculating risk adjustments. However, CMS has not  fully developed plans for validating and using MA encounter data, missing  an opportunity to detect potentially inaccurate or unreliable data that is  being used to direct billions of federal dollars. We recommended that  CMS fully validate the MA encounter data it is collecting before using  these data for payment purposes. In 2015, CMS began using encounter  data as an additional source of diagnostic data in calculating beneficiary  risk scores but acknowledged that the agency had yet to complete all  steps to validate the data before using them for payment purposes, as we  had recommended. Without fully validating the completeness and  accuracy of MA encounter data, CMS and MA organizations would be  unable to confidently use the data for risk adjustment or any other  program management purpose.
Provider network adequacy. CMS is responsible for ensuring adequate  access to care for MA enrollees, but reports that some MA organizations  have been narrowing their provider networks raise questions about CMS  oversight of MA plans’ network adequacy. In 2015, we reported on  shortcomings in CMS’s criteria for determining network adequacy, how  the agency oversees MA organizations’ adherence to its requirements,  and how it ensures enrollees are properly notified about provider network  changes. For example, unlike other managed care programs, CMS’s  network adequacy criteria do not consider measures of provider  availability, such as appointment wait times and whether providers are  accepting new patients. CMS also assesses very few networks (less than  one percent) each year against its network adequacy criteria and does  little to evaluate the accuracy of the network data MA organizations  submit. We made several recommendations, including that CMS augment  MA network adequacy criteria to address provider availability. HHS  concurred with this recommendation, and in early 2016, officials stated  that they will review how to augment the MA network adequacy criteria to  address provider availability in future years. However, until this happens,  provider networks may appear to regulators and beneficiaries as more  robust than they actually are.
section_title: Program Design Effects on Beneficiaries, Including Those Eligible for Medicaid
paragraphs: The Medicare Trustees estimate that Medicare spending will grow at a  faster rate than workers’ earnings or the economy overall, which will  impose a significant burden on Medicare beneficiaries and the U.S.  economy over time. Because most Medicare beneficiaries pay their Part  B premium by having it withheld from their monthly Social Security  benefits, and because growth in Medicare premiums and cost sharing has  outpaced growth in Social Security benefits, beneficiaries and their  families may increasingly need to draw on other income or resources to  help pay for necessary medical care. Moving forward, it will be important  to find approaches that help avert or mitigate this growing financial  burden, particularly for those beneficiaries with high health care needs  and few economic resources. For example, understanding how  beneficiaries make medical decisions and what information would help  them identify and use providers that efficiently deliver appropriate, high- quality care could lead to savings for both beneficiaries and taxpayers.
Our work has identified additional opportunities to improve how the  Medicare program ensures that beneficiaries, including those who are  also eligible for Medicaid, receive the appropriate services they need.
Care for dual-eligible beneficiaries. The federal government, states,  and others have been focusing on care coordination as a key strategy for  improving the quality of care for dual-eligible beneficiaries—individuals  who qualify for both Medicare and Medicaid—while also reducing costs.  Dual-eligible beneficiaries, who are often in poorer health compared with  other Medicare and Medicaid beneficiaries, typically receive benefits  through each program separately, which can lead to fragmented care due  to different program rules for receiving benefits and reimbursing  providers. In 2013, CMS began implementing the Financial Alignment  Demonstration to integrate Medicare and Medicaid services and  financing, and to improve coordination for dual-eligible beneficiaries.  While CMS established a framework of monitoring activities to oversee  the demonstration, the extent of care coordination is not entirely clear  from the information being collected. For example, CMS monitors two  core measures related to care coordination, but because these are being  used in only one of two models being tested in the demonstration, CMS  cannot compare the two demonstration models using these measures.  Similarly, demonstration states had state-specific measures that explored  aspects of care coordination, but they were not comparable across states.  We recommended, among other things, that CMS align existing state- specific measures of the extent to which individualized care plans are  being developed to make them comparable. The agency agreed with  this recommendation, and CMS officials said they plan to develop a care plan measure that more closely aligns specifications across  demonstrations, but data collection is not expected to begin until January  2018.
Dual-eligible special needs plans. Special needs plans are MA private  plans designed to address the unique needs of certain Medicare  populations, and among these plans are those targeted specifically to  dual-eligible beneficiaries. CMS and Congress have taken steps to  coordinate care for those enrolled in dual-eligible special needs plans to  increase benefit integration and care coordination. For example, PPACA  established a type of plan referred to as a fully integrated dual-eligible  special needs plan, which is designed to integrate program benefits for  dual-eligible beneficiaries through a single managed care organization. In  addition, dual-eligible special needs plans that meet certain performance  and quality-based standards may seek CMS approval to offer benefits  beyond what other MA plans offer if such benefits would help bridge the  gap between Medicare- and Medicaid-covered services. Although a large  percentage of dual-eligible beneficiaries (43 percent in 2012) were under  age 65 and qualified for Medicare because they were disabled, we found  that few fully integrated dual-eligible special needs plans serve disabled  dual-eligible beneficiaries or report lower costs for Medicare services. In  addition, moderately better health outcomes for disabled dual-eligible  beneficiaries in dual-eligible special needs plans do not necessarily  translate into lower levels of costly Medicare services—that is, inpatient  stays, readmissions, and emergency room visits.
Access to preventive services. Over the past several years,  researchers have found that certain preventive services are effective in  early diagnosis or reduced prevalence of diseases that contribute to the  growth in Medicare spending. To encourage beneficiary use, PPACA  removed beneficiary cost-sharing requirements for many Medicare- covered preventive services, such as mammograms and colorectal  cancer screening. However, in our work we found that while Medicare  beneficiaries’ use of some preventive services—cardiovascular disease  screening and cervical cancer screening—generally aligned with clinical  recommendations, the use of other preventive services, such as  osteoporosis screening and immunizations, did not. Medicare  beneficiaries who did not receive certain preventive services commonly  reported that they had limited information on prevention; had concerns  about discomfort, side effects, or efficacy; or their doctor did not  recommend the services. Furthermore, we found better use of preventive  services by beneficiaries is unlikely without appropriate Medicare  coverage. For instance, low use of some recommended services—such  as osteoporosis screenings—may result, in part, from limiting which  beneficiaries are covered or how frequently the service is covered.  Conversely, the absence of required cost sharing for certain services that  are not recommended, such as prostate-specific antigen testing for  prostate cancer for men aged 75 or older, may contribute to the  inappropriate use of those services. In 2012, we suggested Congress  require beneficiaries to share the cost when they receive services that the  U.S. Preventive Services Task Force recommends against.
section_title: Program Management
paragraphs: CMS has overcome some challenges in managing the Medicare program  as it implemented some program improvements in recent years, including  a competitive bidding program for durable medical equipment (DME).  However, more could be done to improve how CMS manages the  Medicare program, including its handling of the growing number of  appeals for denied claims.
Competitive bidding program. We had previously reported that  Medicare sometimes overpaid for DME items relative to other payers.  Congress required that CMS implement a competitive bidding program for  DME suppliers, which the agency began in 2009. In early assessments,  we found that beneficiary access and satisfaction appeared stable and  the competitive bidding program has led to savings. More recently in  2016, we found that the number of beneficiaries receiving DME items  covered under the competitive bidding program generally decreased after  implementation of phases of the program that began in July 1, 2013.  Available evidence from CMS’s monitoring efforts indicates no  widespread effects on beneficiary access, but some beneficiary advocacy  groups have reported specific access issues, such as difficulty locating  contract suppliers and delays in delivery of DME items. Changes such as  expanding the program into additional competitive bidding areas; using  pricing from competitive bidding areas to set prices in non-competitive  bidding areas (which was fully phased in as of July 2016); and selecting  new contract suppliers for contracts for new rounds of bidding will provide  significant new data to further assess the effect of the program.  Continued monitoring of the competitive bidding program experience is  important to determine the full effects it may have on Medicare  beneficiaries and DME suppliers.
Appeals process. Medicare has seen significant growth in the number of  appeals submitted by providers, beneficiaries, and others dissatisfied with  the program’s decisions to deny or reduce payment for claims. The  Department of Health and Human Services (HHS) attributes the increase  in appeals to several factors, including for example, CMS’s recent  increased focus on program integrity activities, which has resulted in  more denied claims and more appeals. In fiscal year 2014, Medicare  denied 128 million FFS claims, or 10.5 percent of claims submitted.  Medicare’s administrative appeals process for FFS claims consists of 4  levels of review (Levels 1 through 4) and allows appellants who are  dissatisfied with decisions at one level to appeal to the next level, with  separate appeals bodies making decisions at each level. From fiscal year  2010 to 2014, the number of appeals at all levels of Medicare’s  administrative appeals process increased significantly but varied by level.  The largest rate of increase (over 900 percent) was experienced at Level  3, in which cases are reviewed by administrative law judges. The large  volume of appeals has resulted in backlogs in decisions; in fiscal year  2014, more than 90 percent of Level 3 decisions were issued after the 90- day statutory time frame.
We recommended that HHS take additional steps to improve its oversight  of the appeals process, including collecting more complete and consistent  data that would assist in monitoring efforts and addressing inefficiencies  in the way certain repetitious claims—such as those for monthly oxygen equipment rentals—are adjudicated. HHS has taken some actions to  reduce the backlog of appeals. For instance, CMS has offered  administrative agreements to eligible hospitals that are willing to withdraw  their pending appeals in exchange for timely partial payments, in order to  more quickly reduce the volume of claims pending in the appeals  process. As of August 2016, CMS has executed settlements amounting to  nearly $1.5 billion with 2,022 hospitals, representing approximately  346,000 claims that were in the appeals system. In September 2016,  CMS announced it would execute another round of settlements for  hospitals with inpatient claims in appeals. In addition, in July 2016, HHS  issued a proposed rule that would revise certain appellate procedures in  an effort to improve the Medicare appeals process and reduce the  backlog. However, HHS has not yet taken actions to address our specific  recommendations, and the backlog shows no signs of abating, as the  number of incoming appeals continues to surpass adjudication capacity at  certain review levels. For fiscal year 2016, the average length of time to  process Level 3 appeals was 877 days, compared with the 90 days  generally required by statute, and up from the 662 days for fiscal year  2015.
section_title: Oversight of Patient Care and Safety
paragraphs: CMS has made progress in improving the health and safety of millions of  Medicare beneficiaries, which represent a significant portion of the U.S.  population. According to CMS, Medicare Quality Improvement  Organizations—which work with providers, beneficiaries, and others to  improve health care delivery systems to achieve better care for lower  costs—-supported efforts that from fiscal year 2011 through fiscal year  2014 helped to prevent tens of thousands of beneficiaries from being  admitted or readmitted to hospitals; reduce the number of health care  associated infections; and reduce the number of nursing home patients  who experienced pressure ulcers or the use of restraints. CMS has also  improved its oversight of quality of care. In 2012, in response to our  recommendation, CMS included long-term care hospitals in its validation  surveys, which are used to measure the effectiveness of surveys  conducted by accrediting organizations on the extent to which facilities meet federal standards for quality of care. However, CMS can further  improve how it oversees patient care and safety, as described below.
Clinical data registries. Clinical data registries (CDR) have the potential  to improve the quality and efficiency of care for all Medicare beneficiaries  by collecting extensive, standardized data and providing feedback to  physicians on their performance based on their peers. CDRs are entities  that collect detailed information on the therapies that patients receive and  changes in their clinical condition over time in order to evaluate and  improve care practices and outcomes. In 2013, we recommended that  HHS adopt several key requirements to ensure qualified CDRs actually  improve the quality and efficiency of care that beneficiaries receive. For  example, CMS should require qualified CDRs to demonstrate  improvements on key measures of quality and efficiency for their target  population and establish a process for monitoring qualified CDRs’  compliance with requirements. HHS should also enhance the effect of  qualified CDRs on quality and efficiency by making it easier to develop  them by promoting the use of health information technology. HHS  concurred with each of our recommendations, but also noted some  challenges it expects, for example in establishing a set of core measures  for qualified CDRs, as we recommended, given the number of clinical  specialties on which qualified CDRs may focus. We maintain, however,  that a minimum set of core measures—even if small—could help CDRs  promote national-level quality improvement initiatives.
End-stage renal disease. In 2013, Medicare spent about $11.7 billion on  dialysis care for about 376,000 Medicare patients. Dialysis is the most  common treatment for individuals with end-stage renal disease, and while  the vast majority of dialysis treatments are performed in dialysis facilities,  dialysis treatments received at home may increase autonomy and health- related quality of life for some patients. Physicians and other stakeholders  estimate that between 15 and 25 percent of patients needing dialysis  could realistically be on home dialysis. In 2012, about 11 percent of  patients needing dialysis received home dialysis.
A number of factors can affect the type of dialysis patients receive,  including patients’ preference and clinical factors, but Medicare payment  policy may also play a role. In 2015, we found that dialysis facilities have  financial incentives in the short term to increase dialysis treatments  provided in facilities. Medicare’s monthly payments to physicians for  managing the care of home patients are often lower than those for  managing in-center patients, which may also discourage physicians from  prescribing home dialysis. Further, just a small fraction of Medicare  patients have used the Kidney Disease Education benefit—which  provides pre-dialysis education and is designed to help patients make  informed decisions related to their treatment. Limited use of this benefit  may be due to statutory limitations on the types of providers who are  permitted to furnish the benefit and on the patients eligible to receive it.  We recommended that CMS examine and, if necessary, revise policies  for paying physicians to manage the care of dialysis patients, and  examine the Kidney Disease Education benefit, and if appropriate, seek  legislation to revise the categories of providers and patients eligible for  the benefit. HHS concurred with the first recommendation but did not  agree with the second, stating that CMS must prioritize its activities to  improve care for dialysis patients. We maintain the importance of  ensuring that Medicare patients with chronic kidney disease understand  their condition and the implications of various treatment options; however,  the limited use of the Kidney Disease Education benefit suggests it may  be difficult for patients to receive this education.
section_title: What Remains to Be Done
paragraphs: Congress, HHS, and CMS have taken steps to improve the fiscal integrity  of Medicare, and CMS has implemented some of our recommendations,  such as providing more frequent feedback to physicians so they can  identify opportunities to reduce costs and rebasing payments for end- stage renal disease services using more recent data, which resulted in  per treatment payment reductions. However, continued federal  improvements to the oversight of Medicare are warranted given the size  and complexity of the program as well as the number and scope of  ongoing changes to the program.
We have a number of Matters for Congressional Consideration for  addressing Medicare payments, costs, and quality of care. Specifically:
To increase beneficiaries’ awareness of providers’ financial interest in  a particular treatment, Congress should consider directing the  Secretary of Health and Human Services to require providers who  self-refer intensity-modulated radiation therapy services—a type of  cancer treatment—to disclose to their patients that they have a  financial interest in the service.
To further align Medicare beneficiary use of preventive services with  U.S. Preventive Task Force recommendations, Congress should  consider requiring beneficiaries who receive services that the Task  Force recommends against to share the cost, notwithstanding that  cost sharing may not be required for beneficiaries with different  characteristics or under different circumstances.
To help HHS better control spending and encourage efficient delivery  of care, Congress should consider requiring Medicare to pay PPS- exempt cancer hospitals as it pays PPS teaching hospitals, or provide  the Secretary with the authority to otherwise modify how Medicare  pays these providers. To generate cost savings from any reduction in  outpatient payments to PPS-exempt cancer hospitals, Congress  should also provide that all forgone outpatient payment adjustment  amounts be returned to the Supplementary Medical Insurance Trust  Fund.
In order to prevent the shift of services from physician offices to  hospital outpatient departments from increasing costs for the  Medicare program and beneficiaries, Congress should consider  directing the Secretary of Health and Human Services to equalize  payment rates between the settings for evaluation and management  office visits—and other services that the Secretary deems  appropriate—and to return the associated savings to the Medicare  program.
To help HHS ensure accuracy in Part B drug payment rates,  Congress should consider requiring all manufacturers of Part B drugs  paid at ASP, not only those with Medicaid drug rebate agreements, to  submit sales price data to CMS, and ensure that CMS has authority to  request source documentation to periodically validate all such data.
To determine the suitability of Medicare’s Part B drug payment rate  methodology for drugs with coupon programs, Congress should  consider (1) granting CMS the authority to collect data from drug  manufacturers on coupon discounts for Part B drugs paid based on  ASP, and (2) requiring the agency to periodically collect these data  and report on the implications that coupon programs may have for this  methodology.
In addition, we have made a range of recommendations to HHS and CMS  intended to improve program management and control costs that remain  open, including the following:
To ensure that MA encounter data are of sufficient quality for their  intended purposes, the Administrator of CMS should (1) establish  specific plans and time frames for using the data for all intended  purposes in addition to risk adjusting payments to MA organizations;  and (2) complete all the steps necessary to validate the data,  including performing statistical analyses, reviewing medical records,  and providing MA organizations with summary reports on CMS’s  findings, before using the data to risk adjust payments or for other  intended purposes.
To ensure that future low-volume payment adjustments (LVPA) are  made only to eligible facilities and to rectify past overpayments, the  Administrator of CMS should (1) require Medicare contractors to  promptly recoup 2011 LVPA payments that were made in error, (2)  improve the timeliness and efficacy of CMS’s monitoring regarding the  extent to which Medicare contractors determine LVPA eligibility  correctly and promptly redetermine eligibility when all necessary data  become available, and (3) investigate errors that contributed to  facilities not consistently receiving the 2011 LVPA and ensure that  such errors are corrected. Additionally, to reduce the incentive for  facilities to restrict the services they provide to avoid reaching the  LVPA treatment threshold, the Administrator of CMS should consider  revisions such as changing the LVPA to a tiered adjustment.
In order to improve CMS’s ability to identify self-referred advanced  imaging services and help CMS address the increases in these  services, the Administrator of CMS should (1) insert a self-referral flag  on its Medicare Part B claims form and require providers to indicate  whether the advanced imaging services for which provider bills  Medicare are self-referred or not; (2) reduce payments for self- referred advanced imaging services to recognize efficiencies when  the same provider refers and performs a service; and (3) determine  and implement an approach to ensure the appropriateness of  advanced imaging services referred by self-referring providers.
To increase dual-eligible special needs plans’ accountability and  ensure that CMS has the information it needs to determine whether  dual-eligible special needs plans are providing the services needed by  dual-eligible beneficiaries, especially those who are most vulnerable,  the Administrator of CMS should evaluate the extent to which dual- eligible special needs plans have provided sufficient and appropriate  care to the population they serve, and report the results in a timely  manner.
To help ensure appropriate payments to MA plans, the Administrator  of CMS should take steps to improve the accuracy of the adjustment  made for differences in diagnostic coding practices between MA and  Medicare FFS. Such steps could include, for example, accounting for  additional beneficiary characteristics, including the most current data  available, identifying and accounting for all years of coding differences  that could affect the payment year for which an adjustment is made;  and incorporating the trend of the impact of coding differences on risk  scores.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact James  Cosgrove at (202) 512-7114 or cosgrovej@gao.gov, or Kathleen King at  (202) 512-7114 or kingk@gao.gov.
section_title: Related GAO Products
paragraphs: Medicare: CMS’s Round 2 Durable Medical Equipment and National Mail- Order Diabetes Testing Supplies Competitive Bidding Programs.  GAO-16-570. Washington, D.C.: September 15, 2016.
Medicare Part B: Data on Coupon Discounts Needed to Evaluate  Methodology for Setting Drug Payment Rates. GAO-16-643. Washington,  D.C.: July 27, 2016.
Medicare Part B: CMS Should Take Additional Steps to Verify Accuracy  of Data Used to Set Payment Rates for Drugs. GAO-16-594. Washington,  D.C.: July 1, 2016.
Hospital Uncompensated Care: Federal Action Needed to Better Align  Payments with Costs. GAO-16-568. Washington, D.C.: June 30, 2016.
Medicare Fee-For-Service: Opportunities Remain to Improve Appeals  Process. GAO-16-366. Washington, D.C.: May 10, 2016.
Medicare Advantage: Action Needed to Ensure Appropriate Payments for  Veterans and Nonveterans. GAO-16-137. Washington, D.C.: April 11,  2016.
Medicare: Increasing Hospital-Physician Consolidation Highlights Need  for Payment Reform. GAO-16-189. Washington, D.C.: December 18,  2015.
Medicare and Medicaid: Additional Oversight Needed of CMS’s  Demonstration to Coordinate the Care of Dual-Eligible Beneficiaries.  GAO-16-31. Washington, D.C.: December 18, 2015.
Medicare Part B: Expenditures for New Drugs Concentrated among a  Few Drugs; and Most Were Costly for Beneficiaries. GAO-16-12.  Washington, D.C.: October 23, 2015.
End-Stage Renal Disease: Medicare Payment Refinements Could  Promote Increased Use of Home Dialysis. GAO-16-125. Washington,  D.C.: October 15, 2015.
Medicare Advantage: Actions Needed to Enhance CMS Oversight of  Provider Network Adequacy. GAO-15-710. Washington, D.C.: August 31,  2015.
Medicare Physician Payment Rates: Better Data and Greater  Transparency Could Improve Accuracy. GAO-15-434. Washington, D.C.:  May 21, 2015.
Medicare: Payment Methods for Certain Cancer Hospitals Should Be  Revised to Promote Efficiency. GAO-15-199. Washington, D.C.: February  20, 2015.
Medicare: Bidding Results from CMS’s Durable Medical Equipment  Competitive Bidding Program. GAO-15-63. Washington, D.C.: November  7, 2014.
section_title: Medicare Improper Payments
subsections: section_title: Why Area Is High Risk
paragraphs: We designated Medicare as one of the original high-risk programs in  1990 due to its size, complexity, and susceptibility to mismanagement  and improper payments. In 2016, Medicare was projected to finance  health services for more than 57 million elderly and disabled beneficiaries  at a cost of $696 billion, and account for approximately 17.8 percent of  federal spending. Improper payments—payments that are either made in  an incorrect amount or should not be made at all—are a significant risk  for Medicare and reached an estimated $60 billion in fiscal year 2016.  The Centers for Medicare & Medicaid Services (CMS), which administers  Medicare for the Department of Health and Human Services (HHS), is  responsible for overseeing the program and safeguarding it from loss.  While Medicare, the largest federal health program, remains inherently  complex and susceptible to improper payments, CMS can continue to  take actions to prevent and reduce improper payments in the program.  This high-risk rating and assessment focuses on CMS’s efforts to reduce  Medicare improper payments. We discuss the broader challenges and  risks associated with the Medicare program separately.
section_title: What GAO Found
paragraphs: CMS has continued to demonstrate leadership commitment to preventing  and reducing Medicare improper payments, but consistently high  improper payment rates and unimplemented improvement opportunities  have resulted in the agency partially meeting the four remaining criteria  for removal from our High-Risk List—capacity, action plan, monitoring,  and demonstrated progress. Since our last high-risk update, agency  leadership took action to prevent improper payments by strengthening  certain provider enrollment and prepayment controls, as we  recommended. CMS also implemented our recommendation to improve  oversight of contractors that carry out postpayment reviews, such as the  Medicare Administrative Contractors (MAC) and Recovery Auditors (RA).  The agency also took certain program integrity actions authorized by the  Patient Protection and Affordable Care Act (PPACA) and the Medicare  Access and CHIP Reauthorization Act of 2015 (MACRA). However,  despite these efforts, Medicare improper payment rates remained high in  2016. According to HHS’s Agency Financial Report for 2016, although  reported improper payments decreased for Medicare fee-for-service  (FFS) from 12.1 percent in fiscal year 2015 to 11.0 percent in fiscal year  2016, this rate remained above the statutorily defined compliance  threshold of 10 percent. In addition, the improper payment rates  increased for Medicare Part C (9.5 percent in fiscal year 2015 to 10.0  percent in fiscal year 2016) and improved somewhat for Part D (3.6  percent in fiscal year 2015 to 3.4 percent in fiscal year 2016). These  rates suggest that additional actions are needed to reduce improper  payments in the Medicare program. By implementing our open  recommendations, CMS will be able to reduce improper payments and  progress toward fulfilling the outstanding criteria to remove Medicare  improper payments from our High-Risk List.
Congress has also taken actions aimed at helping CMS address this  high-risk issue. For example, Congress passed and the President signed  into law MACRA in April 2015, which included several provisions aimed at  improving Medicare program integrity, such as requiring and providing  funding for CMS to remove beneficiaries’ Social Security numbers (SSN)  from Medicare cards, requiring MACs to have improper payments  outreach and education programs, and modifying surety bond conditions  of participation for home health agencies. Congress has also continued to  appropriate discretionary funding for CMS to take action to reduce  improper payments. In addition, the House and Senate have held more  than 20 hearings in the last 4 fiscal years to identify additional program  integrity improvements, including 7 hearings since our 2015 high-risk  report.
section_title: What Remains to Be Done
paragraphs: Improper payments in all parts of Medicare remain unacceptably high. As  Medicare program spending and enrollment are projected to continue to  grow under current law, sustained effort will be needed to ensure program  integrity and reduce improper payments. If CMS were to effectively  implement our numerous recommendations, it could improve program  management, make fewer improper payments, and recover more of those  it makes. For example, to improve the effectiveness of efforts to reduce  and recover improper payments in Part C, CMS should improve the  processes for selecting contracts to include in its risk adjustment data  validation (RADV) audits—audits of Medicare Advantage (MA)  organizations that help CMS recover improper payments in cases where  beneficiary diagnoses are unsupported by medical records. We also  recommend that CMS enhance the timeliness of these audits and  incorporate recovery audit contractors (RAC) into the RADV audit. CMS  should also revise its guidance for verifying provider practice locations so  that MACs conduct additional research on questionable practice location  addresses to help improve Medicare provider and supplier enrollment- screening procedures.
Moreover, CMS should fully implement the following priority  recommendations and available procedures authorized by PPACA and  MACRA to improve the Medicare improper payment rate and remove this  area from our High-Risk List:  set clear expectations in contract work statements for Part D RAC,  conduct annual RAC performance evaluations, and review the  process for developing new audit issues to improve the agency’s Part  D RAC program operations and contractor oversight;  seek legislative authority to allow the RAs—which typically conduct  postpayment reviews—to conduct prepayment claim reviews for  Medicare FFS as another means of preventing improper payments  before they occur; provide guidance to MACs on how to accurately calculate and report  savings from prepayment claim reviews to ensure that CMS has the  information it needs to evaluate MAC effectiveness in preventing  improper payments and evaluate and compare MACs’ performance to  that of other contractors; monitor the database used to track Medicare FFS recovery audit  activities to ensure that all postpayment review contractors submit  required data and that the data contained in the database are  accurate and complete;  clarify and standardize as much as possible the requirements for the  contents of postpayment claims review contractors’ correspondence  with providers and assess regularly whether contractors are  complying with content requirements to improve the efficiency of  postpayment claims reviews and simplify compliance for providers;  and  require surety bonds for certain types of at-risk providers and  suppliers as authorized by PPACA and MACRA.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: CMS continues to meet our criterion for leadership commitment to  reducing Medicare improper payments. Improper payment reduction  remains a strategic priority for HHS, and CMS leadership has taken  multiple actions that demonstrate its commitment to reducing such  payments in the Medicare program, including implementing several of our  recommendations. For example, CMS leadership indicated that the  agency took steps since our last high-risk update to co-locate all offices  whose primary mission is ensuring the integrity of Medicare FFS claims  payments, which it believes will improve efficiency for dealing with  program integrity issues. CMS also implemented some of our 2012 and  2013 recommendations to improve postpayment reviews and prepayment  control efforts. For example, CMS uses several contractors to conduct  postpayment reviews for improper payments and the agency has made  changes to standardize contractor requirements as we highlighted as a  priority recommendation in the 2015 high-risk update. By aligning these  contractor requirements, CMS will likely improve the efficiency and  effectiveness of its Medicare program integrity efforts by strengthening  the control environment, lessening providers’ confusion, and reducing  administrative burdens.
In response to our priority recommendations, CMS also began  disseminating information about certain contractors’ most successful  prepayment edits—controls preprogrammed into payment processing  systems—and requested that these contractors share information about  their top edits, thereby ensuring more widespread use of effective  prepayment controls. In 2015, we also recommended changes to  improve CMS’s enrollment screening procedures for Medicare providers  and suppliers, and CMS has implemented several updates to its provider  enrollment database that will address identified weaknesses.
section_title: Capacity
paragraphs: CMS partially met our criterion that it have the capacity to reduce  improper payments in the Medicare program. The Medicare integrity  program—along with other activities to detect, prevent, and combat  factors that contribute to improper payments—is funded through the  Health Care Fraud and Abuse Control (HCFAC) program, which has  reported returns on investment of $6.10 for every $1 spent from fiscal  year 2013 through 2015. In fiscal year 2016, Congress provided more  discretionary HCFAC funding than in any prior year. These funds helped  CMS implement planned initiatives to protect Medicare dollars. While  CMS received increased discretionary funding since 2015, the budgetary  environment remains uncertain, as demonstrated by the 6 percent decline  in discretionary Medicare integrity funding from fiscal year 2011 to 2014.  Given funding uncertainty and projected spending increases, it is even  more important for CMS to prioritize its most effective program integrity  initiatives and to maximize the effect of those initiatives already underway  by implementing our recommendations.
section_title: Action Plan
paragraphs: CMS has partially met our action plan criterion. While CMS identifies and  reports progress on corrective actions related to Medicare improper  payments in HHS’s annual Agency Financial Report, the agency has not  implemented all of the recommendations we made that could reduce  improper payments nor fully developed an action plan for addressing our  high-risk area. HHS’s Agency Financial Report for 2016 identified  insufficient documentation and medical necessity errors as root causes of  improper payments for Medicare FFS, and insufficient documentation and  administrative errors as root causes of improper payments for both Parts  C and D. The report also identified actions that CMS has taken or is  taking to address these causes. For example:
CMS took action to revalidate existing Medicare providers and  suppliers, as required by PPACA. The provider and supplier  revalidation is in the second round of a multiyear process to improve  enrollment screening that we reported on in 2016.  Specifically, we  reported that CMS’s revised enrollment screening process resulted in  over 703,000 existing enrollment records being deactivated or  revoked but that CMS needed to establish performance measures to  assess the revised process.
CMS took several corrective actions to address improper payment  rates for home health claims, which have historically had improper  payment rates over 50 percent. For example, CMS took action to  clarify face-to-face requirements for home health providers and  implemented prepayment claims reviews in 2015 to help educate  home health providers. The improper payment rate for home health  claims decreased from 59.0 percent in fiscal year 2015 to 42.0  percent in fiscal year 2016.
CMS also expanded the use of prior authorization to prevent improper  payments for various suppliers. For example, CMS published a final  rule in December 2015 that established a Master List of Durable  Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS)  items that providers frequently bill to Medicare when recipients don’t  need them. The rule, which took effect on February 29, 2016, requires  prior authorization for certain DMEPOS items on the Master List,  which CMS believes will reduce or prevent questionable billing  practices and improper payments for these items. In December 2016,  CMS announced that it would begin implementing prior authorization  for two types of power wheelchairs not previously covered in a  demonstration beginning in March 2016.
Despite these efforts, we have found problems with some of the proposed  corrective actions. For Part C improper payments, HHS’s 2015 and 2016  Agency Financial Reports identified RADV audits as a primary corrective  action. These audits of MA organizations—to which Medicare pays a risk- adjusted monthly amount for each enrolled beneficiary—help CMS  recover improper payments from such organizations if they requested  CMS to adjust payments based on beneficiary diagnoses unsupported by  medical records. However, in April 2016, we reported significant problems  with the methods used to select MA contracts for RADV audits and the  time it took to complete the audits. For example, using current methods,  CMS is unable to select contracts for audit that have the greatest  potential for recovering improper payments. These issues limit CMS’s  ability to recover the billions of dollars in MA improper payments that  occur each year.
In addition, CMS has yet to address some problems including those  where we have recommended changes. For example, in 2016, we  recommended that CMS seek legislative authority to allow RAs to review  Medicare FFS claims before they are paid as another means to prevent  improper payments before they occur. Although CMS and RA officials told  us that a demonstration of RA prepayment reviews was considered  successful, the agency disagreed with our recommendation to seek  authority to extend this ability and told us that other claim review  contractors conduct prepayment reviews and that CMS has implemented  other programs as part of its strategy to move away from the “pay and  chase” process of recovering overpayments. We continue to believe that  prepayment reviews better protect agency funds compared to  postpayment reviews, and that seeking the authority to allow RAs to  conduct prepayment reviews is consistent with CMS’s strategy to pay  claims properly the first time. In not seeking the authority, CMS may be  missing an opportunity to reduce the amount of uncollectable  overpayments from RA reviews and save administrative resources  associated with recovering overpayments. Finally, CMS officials have  indicated that the agency is developing an action plan to address our  identified high-risk areas, but as of January 2017, the plan was not yet  complete.
section_title: Monitoring
paragraphs: CMS has taken steps to monitor the effectiveness of its corrective  measures, but only partially met our monitoring criterion due to data and  oversight challenges. For example, in response to our 2011  recommendation, CMS implemented changes to the data systems its  contractors use to track spending on Medicare integrity efforts, thereby  improving the agency’s ability to assess the effectiveness of these  activities. However, other weaknesses limit CMS’s ability to monitor  activities of the contractors that review Medicare claims before and after  payment. In 2016, we reported that CMS does not have reliable data on  savings from prepayment claims reviews to evaluate MACs’ performance  in preventing improper payments or to compare performance across  contractors. In response to our report, CMS is developing  methodologies to estimate amounts CMS would have paid providers had  claim denials based on prepayment review not occurred. Until CMS  completes these activities and calculates and reports savings from  prepayment reviews, this remains a priority recommendation.
In 2016, we also found that, although CMS has improved its provider and  supplier enrollment screening process, it lacked objectives for monitoring  this screening process and performance measures to assess progress  toward achieving its goals for revalidating enrollment information.  Finally, in 2015, we reported that CMS did not adequately set  expectations for the RAC hired to oversee Part D payments, did not  conduct timely performance evaluations, and did not have a good process  for approving audit work. As a result of these management weaknesses,  CMS collected fewer than $10 million in Part D improper payments as of  May 2015. Given that Part D improper payments increased from $2.2  billion to $2.4 billion from fiscal year 2015 to 2016, CMS will need to  address these issues when it solicits the next Part D RAC contracts.
section_title: Demonstrated Progress
paragraphs: CMS has demonstrated some progress, including a decrease in the  Medicare FFS and Part D improper payment rates in fiscal year 2016, but  the size of the program and persistently high improper payment rates for  some parts of Medicare indicate further progress is needed. As noted,  CMS has taken various actions to improve Medicare program integrity,  such as updating eligibility enrollment software, revalidating existing providers and suppliers, and reducing differences in contractor  postpayment review requirements; however, it has yet to be determined  how many of these changes will affect CMS’s long-term ability to prevent  and collect improper payments. In addition, Congress enacted MACRA,  which, among other things, required and provided funding for CMS to  remove beneficiaries’ SSNs from Medicare cards and develop a new,  unique identifier—which we also recommended in 2012 and have  highlighted as a priority recommendation. In 2016, CMS reported that it  had begun the process of removing SSNs from Medicare cards and will  begin replacing them with randomly generated Medicare Beneficiary  Identifiers in 2018; however, such changes will not be fully implemented  until 2019. CMS has indicated that certain other corrective actions—like  expanding the use of prior authorization—have successfully reduced  improper payments in several demonstration projects and provider  education initiatives, and as a result, the agency is in the process of  expanding such efforts. Moreover, CMS has yet to implement certain  PPACA-authorized actions as we encouraged the agency to do in our  2015 high-risk report. For example, PPACA authorized CMS to impose  surety bonds on certain at-risk providers to strengthen provider  enrollment protections. MACRA also included a provision to require  surety bonds for all home health agencies as a condition of Medicare  participation. CMS has stated that the agency is working to implement  this requirement, but, as of December 2016, CMS had not issued rules to  do so. Continued progress in these and other efforts is needed, as  Medicare FFS, Part C, and Part D all remained on the Office of  Management and Budget’s list of high-error programs in 2015. Sustained  control over payments and program integrity management is needed  before Medicare improper payments can fully meet our criterion for  demonstrated progress.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: Our body of work on improper payments has raised the level of  attention to this issue, including Medicare improper payments, and  contributed to the passage of the Improper Payments Information Act  of 2002 (IPIA) and subsequent improper payment legislation. These  laws require, among other things, agencies to estimate their annual  amount of improper payments and report on actions to reduce them.  In part from our continued oversight of CMS’s efforts to meet the  requirement of IPIA, both Medicare Part C and Part D have reduced  overpayment rates, a component of the total program improper  payment rate, since each program began reporting improper  payments in 2009 and 2011, respectively. Specifically, we determined  that Medicare Part C had cost savings associated with overpayment  error rate reductions of $1.2 billion in fiscal year 2010, $5.1 billion in  fiscal year 2011, $6.2 billion in fiscal year 2013, and $8.9 billion in  fiscal year 2014. Part D had cost reduction of $209.8 million in fiscal  year 2014 and $51.1 million in fiscal year 2015.
In 2012, we reported that CMS had not integrated its predictive  analytics system, known as the Fraud Prevention System (FPS), with  its claims processing and payment systems to allow for the automated  prevention of potentially fraudulent Medicare claims payments. We  recommended that the agency develop schedules for completing  integration of these systems. In response, CMS implemented  capabilities which allowed FPS to stop payment of certain improper  and non-payable claims including a total of $26.2 million of cost  savings in 2014 and 2015.
In 2012, we made several recommendations to CMS to promote  greater use of effective prepayment edits and better ensure proper  payment, to promote implementation of effective edits based on  national policies, and to encourage more widespread use of effective  local edits by MACs. In response to these recommendations, CMS  began disseminating information about certain contractors’ most  successful prepayment edits—controls preprogrammed into payment  processing systems—requested that these contractors share their top  edits, and made improvements to certain edits that identify services  billed in medically unlikely amounts. The agency also revised its  standard operating procedures to ensure consideration of automated  edits for all new and existing national coverage determinations— which describe the circumstances under which Medicare will cover  services nationwide—as we recommended. These changes help CMS  ensure Medicare payments are made properly the first time.
Beginning in 2013, CMS took several actions to improve its process  for addressing RAC-identified vulnerabilities that led to improper  payments as we recommended in 2010. For example, the agency  created a protocol to determine the effectiveness of certain corrective  actions and established regular meetings to discuss RAC issues. By  taking these steps, CMS established monitoring and control activities  to ensure that corrective actions are taken that help meet the overall  goal of reducing improper payments in the Medicare program.
In response to our 2011 recommendation, CMS implemented  changes in 2014 to the data systems MACs use to track spending on  Medicare integrity efforts, thereby improving the accuracy of spending  estimates. These changes improve the agency’s ability to assess  the effectiveness of their Medicare integrity activities.
In 2015, we reported weaknesses in the screening procedures CMS  uses to prevent and detect ineligible or potentially fraudulent providers  and suppliers from enrolling in the Medicare Provider Enrollment,  Chain and Ownership System (PECOS). Specifically, we found that  the computer software CMS uses to validate applicants’ addresses  does not flag potentially ineligible addresses. In addition, we found  that CMS’s process for verifying providers’ licenses did not always  identify providers’ adverse actions when enrolling, revalidating, or  reviewing provider’s licenses unless the provider self-reported the  action. In response to recommendations we made to address these  issues, CMS updated its address verification software and  incorporated information from the Federation of State Medical Boards  into its automatic screening process thereby improving the integrity of  Medicare provider enrollment.
In 2012 and 2013, we made recommendations to CMS to remove  beneficiary SSNs from the Medicare insurance card in order to protect  beneficiaries from identity theft. In response to our  recommendations and in accordance with MACRA, CMS initiated a  project in 2016 to replace beneficiary SSNs with a non SSN-derived  Medicare Beneficiary Number. Removing SSNs from Medicare cards  better protects Medicare beneficiaries from identity theft and provides  CMS with a useful tool in combatting Medicare fraud and medical  identity theft.
In 2011, we identified instances of questionable access to prescription  drugs in the Part D program and made a recommendation to CMS to  improve its efforts to curb overutilization in Part D. In response to  our recommendation, CMS conducted a case management pilot in  2012 to improve retrospective drug utilization program controls,  developed a drug utilization review methodology to target Part D  beneficiaries who are at risk due to high use of opioids, and  implemented an overutilization monitoring system to ensure Part D  sponsors are implementing effective controls against opioid  overutilization. By implementing these changes, CMS has taken an  important step toward insuring the safety of Medicare beneficiaries  and reducing the abusive practice of doctor shopping for prescription  drugs.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Kathleen King  at (202) 512-7114 or kingk@gao.gov.
section_title: Related GAO Products
paragraphs: Medicare: Initial Results of Revised Process to Screen Providers and  Suppliers, and Need for Objectives and Performance Measures.  GAO-17-42. Washington, D.C.: November 15, 2016.
Skilled Nursing Facilities: CMS Should Improve Accessibility and  Reliability of Expenditure Data. GAO-16-700. Washington, D.C.:  September 7, 2016.
Medicare Fee-For-Service: Opportunities Remain to Improve Appeals  Process. GAO-16-366. Washington, D.C.: May 10, 2016.
Medicare: Claim Review Programs Could Be Improved with Additional  Prepayment Reviews and Better Data. GAO-16-394. Washington, D.C.:  April 13, 2016.
Medicare Advantage: Fundamental Improvements Needed in CMS’s  Effort to Recover Substantial Amounts of Improper Payments.  GAO-16-76. Washington, D.C.: April 8, 2016.
Health Care Fraud: Information on Most Common Schemes and the  Likely Effect of Smart Cards. GAO-16-216. Washington, D.C.: January  22, 2016.
Medicare Part D: Changes Needed to Improve CMS’s Recovery Audit  Program Operations and Contractor Oversight. GAO-15-633.  Washington, D.C.: August 14, 2015.
Medicare Program: Additional Actions Needed to Improve Eligibility  Verification of Providers and Suppliers. GAO-15-448. Washington, D.C.:  June 25, 2015.
Medicare: Potential Uses of Electronically Readable Cards for  Beneficiaries and Providers. GAO-15-319. Washington, D.C.: March 25,  2015.
section_title: Medicaid Program
subsections: section_title: Current State of the Medicaid Program
subsections: section_title: Overview of Medicaid’s Challenges
paragraphs: The size, growth, and diversity of the Medicaid program presents  oversight challenges, and we designated Medicaid as a high-risk program  in 2003 due to concerns about the adequacy of fiscal oversight. Medicaid  is one of the largest sources of funding for acute health care, long-term  care, and other services for low-income and medically needy populations.  This federal-state program covered an estimated 72.2 million people in  fiscal year 2016 and is the largest health program as measured by  enrollment and the second largest as measured by expenditures, second  only to Medicare. A source of significant pressure on federal and state  budgets, estimated Medicaid outlays for fiscal year 2016 were $575.9  billion, of which $363.4 billion was financed by the federal government  and $212.5 billion by the states.
Medicaid allows states significant flexibility to design and implement their  programs, resulting in more than 50 distinct programs; this variability  complicates program oversight and has contributed to challenges in  overseeing program payments and beneficiaries’ access to services.  Each state Medicaid program, by law, must cover certain categories of  individuals and provide a broad array of benefits. Populations covered  include children in low-income families and low-income individuals who  are elderly, disabled, or are experiencing high medical needs. Medicaid’s  extensive benefit package includes coverage for acute care services,  primary care services, long-term care services, and comprehensive  screening and treatment services for children.
Within these broad parameters, however, states administer their own  programs, deciding whether to cover any health services or populations  beyond what are mandated by law, setting provider reimbursement rates,  and operating state-specific data systems to enroll eligible beneficiaries  and providers and to process and pay claims. For example, states may  pay health care providers for each service they provide on a fee-for-service (FFS) basis; contract with managed care organizations (MCO) to  provide a specific set of Medicaid-covered services to beneficiaries, and  pay them a set amount per beneficiary per month; or rely on a  combination of both delivery systems.
Variability among state Medicaid programs also results from key Medicaid  reform efforts that states may initiate. For example, under Section 1115 of  the Social Security Act, the Secretary of Health and Human Services can  waive traditional Medicaid requirements and authorize states to expend  funds on Medicaid demonstrations to test new ways to deliver services.  State Medicaid programs also differ in whether and how they have  elected to expand Medicaid as allowed under the Patient Protection and  Affordable Care Act (PPACA), which gave states the option to expand  Medicaid eligibility to nearly all adults under age 65 with incomes up to  133 percent of the federal poverty level (hereafter referred to as newly  eligible adults). States that elected to expand Medicaid received 100  percent federal funding for this newly eligible population through 2016,  with the federal share declining to 90 percent for 2020 and subsequent  years. As of October 2016, 31 states and the District of Columbia had  opted to expand Medicaid eligibility under PPACA. In 2015, the Centers  for Medicare & Medicaid Services (CMS) projected that total spending for  Medicaid will rise an average of 6.4 percent per year from 2015 to 2024  (see figure 19).
States also vary in the extent to which they are affected by economic  downturns, which in turn can affect their Medicaid programs. The federal  government matches most state expenditures using a statutory formula  based in part on each state’s per capita income. We and others have  noted that states’ efforts to fund Medicaid can be challenged during  economic downturns, when Medicaid enrollment can rise and state  revenues can decline. To ensure that federal funding efficiently and  effectively responds to the program’s countercyclical nature, we have  emphasized the need for timely and targeted federal assistance to  stabilize states’ funding of Medicaid during such periods. Such  assistance would support states with declining revenues or increased  enrollment during a national economic downturn, further stabilizing the  financing of this important program.
An overarching challenge for the Medicaid program is the lack of  accurate, complete, and timely data CMS needs to oversee the diverse  and complex state Medicaid programs. Our work has made it clear that  insufficient data have affected CMS’s ability to ensure proper payments  and beneficiaries’ access to services. CMS’s two primary data sets—the  CMS-64, which serves as the basis for calculating the amount of federal  matching funds for states, and the Medicaid Statistical Information  System (MSIS), which is designed to report individual beneficiary claims  data—have the potential to offer a robust view of state financing,  payments, and overall spending in the Medicaid program. However, the  data’s usefulness is limited because of issues with completeness,  timeliness, and accuracy. Improved data would enhance CMS oversight,  allowing for improved monitoring of program financing and payments,  beneficiary access, and compliance with Medicaid laws and  requirements. CMS has acknowledged the need for improved Medicaid  data and has undertaken a number of steps aimed at streamlining and  improving the quality of data currently reported by states and available to  CMS for oversight purposes.
section_title: Our Work Suggests the Need for Continued Attention in Five Principal Areas
subsections: section_title: Financing and Provider Payment Transparency and Oversight
paragraphs: Complete and accurate data on state financing and payments to  individual providers is essential for CMS to effectively oversee state  Medicaid programs. Without more transparent information on state  funding sources and program payments, CMS is unable to determine  whether program expenditures are appropriate or to ensure the fiscal  integrity of the program. Congress has held multiple hearings on these  issues, including a November 2015 hearing at which the House  Committee on Energy and Commerce, Subcommittee on Health,  examined possible legislative remedies to address concerns we have  raised in multiple reports about the transparency of Medicaid financing  and payments to individual providers.
Financing transparency and oversight. In recent years, states have  increasingly relied on funds from providers and local governments to  finance the nonfederal share of Medicaid, with implications for federal  costs. While states finance the nonfederal share in large part through  state general funds, they also depend on other sources of funds, such as  taxes on health care providers and transfers of funds from local  governments. Our 2013 survey of states found that, in 2012, states  financed over one-quarter—over $46 billion—of the nonfederal share of  Medicaid with funds from health care providers and local governments, an  increase of over 21 percent since 2008 from these sources. Our work has  illustrated that by requiring providers to supply all or more of the  nonfederal share of Medicaid payments, states can claim an increase in  federal matching funds without a commensurate increase in state  expenditures. This shifts costs from the state to the federal government.
Identifying the sources of nonfederal funds is essential to assessing their  effect; however, CMS does not collect complete or accurate information  on these sources of nonfederal funds. Apart from data on provider taxes  and donations, CMS does not require states to provide information on the  funds they use to finance Medicaid nor ensure that the data they do  collect are accurate and complete. This lack of transparency in states’  sources of funding hinders CMS’s ability to determine whether increasing  payments to providers provides fiscal relief to the state or whether  increasing payments to providers improves beneficiary access. Without  accurate information on how states finance their Medicaid programs,  CMS is also unable to ensure that states comply with federal  requirements. For instance, under federal law, at least 40 percent of the  state share must be from state funds, which includes state general funds,  provider taxes and donations, and transfers from other state agencies.  CMS disagreed with our recommendation to take action to improve the  information available on states’ sources of the nonfederal share of  Medicaid payments. In 2015, legislation was introduced that would  require CMS to take such action.
Oversight of payments to institutional providers. Over the years, we  and others have reported on CMS’s oversight of payments that states  often make to institutional providers, such as hospitals and nursing  facilities, which have raised questions. In particular, concerns have been  raised about states making large Medicaid supplemental payments— payments in addition to the regular, claims-based payments made to  providers for services they provided—often to government providers,  such as local government and state-operated hospitals and other health  care facilities. In fiscal year 2015, the latest date for which data are  available, these payments totaled about $55 billion. Supplemental  payments that result in total Medicaid payments well in excess of a  provider’s costs raise questions about whether payments are consistent  with the statutory requirement that payments be economical and efficient  and are actually for covered Medicaid services.
Among other concerns related to CMS oversight of supplemental  payments, we have found the agency lacks a policy and process for  determining whether payments made to individual providers are  economical and efficient, as required by law, and lacks clear guidance on  appropriate methods for states to distribute payments. For example, in  2015, we reported that three hospitals in New York received  supplemental payments that resulted in overall Medicaid payments to the  hospitals that greatly exceeded their cost of providing Medicaid services.
CMS, in response, required New York to retroactively reduce  supplemental payments to the hospitals by more than $1.5 billion— including $771 million in federal funds—over 4 years.
Further, in a 2016 report, we found that selected states distributed  supplemental payments to hospitals largely based on the availability of  local government funds to finance the nonfederal share, rather than on  the volume of services each hospital provided. In addition, officials from  hospitals that received payments above costs reported using the excess  revenues from these supplemental payments broadly, from covering the  costs of uninsured patients to funding general hospital operations,  maintenance, and capital purchases, such as for a helicopter.
Based on the findings from these reports, we have recommended that  CMS (1) clarify criteria for determining the economy and efficiency of  payments to individual providers, (2) issue guidance clarifying its policies  that supplemental payments should be linked to the provision of Medicaid  services and not be contingent on the availability of local financing, and  (3) require provider-specific reporting of certain types of supplemental  payments. In 2015, legislation was proposed that would require CMS to  collect provider-specific data on states’ supplemental payments. As of  fall 2016, CMS was pursuing regulatory actions to address some of the  concerns we raised, including requiring states to report information about  how they distribute supplemental payments.
section_title: Managed Care Payments and Utilization Oversight
paragraphs: As of 2014, the latest date for which this information is available, more  than three-fourths of Medicaid beneficiaries received some of their  services in a managed care delivery system, in which the state typically  contracts with managed care organizations (MCO) to provide a specific  set of services for beneficiaries for a set amount per beneficiary per  month. Federal spending for managed care in fiscal year 2014 was $107  billion, which accounted for over one-third of federal Medicaid spending  that year and represented a significant increase from 2013. Increased  enrollment and spending for Medicaid managed care makes effective  federal and state oversight of this large and complex component of the  Medicaid program critical, and underscores the need for reliable data to  assess the appropriateness of states’ payments to MCOs and  beneficiaries’ access to MCO services. In our work examining federal  expenditures for MCOs, we determined that state payments to MCOs in  2014 varied widely across and within 8 states as did the average annual  MCO payments per beneficiary, which ranged from $2,784 in California to  $5,180 in Pennsylvania. While this variation could be due, in part, to  differences in the enrolled population and geographic costs and utilization  patterns, it suggests the need to further examine the relationship between  higher MCO spending and beneficiaries’ experiences.
Further, federal law requires states to collect encounter data—records of  health care services for which MCOs pay—and submit these data to CMS  using MSIS. Having reliable encounter data that provides information on  service utilization is important as MCOs receive a fixed amount per  beneficiary regardless of the number of services used and therefore may  have financial incentives to limit beneficiaries’ access to services.  However, in our work examining beneficiary utilization of services, we  could not fully assess utilization patterns for Medicaid managed care  beneficiaries in 19 states because MSIS data were either not available  (11 states) or were unreliable (8 states). In May 2016, CMS issued a  final rule for Medicaid managed care that includes provisions aimed at  improving Medicaid managed care encounter data submissions. For  example, for contracts with MCOs and limited benefit health plans  beginning on or after July 1, 2017, states are required to include  provisions regarding the maintenance of encounter data, and, by July 1,  2018, to have procedures in place to validate that the enrollee encounter  data these entities submit are complete and accurate.
section_title: Growing Expenditures for and Oversight of Large Medicaid Demonstrations
paragraphs: Medicaid demonstrations have become a significant proportion of  Medicaid expenditures, growing steadily from about $50 billion, or about  14 percent of total Medicaid expenditures in fiscal year 2005, to $165  billion, or close to one-third of total Medicaid expenditures in fiscal year  2015. Section 1115 of the Social Security Act authorizes the Secretary  of HHS to waive certain federal Medicaid requirements and allow costs  that would not otherwise be eligible for federal matching funds for  experimental, pilot, or demonstration projects that are likely to assist in  promoting Medicaid objectives. The demonstrations can provide a way for  states to test and evaluate new approaches for delivering Medicaid  services. By policy, demonstrations should be budget neutral to the  federal government; that is, they must not increase federal costs. In July  2015, CMS changed its organizational structure and increased its staffing  to oversee section 1115 demonstrations and their growing role in the  Medicaid program, and we continue to assess CMS’s approval and  oversight of spending for these demonstrations.
Expenditure authorities in Medicaid demonstrations. Using its  authority under Section 1115 of the Social Security Act to approve costs  that would not otherwise be matchable under Medicaid, HHS has  approved Medicaid spending for a wide range of purposes beyond  extending coverage to new populations or for new benefits. For example,  HHS approved demonstrations that allowed 5 states to spend up to $9.5  billion to fund state health programs that were previously financed at least  in part by the state or potentially other federal programs. HHS also  approved 8 states to make more than $26 billion in supplemental  payments to hospitals and other providers. We found that HHS’s criteria  and approval documents were not always clear as to how approved  spending would further Medicaid objectives. For example, some of these state programs appeared to be only tangentially related to  improving health outcomes for low-income individuals and lacked  documentation explaining how approving them would promote Medicaid  objectives. We also found that demonstration approvals sometimes  lacked assurances that demonstration spending would not duplicate other  federal funds received by states.
In response to our work, HHS issued general criteria for determining  whether demonstrations met Medicaid objectives, which it had not  delineated before. HHS also committed to identifying in approval  documents how each expenditure authority promoted Medicaid objectives  and providing assurances that demonstration funds would not duplicate  other federal funds. While issuing the general criteria is a useful first step,  we maintain that given the breadth of the Secretary’s authority under  section 1115—the exercise of which can result in billions of dollars of  federal expenditures for costs that would not otherwise by allowed under  Medicaid—more explicit criteria are needed.
Budget neutrality of Medicaid demonstrations. We remain concerned  about the Secretary of HHS’s lack of an adequate budget neutrality policy  including the criteria and process for reviewing and approving  demonstration spending limits and the lack of a written, up-to-date policy  that is readily available to state Medicaid directors and others. In multiple  reports, we have found that federal spending on Medicaid demonstrations  could be reduced by billions of dollars if HHS were required to improve  the process for reviewing, approving, and making transparent the basis  for spending limits approved for Medicaid demonstrations. For example,  in 2014, we reported that HHS had approved a spending limit for  Arkansas’s demonstration—to test whether providing premium assistance  to purchase private coverage through the health insurance exchange  would improve access for newly eligible Medicaid beneficiaries—that was  based, in part, on hypothetical, not actual, costs. We estimated that by  allowing the state to use hypothetical costs, HHS approved a  demonstration spending limit that was over $775 million more than what it  would have been if it was based on the state’s actual payment rates for  services under the traditional Medicaid program.
Another troubling precedent is that HHS granted Arkansas and 11 other  states additional flexibility in their demonstrations to increase the  spending limit if costs proved higher than expected. Our report on  Arkansas was the latest in a series of reports showing significant  concerns with HHS’s process for reviewing and approving spending  under demonstrations. For example, in 2013 we reported that, for 4 of 10  demonstrations we reviewed, HHS approved spending limits that  exceeded those that were supported in documentation and by HHS’s own  policy by an estimated $32 billion. We have recommended that HHS (1)  better ensure that valid methods are used to demonstrate budget  neutrality, (2) clarify criteria for reviewing and approving demonstration  spending limits, (3) document and make public the basis for approved  spending limits, and (4) update its written budget neutrality policy to  reflect the actual criteria and processes used to develop and approve  demonstration spending limits.
HHS has generally disagreed that changes to its policy and process are  needed. Congress has held hearings, sent letters to CMS, and proposed  legislation regarding how CMS reviews and approves demonstration  spending limits. Although HHS has not issued a written budget neutrality  policy as of October 2016, HHS has taken some steps to improve its  oversight, including issuing a report in October 2015 to Congress on  actions taken with respect to Medicaid demonstrations. The report  discussed some steps HHS has taken and planned to take to improve  access to program information and the transparency of its criteria for  approving expenditures. Further, in 2016 HHS took steps to change its  budget neutrality methodology that are intended to result in more  appropriate demonstration spending limits. Nonetheless, we maintain  that HHS must take the additional actions specified in our  recommendations to improve the transparency of its demonstration  approvals.
section_title: Monitoring and Measurement of Access to Quality Care
paragraphs: Access to appropriate care has been a concern because of the needs  and vulnerability of the individuals covered by Medicaid, including  children, the elderly, and the disabled. National survey data have  suggested that access reported by Medicaid beneficiaries is comparable  to that of individuals with private health insurance in many areas, but that  Medicaid beneficiaries do face particular challenges in accessing certain  types of care. To help assess Medicaid enrollees’ access to care, CMS  needs better data.
Access to preventive, oral, and mental health services. The higher  prevalence of some health conditions among Medicaid beneficiaries  nationally that can be identified and managed by preventive services  suggests that more can and should be done to ensure Medicaid  beneficiaries receive these services. For example, states are required to  provide preventive services for children through the Early and Periodic  Screening, Diagnostic, and Treatment (EPSDT) benefit. However,  national data collected by HHS suggest that Medicaid beneficiaries  receive these services at rates below established goals. In addition, our  2016 work showed that, due to variation across states in the scope,  functionality, and availability of resources on provider information,  Medicaid beneficiaries in FFS arrangements may face challenges in  identifying available providers in their respective states. State Medicaid  programs have also struggled to ensure that beneficiaries, particularly  children, receive appropriate oral health and mental health services when  needed. High rates of dental diseases remain prevalent across the nation,  especially in vulnerable and underserved populations. Medicaid  beneficiaries, children in particular, have increased their use of dental  services but still visited the dentist less often than privately insured  children. These visits are essential to preventing future high cost dental  services. Medicaid children may also have problems accessing mental  health providers and may not be receiving appropriate mental health  treatment and services. For example, national survey data indicate  concerns that some children enrolled in Medicaid may be inappropriately  prescribed psychotropic drugs and are not receiving needed mental  health services, such as counseling and therapy.
Better data needed to assess enrollees’ access to care. CMS’s ability  to assess beneficiaries’ access to services is complicated by insufficient data. For example, in reviewing states’ EPSDT reports for our 2011  report, we found reporting errors large enough to overstate the extent to  which children received services, and we found that states did not always  report required data on the number of children referred for additional  services. Further, the currently reported state data do not indicate  whether children referred for preventive services actually received the  services.
CMS has taken steps to better identify reporting errors and obtain  corrected data, but as of September 2016, CMS has no plans to require  states to report whether children received the treatment services for  which they were referred. Our 2015 work on MCOs described above also  points out the need for better data to understand MCO beneficiaries’  access to covered services, including differences in access that could  help explain the wide variation in MCO payments per beneficiary we  identified. Finally, given that PPACA requires states to cover certain  recommended preventive services for newly eligible adults in states that  expanded Medicaid under the law, data are needed to determine whether  this coverage helps improve beneficiaries’ access to and receipt of these  services.
section_title: Growing Expenditures for Long-Term Care Services
paragraphs: Medicaid is the nation’s primary payer of long-term care services and  supports (LTSS) for aged and disabled individuals. Medicaid spending  (federal and state) on LTSS is significant—in 2016, we reported LTSS  spending was an estimated $152 billion in fiscal year 2014 (see figure  20), or about one-quarter of the program’s total expenditures annually.  The demand for LTSS is expected to increase as the nation’s population  ages and life expectancy increases, including individuals with disabilities  and complex health needs who require long-term services and supports.
Monitoring of long-term care services provided in the community.  Medicaid LTSS spending for services provided to beneficiaries in home-  and community-based settings has grown rapidly and now exceeds  spending for care provided in institutional settings, such as nursing  homes. Monitoring and oversight of these services is important for  ensuring quality of care, as the individuals who rely on these services are  among Medicaid’s most vulnerable, and while home- and community- based services can enable people to live more independently, the  services are not without risk.
In the case of personal care services—an important type of long-term  care service to help individuals who have limited ability to care for  themselves—beneficiaries receiving these services include aged  individuals and individuals with physical, developmental, or intellectual  disabilities. When personal care services are provided in a private home,  other providers or community members may not be present to help  discourage or report questionable activities. Further, depending on the  state and the personal care services program, personal care attendants  who provide personal care services may not be required to have  specialized training. Personal care services—for which Medicaid paid $15  billion on a fee-for-service basis in calendar year 2015—are also among  the highest at risk for improper payments, including for services which  were billed but never provided to the beneficiary. In 2014, CMS estimated  over $2 billion of payment errors for Medicaid personal care services. In  2016, we found that while CMS has taken several steps to improve  oversight of personal care services, it has not collected all required state  reports on beneficiaries’ health and welfare for some programs, and it  could do more to harmonize the patchwork of federal program  requirements intended to oversee beneficiary safety and assure that  billed services are provided. Such harmonization would help ensure a  more consistent administration of policies and procedures and could  enhance oversight.
Finally, another important change in the delivery of Medicaid-funded  LTSS is the rapid growth in managed care, which in 2014 accounted for  almost 15 percent of Medicaid LTSS expenditures. We will continue to  monitor Medicaid’s use of managed care to deliver LTSS as well as other  aspects of the program’s growing support for LTSS and examine the  implications for oversight.
section_title: What Remains to Be Done
paragraphs: We have a number of Matters for Congressional Consideration and  recommendations to HHS and CMS for addressing issues related to  financing, payment oversight, demonstration spending, and access- related issues.
We have suggested Congress take the following actions:
To improve the transparency of and accountability for certain high-risk  Medicaid payments that total tens of billions of dollars annually,  Congress should consider requiring CMS to improve reporting of and  guidance related to certain supplemental payments and to require  states to submit annual independent audits of such payments.
To improve the fiscal integrity of Medicaid, Congress should consider  requiring increased attention to fiscal responsibility in approving  Section 1115 Medicaid demonstrations by requiring the Secretary of  HHS to improve the demonstration review process through steps such  as (1) clarifying criteria for reviewing and approving states’ proposed  spending limits, (2) better ensuring that valid methods are used to  demonstrate budget neutrality, and (3) documenting and making  public material explaining the basis for any approvals.
To ensure that federal funding efficiently and effectively responds to  the countercyclical nature of the Medicaid program, Congress should  consider enacting a federal matching formula that targets variable  state Medicaid needs and provides automatic, timely, and temporary  increased federal assistance in response to national economic  downturns.
In addition, we have made recommendations to HHS and CMS, including:
To improve CMS’s oversight of Medicaid payments, the Administrator  of CMS should develop (1) a policy establishing criteria for when such  payments at the provider level are economical and efficient; and (2) a  process for identifying and reviewing payments to individual providers,  once criteria are developed, in order to determine whether they are  economical and efficient.
To improve the transparency of the process for reviewing and  approving spending limits for comprehensive section 1115  demonstrations, the Secretary of Health and Human Services should  update the agency’s written budget neutrality policy to reflect actual  criteria and processes used to develop and approve demonstration  spending limits, and ensure the policy is readily available to state  Medicaid directors and others.
To meet HHS’s fiduciary responsibility of ensuring that section 1115  waivers are budget neutral, the Secretary should better ensure that  valid methods are used to demonstrate budget neutrality, by  developing and implementing consistent criteria for considering  proposals for section 1115 demonstration waivers.
To better understand the effect of certain personal care services on  beneficiaries and more consistently administer policies and  procedures across personal care services programs, the Secretary of  HHS should direct the Administrator of CMS to (1) collect and analyze  required state information on the impact of certain personal care  services programs, and (2) take steps to further harmonize federal  requirements across programs providing personal care services.
In light of the need for accurate and complete information on  children’s access to health services under Medicaid and State  Children’s Health Insurance Program (CHIP), CMS should work with  states to identify additional ways to improve reports used to monitor  children’s access to services, including identifying how to capture  information related to whether children receive treatment services for  which they are referred.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Katherine  Iritani at (202) 512-7114 or iritanik@gao.gov, or Carolyn L. Yocom at  (202) 512-7114 or yocomc@gao.gov.
section_title: Related GAO Products
paragraphs: Medicaid Personal Care Services: CMS Could Do More to Harmonize  Requirements Across Programs. GAO-17-28. Washington, D.C.:  November 23, 2016.
Medicaid Fee-For-Service: State Resources Vary for Helping  Beneficiaries Find Providers. GAO-16-809. Washington, D.C.: August 29,  2016.
Medicaid: Federal Guidance Needed to Address Concerns About  Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.:  February 5, 2016.
Medicaid Managed Care: Trends in Federal Spending and State  Oversight of Costs and Enrollment. GAO-16-77. Washington, D.C.:  December 17, 2015.
Medicaid: Improving Transparency and Accountability of Supplemental  Payments and State Financing Methods. GAO-16-195T. Washington,  D.C.: November 3, 2015.
Medicaid: Overview of Key Issues Facing the Program. GAO-15-746T.  Washington, D.C.: July 8, 2015.
Medicaid: Key Issues Facing the Program. GAO-15-677. Washington,  D.C.: July 30, 2015.
Medicaid Demonstrations: More Transparency and Accountability for  Approved Spending Are Needed. GAO-15-715T. Washington, D.C.: June  24, 2015.
Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care.  GAO-15-481. Washington, D.C.: May 29, 2015.
Medicaid Demonstrations: Approval Criteria and Documentation Need to  Show How Spending Furthers Medicaid Objectives. GAO-15-239.  Washington, D.C.: April 13, 2015.
Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited  Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.
Medicaid and CHIP: Reports for Monitoring Children’s Health Care  Services Need Improvements. GAO-11-293R. Washington, D.C.: April 5,  2011.
section_title: Medicaid Improper Payments
subsections: section_title: Why Area Is High Risk
paragraphs: The Centers for Medicare & Medicaid Services (CMS) in the Department  of Health and Human Services (HHS) has taken several actions that  demonstrate its commitment to reduce improper payments, including  using rulemaking to strengthen state capacity and oversight of managed  care organizations (MCO) and the ongoing implementation of a new  claims data system that could address issues with incomplete, inaccurate,  and untimely state data. Despite these efforts, however, overall Medicaid  improper payments continue to increase, rising to about $36.3 billion in  fiscal year 2016 compared with $29.1 billion in fiscal year 2015.
We designated Medicaid as a high-risk program in 2003 in part due to  concerns about the adequacy of the fiscal oversight that is necessary to  prevent inappropriate program spending. This federal and state program  covered acute health care, long-term care, and other services for an  estimated 72.2 million low income and medically needy individuals in  fiscal year 2016, making it one of the largest sources of funding for  medical and health-related services. Under current law, the program is  expected to continue to grow—covering as many as 13.2 million  additional individuals by 2025—as states may expand their Medicaid  programs under the Patient Protection and Affordable Care Act (PPACA).  As with any estimate, changes to PPACA or other laws could affect the  projected federal spending on major federal health care programs and  federal revenues.
By design, Medicaid allows significant flexibility for states to design and  implement their programs, which has resulted in over 50 distinct state- based programs. The federal government matches state expenditures  for most Medicaid services using a statutory formula. The federal  matching rate varies under the program, with increased federal matching  funds for individuals newly eligible through the expansion of Medicaid  under PPACA. The program is a significant expenditure for the federal  government and the states, with total estimated expenditures of $575.9  billion in fiscal year 2016, of which $363.4 billion was financed by the  federal government and $212.5 billion by the states.
Within broad federal guidelines, states have some discretion in setting  Medicaid eligibility standards and provider payment rates, and in  determining the amount, scope, and duration of covered benefits and how  these benefits are delivered. For example, states may pay health care  providers for each service they provide on a fee-for-service (FFS) basis;  contract with MCOs to provide a specific set of Medicaid-covered services  to beneficiaries and pay them a set amount per beneficiary per month; or  rely on a combination of both delivery systems. Roughly three-fourths of  Medicaid beneficiaries receive some or all of their services from MCOs,  and payments to MCOs account for over one-third of federal Medicaid  spending. Increased enrollment and spending for Medicaid-managed care  makes effective federal and state oversight of this large and complex  component of the Medicaid program critical.
The size and diversity of the Medicaid program make it particularly  vulnerable to improper payments—including payments made for people  not eligible for Medicaid or made for services not actually provided. Over  recent years, improper payments have increased substantially and  represent a significant cost to the program, an estimated $36.3 billion in  federal dollars in fiscal year 2016. While states have the first-line  responsibility for preventing improper payments, CMS has an important  role in overseeing and supporting state efforts to reduce and recover  improper payments. This high-risk assessment focuses solely on CMS’s  efforts to prevent and reduce improper payments. Medicaid vulnerabilities  include more than improper payments, and we discuss the broader  challenges and risks associated with the Medicaid program separately  (see page 520).
section_title: What GAO Found
paragraphs: As mentioned above, the continued growth in the overall estimated  improper payment rate—10.5 percent in 2016 compared with 9.8 percent  in 2015—underscores the need for additional federal action and has  resulted in the agency partially meeting the 5 key criteria for removal from  our High-Risk List: leadership commitment, capacity, action plan,  monitoring, and demonstrated progress. Until additional actions are  taken, gaps in oversight remain that will challenge CMS’s ability to reduce  improper payments.
Congress has taken action to address improper payments and oversight  challenges in the Medicaid program. For example, HHS identified  provider screening and enrollment as a main area contributing to  increased estimates in Medicaid improper payments, and Congress  recently enacted legislation requiring MCOs only use providers that have  been screened and enrolled by the appropriate state Medicaid program.  The legislation also requires states to report information about terminated  Medicaid providers to CMS and requires CMS to include such  information, as appropriate, in the agency’s Medicaid provider termination  notification system. Additionally, Congress has held several hearings  related to Medicaid improper payments, including a May 2016 hearing  held by the House Energy and Commerce Subcommittee on Oversight  and Investigations and an October 2015 hearing held by the Senate  Committee on Finance. Further indicating a continued focus on agency  action on Medicaid program integrity, the chairmen of two congressional  committees and subcommittees sent letters to CMS regarding Medicaid  program integrity, including a letter on eligibility determinations and one  on how CMS sets its target improper payment rate for the Medicaid  program.
section_title: What Remains to Be Done
paragraphs: CMS has taken steps to improve the improper payment rate in recent  years, including implementing certain recommendations we previously  made and using rulemaking to strengthen program integrity efforts.  Several of these efforts are in progress, with staggered compliance dates  for changes to oversight of MCOs and continued state implementation of  the Transformed Medicaid Statistical Information System (T-MSIS). For  example, the requirement in the May 2016 managed care rule for states  to audit the accuracy, truthfulness, and completeness of the financial data  submitted by MCOs will not take effect until July 2017. Additionally, T- MSIS, which aims to collect more complete and timely state data,  including claims and utilization data, is not fully implemented across all  states. Continued oversight and leadership will be necessary in these  areas.
Further, there are several areas where CMS needs to take action to  address issues and recommendations that have not been fully  implemented, including:  considering which additional databases that states and Medicaid  managed care plans use to screen providers, which could be helpful  in improving the effectiveness of these efforts, and determining  whether any of these databases should be added to the list of  databases identified by CMS for screening purposes; developing a plan to regularly assess the effectiveness of checks for  duplicate coverage between Medicaid and federally facilitated  exchanges, including thresholds for the level of duplicate coverage it  deems acceptable;  continuing its efforts to work with Social Security Administration to  share its Death Master File with states and providing additional  guidance to states to better identify beneficiaries who are deceased;  and  conducting systematic assessments of federal determinations of  Medicaid eligibility in states that delegated this authority to the federal  marketplace until it is part of the regular review processes that are  expected to resume in 2018.
Fully addressing these recommendations would help CMS address the  growing levels of improper payments. Until CMS takes additional actions  to address these and other gaps in oversight, the Medicaid program  remains at risk for unacceptable levels of improper payments and  therefore remains on our High-Risk List.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: CMS continues to partially meet the criteria for leadership commitment to  reducing improper payments; however, questions remain about the  success of its efforts. Since 2014, the agency has reorganized its  program integrity activities with the aim of creating more streamlined  operations; established an agency-wide Program Integrity Board to  identify and set priorities for addressing vulnerabilities in its programs;  and taken steps to improve coordination activities with Medicare. CMS  also published a final rule on Medicaid managed care in May 2016 that is  intended to improve oversight of MCOs. The rule is responsive to our  priority recommendations that CMS should hold states accountable for  Medicaid MCO program integrity by requiring states to audit payments to  and by MCOs, and updating its guidance on Medicaid managed care  program integrity practices and effective handling of MCO recoveries. As  1 example, the rule requires that states, at least once every 3 years, audit  the data submitted by MCOs with contracts starting on or after July 1,  2017. Prior to issuance of this rule, there had been no requirement for  states to audit payments to and by MCOs. However, given that CMS only  recently reorganized its program integrity activities, and issued the new  rule, and that the rule’s provisions will be implemented in staggered time  frames that extend to 2018, the effects on program integrity efforts are  unclear.
Further, additional leadership is needed to address remaining  weaknesses in federal oversight, including ensuring complete, accurate,  and timely data to support oversight and program integrity efforts. CMS is  continuing its national effort to implement the T-MSIS. However,  implementation has been delayed for several years, and it remains  unclear when data will be available from all states or how CMS will use  these data for oversight purposes.
section_title: Capacity
paragraphs: CMS continues to partially meet the criteria for capacity. The agency has  taken actions to enhance the resources and guidance available to states  for program integrity purposes. For example, CMS issued a final rule in  December 2015 that permanently extends the availability of a 90 percent  federal match for states’ expenditures related to enhancing or replacing  their Medicaid eligibility and enrollment information technology (IT)  systems, and aims, in part, to enhance states’ program reporting and  management tools to support program integrity efforts. In addition, the May 2016 managed care rule includes provisions to strengthen data  available on managed care utilization and imposes financial  consequences on states that do not submit MCO utilization data. For  example, state contracts with MCOs must provide for the collection and  maintenance of sufficient data on managed care service utilization, also  known as encounter data, and states must have procedures to ensure  that these required enrollee encounter data are complete and accurate.  However, these provisions do not take effect until July 2017 or 2018, so  their success in improving data available for program integrity is unknown  and will depend on how states and CMS implement them.
In response to our 2015 priority recommendation to support state third- party liability efforts, CMS produced an updated guide to compile and  share effective and innovative Medicaid third-party liability practices  reported by states, an important tool that could help states ensure that  Medicaid pays only after other liable third parties. In response to our  priority recommendation to provide guidance to states on their oversight  of third-party liability efforts conducted by Medicaid managed care plans,  CMS subsequently published a handbook, which provides guidance to  states on third party liability efforts, including such efforts conducted by  Medicaid MCOs. Finally, our recent work has also identified limitations in  program integrity efforts in Puerto Rico and other U.S. territories that put  Medicaid funding in these areas at risk for fraud, waste, and abuse, and  underscore the need for CMS to develop a cost-effective approach to  protecting Medicaid funding in these territories.
section_title: Action Plan
paragraphs: CMS has documented a strategic approach to reducing improper  Medicaid payments, but only partially meets the criteria due to a missing  report the agency is legally required to provide to Congress. In July 2014,  CMS issued the Comprehensive Medicaid Integrity Plan for fiscal years  2014 through 2018, in which CMS established goals to expand its  capacity to protect the program’s integrity and manage risk in  administering federal grants to states. The agency is required to report to  Congress annually on the use and effectiveness of funds appropriated for  the Medicaid Integrity Program. The agency reported for fiscal years 2013  and 2014 in July 2016, well after the required timeframes, and the agency  is out of compliance with the requirement for fiscal year 2015 because it  has not submitted a report for fiscal year 2015, as of December 2016.
With regard to specific actions, CMS has taken steps to identify duplicate  coverage for individuals transitioning from Medicaid to federally facilitated  exchanges created under PPACA, and had performed three checks as of  October 2016. In response to our priority recommendation that CMS  establish a schedule for regular checks for duplicate coverage, CMS  reported that it intends to check for duplicate coverage at least two times  per coverage year going forward. CMS also reported that it was reviewing  these data to assess whether the checks were effective. However, the  agency has not developed a plan, including thresholds for the level of  duplicate coverage it deems acceptable, to routinely monitor the  effectiveness of these checks.
section_title: Monitoring
paragraphs: CMS continues to partially meet the criteria for monitoring. CMS has  enhanced its oversight of states’ program integrity activities, particularly  by increasing its focus on collaborative audits and working with states to  improve compliance with PPACA’s provider screening requirements. In  focusing on collaborative audits, CMS has engaged more states than  before, targeted federal audit resources to state needs, and identified an  increasing amount of overpayments. In addition, CMS now provides  states with federal data to strengthen Medicaid provider enrollment  screening and has provided guidance and technical assistance to assist  states on their revalidation efforts. CMS also recently provided additional  guidance to states on specific provider screening and reporting provisions  included in the 21st Century Cures Act. Our prior work has shown that  available federal data do not include all of the information necessary for  states to effectively and efficiently process Medicaid provider applications.  Due to this issue and other challenges, we found that states and  managed care plans rely on fragmented information from multiple and  disparate databases to screen managed care providers, and often  struggle to access and use these databases because of difficulties  conducting provider matches across databases.
CMS also needs to take additional steps to better monitor states’  beneficiary eligibility determinations. Specifically, we found that CMS is  not always able to assess the accuracy of federal Medicaid eligibility  determinations, which is particularly problematic where states delegate  this determination authority to the federal government through federally  facilitated exchanges. While CMS is relying upon operational controls  within the federal marketplaces to ensure accurate eligibility  determinations, without a systematic review of these determinations, the  agency lacks a mechanism to ensure that only eligible individuals are  enrolled in the program and to identify associated improper payments  until CMS’s updated eligibility review program resumes in 2018.
section_title: Demonstrated Progress
paragraphs: CMS continues to partially meet the criteria for demonstrated progress.  The agency has taken actions to improve federal and state oversight of  Medicaid MCOs, to extend funding to help states modernize their  eligibility systems, and to help states come into compliance with recent  legislation by providing updated guidance. Nonetheless, additional  actions are warranted to identify and reduce improper payments, given  the rise in the Medicaid improper payment rate and expected growth of  the Medicaid program.
Several factors will complicate CMS efforts to identify improper payments.  Specifically, CMS’s improper payment rate estimates may be inaccurate  because the agency has frozen a component used to calculate improper  payments based on beneficiary eligibility through fiscal year 2018.  Additionally, CMS estimates of improper payments to MCOs do not  consider underlying medical data such as the use of medically  unnecessary services and other contributing factors. Finally, CMS will not  fully implement certain provisions to strengthen program integrity in  Medicaid managed care—such as requiring MCOs to only use providers  that have been screened and enrolled by the appropriate state Medicaid  program—until January 2018. Thus, it is critical that CMS take other  actions to ensure that only providers in good standing participate in the  program during this interim period.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: CMS is conducting collaborative audits with states, which allows the  states to augment their own program integrity audit capacity by  leveraging the resources of CMS and its audit contractors. These  efforts have increased the amount of identified Medicaid  overpayments.
CMS provided training to states through the Medicaid Integrity  Institute on correct reporting of program integrity recoveries. Efforts to  ensure correct reporting of recoveries will make it easier for CMS to  determine whether states are returning the federal share of recovered  overpayments.
CMS posted guidance on its website regarding the requirements that  must be met in order for Medicaid administrative expenditures to be  eligible for federal matching funds. A CMS official said that the agency  ensures that the policies are applied consistently across all states  through internal training. These efforts should improve CMS’s  financial management of Medicaid administrative claiming activities.
CMS reconfigured the National Medicaid Audit Program to eliminate  the review contractor function altogether in response to concerns that  the federal review was duplicative of actions undertaken by audit  contractors within a state or geographic area. By eliminating  duplication in the review function, CMS will realize greater efficiencies  in its audits and reduce state burden.
section_title: GAO Contact
section_title: Related GAO Products
paragraphs: Medicaid: Program Oversight Hampered by Data Challenges,  Underscoring Need for Continued Improvements. GAO-17-173.  Washington, D.C.: January 6, 2017.
Medicaid Program Integrity: Improved Guidance Needed to Better  Support Efforts to Screen Managed Care Providers. GAO-16-402.  Washington, D.C.: April 22, 2016.
Medicaid and CHIP: Increased Funding in U.S. Territories Merits  Improved Program Integrity Efforts. GAO-16-324. Washington, D.C.: April  8, 2016.
Nonemergency Medical Transportation: Updated Medicaid Guidance  Could Help States. GAO-16-238. Washington, D.C.: February 2, 2016.
Medicaid: Additional Federal Controls Needed to Improve Accuracy of  Eligibility Determinations and for Coordination with Exchanges.  GAO-16-157T. Washington, D.C.: October 23, 2015.
Medicaid: Additional Efforts Needed to Ensure That State Spending Is  Appropriately Matched with Federal Funds. GAO-16-53. Washington,  D.C: October 16, 2015.
Medicaid and Insurance Exchanges: Additional Federal Controls Needed  to Minimize Potential for Gaps and Duplication in Coverage. GAO-16-73.  Washington, D.C.: October 9, 2015.
Medicaid: Key Issues Facing the Program. GAO-15-677. Washington,  D.C.: July 30, 2015.
Medicaid: Additional Actions Needed to Help Improve Provider and  Beneficiary Fraud Controls. GAO-15-313. Washington, D.C: May 14,  2015.
Medicaid: Additional Federal Action Needed to Further Improve Third- Party Liability Efforts. GAO-15-208. Washington, D.C.: January 28, 2015.
section_title: Improving and Modernizing Federal Disability Programs
subsections: section_title: Why Area Is High Risk
paragraphs: programs that support employment can divert individuals from the  disability rolls, these programs lack a unified vision, strategy, or set of  goals to guide their outcomes. We first designated improving and  modernizing federal disability programs as high risk in 2003.
section_title: What GAO Found
paragraphs: The federal government’s progress in improving and modernizing  disability programs remains mixed. We assessed progress across five  broad areas: two reflecting SSA’s and VA’s actions to manage their  disability claims workloads; two reflecting SSA’s and VA’s progress to  modernize their criteria for deciding who is eligible for disability benefits;  and, lastly, the Office of Management and Budget’s (OMB) efforts to  create unified strategies and goals for programs that support employment  for people with disabilities. Some of the agencies we assessed met  certain criteria while others did not, and when combined, the resulting  summary rating shows that the five criteria were partially met. SSA and  VA have continued to make progress managing their claims workloads,  but both agencies currently face challenges managing their appeals  backlogs. SSA and VA also have made progress updating the criteria  they use to determine eligibility for disability benefits, especially with  respect to developing action plans. In terms of plans to mitigate the  potential effects of program fragmentation, OMB—which performs a  management role for the executive branch—has made some progress  developing plans to test interventions that may improve employment  outcomes in the private as well as public sector, but has not yet  developed a unified vision, or government-wide goals and related  strategies for improving employment outcomes outside of the federal  sector.
With respect to SSA updating the criteria it uses to determine eligibility for  benefits, more needs to be done to address this high-risk issue, but in  response to our 2012 recommendation, SSA took action that resulted in  cost savings. Specifically, SSA replaced its earlier, highly ambitious plans  to develop its own occupational information system (OIS) (to house  occupational data used to make disability determinations) with a  potentially more cost-effective approach that uses existing expertise and  resources in the federal government. In doing so, SSA partnered with the  Bureau of Labor Statistics (BLS) to collect and update occupational  information by surveying employers. As a result of SSA implementing our  recommendation, we determined that, as of 2015, SSA saved  approximately $27 million dollars.
section_title: What Remains to Be Done
paragraphs: council to run early intervention demonstration programs, which has  the potential to uncover approaches worth pursuing at a national level.  However, to date, the proposed council to achieve that vision has not  been funded. Further, while common measures recently implemented  will help assess the relative success of specific programs across  agencies, the prior administration did not develop goals or strategies  for measuring and tracking the cumulative effect of disparate  programs on employment outcomes beyond the federal sector—which  could also help inform and target the types of interventions to be  piloted by the new administration.
section_title: Additional Details on What GAO Found
subsections: section_title: Managing Disability Claims Workload (SSA)
paragraphs: Since our 2015 update, SSA has demonstrated mixed progress in  addressing its workload challenges, such that partially met ratings did not  change from 2015. Specifically, SSA made progress reducing its backlog  of initial disability claims, while its appeals workload continued to grow.
subsections: section_title: Leadership Commitment
paragraphs: Since our 2015 high-risk report, SSA has continued to meet our  leadership criterion. As described below, SSA officials told us that they  continued to develop plans to implement its Vision 2025—a long-term  strategic plan that articulates how SSA will serve its customers in the  future. SSA also designated reducing wait times for hearings decisions as  a priority goal for fiscal years 2016 and 2017.
section_title: Capacity
paragraphs: SSA continued to partially meet our criterion for building capacity. With  respect to ensuring sufficient capacity at the initial claims level, while SSA  has reduced the number of pending initial claims each year since 2010,  efforts to further reduce costs and process claims more efficiently using  technology were stalled. Specifically, SSA halted development of its  Disability Case Processing System (DCPS), after a consulting firm  contracted by SSA reported the agency spent about $288 million with few  results. Subsequently, SSA selected a new development path for the  DCPS, and officials still expect that DCPS will improve workflows and  reduce administrative costs; however, SSA’s Office of Inspector General  found that SSA did not evaluate all alternatives or consider all costs  required to maintain a new system before pursuing a DCPS alternative.  SSA officials reported in October 2016 that the agency was developing an  initial product to deliver to three test sites focused on processing certain  fast-track claims. To address its priority goal of reducing the time for  hearing decisions, officials reported that SSA increased the number of  administrative law judges (ALJ) who decide appeals cases by 349 in  fiscal years 2015 and 2016—about a 24 percent increase. In its plan to  address its appeals backlog, SSA noted that it is exploring ways to  improve ALJ hiring in difficult-to-staff locales, leverage SSA’s Office of  Quality Review to obtain assistance with critical case processing  activities, and use judges from the Appeals Council to hold hearings on  some cases. However, SSA officials noted in October 2016 that plans to  increase hiring and leverage other resources are on hold due to a hiring  freeze expected to extend into fiscal year 2017.
section_title: Action Plan
paragraphs: their hearings, and sharing resources across the agency to help  process appeals at backlogged hearing offices; and  improving the use of information technology (IT), such as expanding  the use of video hearings, providing online records access to medical  and vocational experts, and reducing the use of physical paperwork at  hearings-level cases.
While this plan is a positive step, the extent to which proposed actions will  reduce the hearings backlog remains to be seen. In September 2016,  SSA’s OIG reported that more than half of the initiatives in the agency’s  plan duplicated past backlog initiatives, including a 2007 plan that did not  result in long-term reductions of the backlog. Additionally, SSA notes in its  plan that some efforts, such as increased hiring, will depend on the  agency receiving additional funding. Regarding SSA’s broader Vision  2025 effort, officials told us that SSA is still in the process of developing  plans to implement it. Among other things, Vision 2025 touches on the  agency’s capacity to process initial claims and appeals. SSA officials told  us that SSA is integrating aspects of Vision 2025 into its fiscal year 2018- 2022 strategic plan—scheduled to be issued in January 2018—and  conducting working sessions with a cross-section of SSA employees to  gather input about how to realize Vision 2025 priorities.
section_title: Monitoring
paragraphs: SSA continued to meet our criterion for monitoring by continuing to  monitor and report on the timeliness of its initial claims and appeals  workloads.
section_title: Demonstrated Progress
paragraphs: SSA partially met our criterion, demonstrating mixed progress. In  addressing its initial claims backlogs, SSA continued to reduce the  number of pending claims in each fiscal year since 2010—from about  842,000 in fiscal year 2010 to 621,000 in fiscal year 2015. However, the  timeliness of its appeals workload worsened. The number of hearings  pending as of the end of 2016 was over 1.1 million and the average time  needed to complete appeals increased from 353 days in fiscal year 2012  to 545 days in fiscal year 2016. SSA’s goal is to eventually reduce this  time to 270 days, as articulated in its appeals reform plan.
section_title: Managing Disability Claims Workload (VA)
paragraphs: Since our 2015 high-risk update, VA has demonstrated mixed progress in  addressing its workload challenges. Progress is evident in regards to  VA’s efforts to reduce the Veterans Benefit Administration’s (VBA)  compensation claims backlog. However, VA’s appeals workload  continued to grow, and several efforts to address this challenge are still  underway. In particular, VA’s proposed framework to reform the appeals  process—developed by VBA and the Board of Veterans’ Appeals  (Board)—requires legislative authority to pursue. We have ongoing work  related to VA’s efforts to address appeals workloads and timeliness that  we plan to issue in the first quarter of 2017.
subsections: section_title: Leadership Commitment
paragraphs: VA continued to meet our criterion for leadership commitment. Since  2015, VA tracked progress toward eliminating the disability compensation  claims backlog, an agency priority goal set for fiscal years 2014 and  2015. It also renewed its commitment to reducing appeals inventories and  improving timeliness of appeals decisions by updating its appeals  strategic plan in 2016, making development of a simplified appeals  process 1 of VA’s 12 breakthrough priorities for 2016, and working closely  with veterans service organizations (VSO) and other stakeholders to  propose a new framework and associated legislation to reform the current  appeals process.
section_title: Capacity
paragraphs: evidence is received. VA states that these automation capabilities will  increase the efficiency of compensation claims processing; and  implementing a national work queue distribution tool at all regional  offices that should allow VA to electronically distribute claims across  regional offices to even out workloads.
According to VA, these efforts have resulted, to date, in reducing the  compensation claims backlog by 88 percent from a peak of 611,073  claims in March 2013 to a low of 71,690 as of September 30, 2016.  Further, VA reported that it increased compensation claim productivity per  full-time equivalent (FTE) by 25 percent since 2011. However, it remains  to be seen if VA can maintain these gains as workloads are projected to  increase in the future.
At the appellate level, VA proposed a streamlined appeals framework  through which it hopes to gain efficiencies; however this new  framework—which is still in the planning stages—requires legislative  authority to implement. VA is developing and implementing technology  improvements that could result in enhanced productivity, such as a new  appeals processing system that would better support a paperless  process. VA also added 300 FTEs at VBA to help process appeals in  fiscal years 2015 and 2016, and according to agency officials, VA  received a 42 percent increase in funding for the Board in fiscal year 2017  that will support the hiring of additional FTEs. VA plans further  improvements related to capacity, such as increasing human resources  and training support, and is developing a recruitment plan with the Office  of Personnel Management (OPM) to hire additional staff, primarily in the  attorney role. However, these staffing increases and technology  improvements were underway as of January 2017, and it is too early to  determine the extent to which the sum of these efforts will improve VA’s  capacity to process appeals.
section_title: Action Plan
paragraphs: providing veterans with a more simple, timely, transparent, and fair  appeals process. While potentially promising, as of October 2016, VA  was still developing implementation plans and did not have legislative  authority to pursue its proposed reforms. Regarding staffing, VA officials  reported in March 2016 that they were working with OPM on a strategic  recruitment plan, but had not finalized this plan.
section_title: Monitoring
paragraphs: VA partially met our criterion for monitoring. VA continued to have clear  goals for processing compensation claims and a system for monitoring  them on a regular basis; however, gaps exist in VA’s ability to measure  performance and proposed process changes related to appeals. In fiscal  year 2015, VA developed new measures to publicly report appeals  processing performance in its Annual Performance Reports, which VA  officials said focus on the discrete steps in the appeals process and help  show where bottlenecks exist. However, VA no longer publicly reports the  total average amount of time needed across VBA and the Board to  resolve an appeal. As we noted in our 2015 update, not reporting broad  measures—such as the average time needed to resolve appeals across  VA—reduces the transparency of VA’s progress. Additionally, VA  currently lacks data that could help it more fully understand factors  currently affecting appeals decision timeliness, such as data on the  number of actions taken on cases or the number of times claims were re- reviewed because new evidence was submitted. To help address this, VA  officials told us that they are developing a data dashboard as a part of IT  improvements, but it is too early to tell how the agency will use the  dashboard to evaluate proposed improvements to the appeals process.
section_title: Demonstrated Progress
paragraphs: VA partially met our criterion for demonstrating progress. VA continued to  make progress with reducing its compensation claims backlog.  Specifically, VA decreased the total inventory of compensation claims by  57 percent from a peak of 883,930 in fiscal year 2012 to 377,107 in fiscal  year 2016. Additionally, VA has improved its claim processing timeliness  by reducing the average length of time a claim is pending from an  average of 282 days in fiscal year 2013 to 85 days in fiscal year 2016.
2012 to 936 days in fiscal year 2015. Appeals that were decided by the  Board in fiscal year 2015 required an average of 1,789 days for a  decision, compared to an average of 1,691 days in fiscal year 2012.
section_title: Updating Disability Benefit Eligibility Criteria (SSA)
paragraphs: Since 2015, SSA has continued to make progress on several fronts to  update the criteria that it uses to determine eligibility for disability benefits.  SSA’s progress is evident across the five high-risk criteria, especially with  respect to capacity and action plans, which improved from partially met to  met. However, SSA has not yet finished reviewing all medical listings, and  is still developing and testing its approach for updating occupational  information that is also used to determine eligibility. It is also unclear how  SSA will consider incorporating the results of a study on accommodations  in the workplace into its decision-making process.
subsections: section_title: Leadership Commitment
paragraphs: SSA continued to meet our criterion for leadership commitment, by  maintaining focus and ensuring progress toward updating the medical  criteria and occupational information used to determine eligibility for  disability benefits, as well as by agreeing to study the role of assistive  technologies and workplace accommodations in mitigating impairments,  and how this might be considered in its disability decision making.
section_title: Capacity
paragraphs: the first update of occupational data (due to be completed in 2024) will be  $178 million. We found SSA’s cost estimate to contain sufficient analysis  and information to support its scaled-back and more feasible approach for  developing an OIS. Thus, SSA met the intention of our prior  recommendation that it develop life-cycle cost estimates for the project in  accordance with best practices, which may help SSA make program  decisions and ensure sufficient resources are allocated to the effort. With  respect to our prior recommendation to consider the roles of assistive  technologies and workplace accommodations in disability decision  making, SSA built capacity by tasking the Health and Medicine Division  (HMD) of the National Academies of Sciences, Engineering, and  Medicine under a contract to study this issue. Its final report is due in July  2017.
section_title: Action Plan
paragraphs: SSA has also met our criterion for developing action plans, improving  from partially met in 2015. As we noted earlier, SSA has plans in place for  updating its medical criteria, and it continued to make progress towards  its goals. With respect to updating its OIS, SSA has developed a project  plan for developing the OIS, and recently provided a life-cycle cost  estimate as noted earlier. Lastly, SSA tasked HMD under a contract to  further study the issue of how assistive technologies and workplace  accommodations can affect disability determination decisions, with a  proposed completion date of July 2017.
section_title: Monitoring
paragraphs: SSA continued to meet the criterion of monitoring progress toward  updating its medical criteria, and has project plans and schedules against  which to monitor its progress toward developing a new OIS to replace its  outdated Dictionary of Occupational Titles.
section_title: Demonstrated Progress
paragraphs: SSA partially met our criterion for demonstrating progress. With respect to  updating its medical listings, SSA officials reported that, as of October  2016, the agency had published final rules for 13 of the 14 body systems  for adults, and drafted a proposed rule for the remaining system. SSA  expects to publish that final rule in 2017 once OMB under the new  administration has reviewed it. Officials stated they are on track to revisit  the 14 body systems every 3 to 5 years once the first round of  comprehensive updates is complete. SSA officials also reported steady  progress updating its occupational information.
In 2016, SSA and BLS completed the first year of its 3-year cycle of  collecting survey data for the OIS, which followed its completion of a  large-scale, preproduction test involving collecting occupational  information from about 2,500 employers.
In May 2016, SSA officials also reported that they are working with a  contractor to develop a Web-based system to house its occupational  data, which they expect to complete in fiscal year 2017.
With respect to assistive technologies and workplace accommodations,  officials reported progress under SSA’s contract with HMD to study  workplace accommodations and assistive technologies. Officials reported  that HMD held public forums in July and September 2016 and invited  experts to present information on various aspects of workplace  accommodations and assistive technologies, which HMD plans to  incorporate into its report findings. SSA expects HMD to conclude its  study by July 2017, but it remains to be seen whether and how SSA will  consider the results of the study in its decision-making process.
section_title: Updating Disability Benefit & Eligibility Criteria (VA)
paragraphs: VA continued to make progress toward updating the medical criteria that  it uses to determine eligibility for disability compensation, and has now  improved to met for action plan and monitoring. However, VA has  experienced delays, and officials told us that VA will not meet its prior  target for completing this effort by March 2017.
subsections: section_title: Leadership Commitment
paragraphs: VA met our criterion for leadership commitment. As noted in sections  below, VA leadership continued to dedicate attention and resources to  completing an initial revision of its medical criteria and developing plans  to keep them updated.
section_title: Capacity
paragraphs: VA partially met our criterion for capacity. Since 2015, VA has taken steps  to ensure it has the capacity to revise and maintain its medical criteria,  and officials told us that VA has drafted or is in the process of drafting  revised regulations for 14 of the 15 body systems. However, VA will not  meet its target date for completing a final review and revision of all body  systems by March 2017. Specifically, officials told us that VA:  finished impact analyses—studies of how revisions will affect  veterans’ disability ratings—for 10 of 15 body systems and extended  timelines for completing analyses for the remaining body systems to  the end of calendar year 2017; promulgated proposed regulations for 5 of 15 body systems with plans  to finalize 4 of those 5 by its original target date of March 2017, and  extended its target dates for finalizing new rules for all body systems  until the end of fiscal year 2018; and plans to assemble cross-functional teams to identify what changes VA  will need to make to its policies, procedures, communications,  training, and computer systems to implement the regulations, which  VA officials said is in accordance with the agency’s standard process  for implementing new and revised regulations.
In addition, officials told us that VA lacks the necessary internal resources  or expertise to conduct earnings loss studies, which take into account  how advances in medical treatments and assistive technologies might be  used to reduce functional loss due to disability. As such, VA requested  funding for a new earnings loss study to begin in 2017. If funding is not  provided, VA officials noted that they will use any available information to  meet VA’s goal of reviewing and revising its medical criteria on a  staggered 5-year cycle. We will continue to monitor VA’s efforts toward  making fact-based and timely revisions to the VA ratings schedule, and  ultimately implement these revisions in its decision making process.
section_title: Action Plan
paragraphs: VA has now met our criterion for action plans, up from partially met in  2015. VA made noteworthy progress in accordance to its original project  plan, as noted above, and updated timeframes in its plan in response to  delays. VA officials currently expect to promulgate final rules for all body  systems by the end of fiscal year 2018. Moreover, officials also told us  that VA is on track to achieve its plans to keep criteria current once initial  updates are complete by placing each of the 15 body systems into a 5- year cycle of staggered reviews, and intends to document work plans and  maintain working groups for each system to ensure that medical  advancements and new research are incorporated as necessary.
section_title: Monitoring
paragraphs: VA met our criterion for monitoring, up from partially met in 2015. Since  August 2013, VA has tracked its progress against its project plan for  finishing its first round of updates of medical criteria, completing earning  loss studies, and ensuring all body systems are updated once every 10  years. In doing so, it has also updated its project plan to include new  timeframes for completing its first round of updates in response to delays  described below.
section_title: Demonstrated Progress
paragraphs: VA partially met our criterion for demonstrated progress. Since 2015, VA  has continued to make progress updating its medical criteria, but, as  previously mentioned, VA will not meet its target to review and revise  regulations for all body systems by March 2017. Specifically, it is not on  target to promulgate regulations for 11 of the 15 body systems it is  updating, and now expects to promulgate proposed regulations for the 11  systems by the end of fiscal year 2017, and final regulations by the end of  fiscal year 2018. Officials also reported progress in completing impact  analyses; as of August 2016, VA had completed analyses for 10 of the 15  body systems. VA extended timeframes for the 5 remaining analyses to  be completed by the end of 2017, prior to the new target date for  promulgating final regulations. We will continue to monitor VA’s progress  toward finalizing regulations for all body systems, and, as referenced  earlier, how it will keep earnings loss information updated.
section_title: Programs with Unified Strategies and Goals (OMB)
paragraphs: Since our 2015 update, OMB has made some progress towards  enhancing coordination and capacity across programs that support  employment for people with disabilities. Some progress is evident in all  five high-risk criteria. However, the scope of its current efforts to improve  employment outcomes and coordination is limited to federal agencies and  contractors, and OMB has not yet articulated a broader vision for  supporting employment for people with disabilities outside the federal  sector that includes appropriate government-wide goals and strategies for  achieving them.
subsections: section_title: Leadership Commitment
paragraphs: promising, they continue to fall short of developing government-wide  strategies and measurable goals to help people with disabilities attain  employment in both the public and private sectors. Finally, OMB officials  told us that they are preparing transition plans to help ensure current  efforts continue under the new administration, but it remains to be seen  whether the administration will support and sustain these efforts.
section_title: Capacity
paragraphs: OMB continued to partially meet our criterion for building capacity. In  addition to proposing the creation of the Council and issuing a resource  guide for employers regarding people with disabilities, OMB officials  noted that the prior administration took two other actions to improve the  capacity for agency coordination:
The Departments of Education and Labor finalized regulations under  the Workforce Innovation and Opportunity Act (WIOA), which includes  a provision that requires states to set aside funds to assist students  with disabilities transition from school to postsecondary education or  the workforce, and allows state vocational rehabilitation agencies to  prioritize serving students with disabilities.
The administration proposed increased funding for supported  employment programs in fiscal years 2016 and 2017 that could, for  example, provide supported employment services for up to 2 years for  individuals already in vocational rehabilitation programs. These  efforts, however, are limited in scope or have not yet been  implemented. Moreover, they do not relate to creating capacity for  establishing goals and other mechanisms to ensure agencies are  accountable for having a measureable impact on employment  outcomes outside the federal sector.
section_title: Action Plan
paragraphs: OMB continued to not meet our criterion for developing action plans. As  mentioned previously, the prior administration proposed establishing the  Council. While the proposed Council is a promising approach, the Council  has not received—as of January 2017—funding for fiscal year 2017, and  it remains to be seen whether this proposal will be funded in the future.  Moreover, the administration has yet to establish government-wide goals  for people with disabilities achieving employment outside the federal  sector. To help ensure focus through the new administration, OMB  officials noted that, in addition to OMB developing transition plans, a  number of agencies have 5-year strategic plans that will span the  outgoing and incoming administrations. OMB officials also noted that it is  ultimately up to the new administration to decide how to plan and  coordinate across federal disability programs.
section_title: Monitoring
paragraphs: OMB partially met our criterion for monitoring. Since 2015, the  administration continued to track and work toward increasing employment  for people with disabilities at federal agencies, achieving the former  President’s goal of hiring 100,000 employees with disabilities over 5  years. With respect to the goal to have people with disabilities comprise  7 percent of federal contractors, OMB officials told us that Labor is  updating its case management system to track progress toward this goal.  They added that Labor will collect information on contractor performance  against this goal as it conducts compliance evaluations, thereby creating  a good source of trend data over time. With respect to standardizing the  way programs and agencies measure employment, OMB officials told us  that the prior administration took a number of steps:
The Departments of Labor and Education promulgated a joint final  rule, pursuant to a requirement in WIOA, which defines common  measures to be used by the six core job training programs under the  two departments.
Other programs, such as the Supplemental Nutrition Assistance  Program’s Employment and Training program, have adopted similar  measures.
OMB officials stated that it is coordinating an interagency group to  ensure all relevant agencies develop the necessary data infrastructure  to collect information on these common measures.
OMB officials said that the administration worked with VA to add  employment-oriented measures to its Vocational Rehabilitation and  Employment Program. Relatedly, officials noted that it is reasonable  to expect the manner in which programs and agencies measure  employment to vary to reflect the different challenges they face.
While common measures are helpful in measuring across programs, they  do not provide and OMB still lacks a comprehensive picture of how  disparate federal efforts support employment of those with disabilities  outside the federal sector.
section_title: Demonstrated Progress
paragraphs: permanent employees with disabilities—including 98,000 full-time  employees—exceeding the former President’s goal of hiring 100,000 over  this period. However, additional hiring goals have not been set and OMB  officials said it is up to the new administration whether and how to do so.  With respect to the administration’s goal to have people with disabilities  comprise 7 percent of most federal contractors, OMB officials reported  that Labor’s initial results from this effort will not be available until mid- 2017. With respect to implementing measures across programs, OMB  officials told us that, although the administration has yet to develop  government-wide goals for the employment of people with disabilities  across all sectors, they anticipate that demonstration projects overseen  by the Council, if implemented, would identify successful early  intervention approaches, which would inform the development of  reasonable outcome measures.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: SSA Workloads: In response to a past recommendation, SSA  appointed a chief strategic officer responsible for coordinating agency- wide planning efforts, including those related to managing SSA’s  disability claims workloads.
VA Workloads: Consistent with our past recommendation, in 2013  VA published its Strategic Plan to Eliminate the Compensation Claims  Backlog, which identified implementation risks and metrics for the  major initiatives mentioned in the Plan.
SSA Modernizing: In response to past recommendations, SSA  developed a project plan to assess risks to the success of the OIS,  and has taken steps to estimate costs for necessary data collection  and planned IT expenditures. SSA also worked with BLS to contract  with experts to ensure they had the appropriate expertise to complete  the OIS. products and technologies for adults, and a final report for SSA is  expected in July 2017.
VA Modernizing: In response to a past recommendation, in 2013 VA  developed a project management plan that included plans for initiating  subsequent updates to its disability rating schedule at regular  intervals—whereby reviews of each body system are initiated on a  staggered 5-year cycle to ensure no more than 10 years transpires  without a review and possible revision of each body system.
VA Modernizing: In response to a past recommendation, in 2014 VA  updated its project management plan to reflect planned actions—such  as identifying human resources to assist in developing and  implementing proposed changes, and needed updates to guidance,  training and systems—that would ensure smooth and timely  implementation of revisions to its ratings schedule.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Barbara  Bovbjerg at (202) 512-7215 or bovbjergb@gao.gov.
section_title: Related GAO Products
paragraphs: Social Security Disability: SSA Could Increase Savings by Refining Its  Selection of Cases for Disability Review. GAO-16-250. Washington, D.C.:  February 11, 2016.
Veterans Disability Benefits: VA Can Better Ensure Unemployability  Decisions are Well Supported. GAO-15-464. Washington, D.C.: July 2,  2015.
Veterans’ Disability Benefits: Improvements Could Further Enhance  Quality Assurance Efforts. GAO-15-50. Washington, D.C.: November 19,  2014.
Social Security Administration: Long-Term Strategy Needed to Address  Key Management Challenges. GAO-13-459. Washington, D.C.: May 29,  2013.
Veterans’ Disability Benefits: Timely Processing Remains a Daunting  Challenge. GAO-13-89. Washington, D.C.: December 21, 2012.
VA Disability Compensation: Actions Needed to Address Hurdles Facing  Program Modernization. GAO-12-846. Washington, D.C.: September 10,  2012.
Employment for People with Disabilities: Little Is Known about the  Effectiveness of Fragmented and Overlapping Programs. GAO-12-677.  Washington, D.C.: June 29, 2012.
Modernizing SSA Disability Programs: Progress Made, but Key Efforts  Warrant More Management Focus. GAO-12-420. Washington, D.C.: June  19, 2012.
section_title: Pension Benefit Guaranty Corporation Insurance Programs
subsections: section_title: Why Area Is High Risk
paragraphs: With nearly $100 billion in assets, the Pension Benefit Guaranty  Corporation’s (PBGC) financial portfolio is one of the largest of any  federal government corporation. Through its single-employer and  multiemployer insurance programs, PBGC insures the pension benefits of  nearly 40 million American workers and retirees who participate in nearly  24,000 private-sector defined benefit plans. PBGC’s financial future  remains uncertain, due in part to a long-term decline in the number of  traditional defined benefit plans and the collective financial risk of the  many underfunded pension plans that PBGC insures. We designated the  single-employer program as high risk in July 2003 and added the  multiemployer program in January 2009.
Since fiscal year 2013, PGBC’s financial deficits have more than doubled.  At the end of fiscal year 2016, PBGC’s net accumulated financial deficit  was over $79 billion—an increase of about $44 billion since 2013. At the  same time, PBGC estimated that its exposure to future losses for  underfunded plans was nearly $243 billion. The single-employer  program, composed of about 22,200 plans, accounted for $20.6 billion of  PBGC’s overall deficit (see figure 21). The multiemployer program,  composed of only about 1,400 plans, accounted for about $59 billion.  According to PBGC, these dramatic increases were attributable to broad  economic factors and financial conditions of the plans PBGC insures.
Various laws have been enacted to strengthen PBGC’s financial position.  For instance, the Pension Protection Act of 2006 (PPA) strengthened  pension funding requirements for plans, the Moving Ahead for Progress  in the 21st Century Act (MAP-21) included measures to increase premium  rates and the Bipartisan Budget Act of 2013 increased premium rates  further. However, some of this legislation also included provisions that would allow single employer plan sponsors to defer mandatory  contributions to their defined benefit pension plans. To the extent that  sponsors reduce contributions in the short term, they may increase plan  underfunding and expose PBGC to greater risk. Recognizing the dramatic  increase in PBGC’s deficit because of particular financial and  demographic challenges facing many multiemployer plans, the  Multiemployer Pension Reform Act of 2014 (MPRA) was enacted in  December 2014 with a number of provisions to promote the long-term  viability of the multiemployer program.
section_title: What GAO Found
paragraphs: As with our last report in 2015, there is no rating for this high-risk area  because addressing the issues in this area primarily involves  congressional action, while the high-risk criteria and subsequent ratings  were developed to reflect the status of agencies’ actions and the  additional steps they need to take.
While PBGC faces a significant long-term challenge with its single- employer program, it faces an immediate and critical challenge with its  multiemployer program. In a 2013 report, we recommended that  Congress consider comprehensive and balanced structural reforms to   reinforce and stabilize the multiemployer system. In December 2014,  Congress took action to address the growing crisis in the multiemployer  pension system by passing MPRA, which enacted several reforms  responsive to our 2013 report on PBGC’s multiemployer program.  Specifically, MPRA provided severely underfunded plans, under certain  conditions and only with the approval of federal regulators, the option to  reduce the retirement benefits of current retirees to avoid plan insolvency  and expanded PBGC’s ability to intervene when plans are in financial  distress. In addition, MPRA doubled the premiums paid by  multiemployer plans (from $13 to $26 per participant). While these  reforms are intended to improve the program’s financial condition,  projections suggest that the future insolvency of the multiemployer  program remains likely. Prior to passage of MPRA, PBGC estimated that  the multiemployer insurance fund would likely be exhausted by 2022 as a  result of current and projected plan insolvencies. PBGC officials noted  that the act did not fully address the crisis in the multiemployer program  and they predict that the changes will only forestall insolvency of the  program probably by about an additional 3 years. Current estimates  indicate that these changes will allow some plans to stay solvent and will  reduce the cumulative unmet need for financial assistance to  multiemployer plans by about half. As of January 2017, 10 pension plans  had submitted 11 applications to suspend benefits under MPRA. (4  applications have been denied, 2 were withdrawn, 4 are under review,  and 1 has been approved.) In addition, the Bipartisan Budget Act of 2013  and the Bipartisan Budget Act of 2015 increased premium rates for the  single-employer program.
PBGC continues to face long-standing funding challenges for its single- employer insurance program as well, due to an overall decline in the  defined benefit pension system. While tens of thousands of companies  continue to offer traditional defined benefit plans, the total number of  plans has declined significantly, as has participation in those plans. Since  1985, there has been a 79 percent decline in the number of plans insured  by PBGC to 23,769 plans in 2014 and more than 11 million fewer workers  are actively participating in these plans. As a result, PBGC’s premium  base has been eroding over time as fewer sponsors are paying premiums  for fewer participants.
Additionally, the structure of PBGC’s premium rates—a key component of  PBGC’s funding—has long been another area of concern. Despite  periodic increases in premium rates, which are set according to statute,  the level of premiums has not kept pace with the magnitude and  multiplicity of risks that PBGC insures against. Moreover, plan  underfunding is the only risk factor currently considered in determining a  sponsor’s premium rate. Since 2011, the administration has proposed  legislative reforms that would authorize the PBGC board to adjust  premiums and to explore designing a more risk-based premium structure.  Under the current premium structure for its single-employer program,  PBGC collects from sponsors a per-participant flat-rate premium and a  variable-rate premium that is based on a plan’s level of underfunding. In  2012, we recommended that Congress consider authorizing a redesign of  PBGC’s premium structure for single-employer plans to allow  incorporation of additional risk factors, such as consideration of a  sponsor’s financial health. PBGC officials stated that they have continued  efforts to enhance understanding of alternative premium structures by  analyzing the limitations of the current system and by modeling various  alternative risk-based options. However, to date no legislation  incorporating additional risk factors into PBGC’s premium structure has  been enacted.
PBGC’s governance structure is another area of weakness noted in  several of our past reports. In particular, we have long recommended that  PBGC’s board—currently composed of the Secretaries of the Treasury,  Commerce, and Labor—be expanded to include additional members with  diverse backgrounds who possess knowledge and expertise useful to  PBGC’s mission. This recommendation has not yet been enacted into  law, but MAP-21 included provisions to improve PBGC’s governance by  prescribing in greater detail the working relationships between its Board  of Directors and its Inspector General, General Counsel, Advisory  Committee, and Director. It also called for the National Academy of  Public Administration (NAPA) to review PBGC’s governance structure  and to report on the ideal size and composition of its board. In its  September 2013 report, NAPA recommended to Congress that if the  agency is provided greater responsibility over its policies, PBGC’s board  should be expanded. Furthermore, we have long emphasized that  PBGC requires strong and stable leadership to ensure that it can meet its  future financial challenges.
In August 2016, the Secretary of Labor provided updated information  related to several of these areas of concern. Regarding the long-term  financial stability of both insurance programs, the Secretary noted that the  President’s 2017 budget again proposed that the PBGC Board be granted  the authority to adjust premiums, and with that authority directed the  Board to raise $15 billion in additional premium revenue from the  multiemployer program. With regard to the recommendation to improve  PBGC’s governance structure, the PBGC Board has declined to pursue  the matter further absent authorizing legislation. PBGC has recently  established an Enterprise Risk Management function and plans to hire a  Risk Management Officer to identify and determine appropriate actions to  mitigate the risks identified. As of October 2016, PBGC had not yet filled  this position or determined the areas of potential risk to be targeted.
section_title: What Remains to Be Done
paragraphs: Although Congress and PBGC have taken significant and positive steps  to strengthen the agency over the past 3 years, concerns persist related  to the multiemployer program and challenges related to PBGC’s overall  funding structure and governance. While changes were made with  passage of MPRA, PBGC officials believe there is a 50 percent chance  that the multiemployer program will be insolvent by the year 2025, and  after that, the risk of insolvency rises rapidly—reaching 90 percent by  2032. Further, the premium structure for PBGC’s single-employer  program continues to result in rates that do not align with the risk the  agency insures against and the effectiveness of PBGC’s board remains  hampered by its size and composition.
Moreover, PBGC continues to face the ongoing threat of losses from the  termination of underfunded plans, while grappling with a steady decline in  the defined benefit pension system. With each passing year, fewer  employers are sponsoring defined benefit plans and the sources of funds  to finance future claims are becoming increasingly inadequate. Absent  additional steps to improve PBGC’s finances, the long-term financial  stability of the agency remain uncertain and the retirement benefits of  millions of American workers and retirees could be at risk of dramatic  reductions.
subsections: section_title: Congressional Actions Needed
paragraphs: To improve the long-term financial stability of both PBGC’s insurance  programs, Congress should consider: authorizing a redesign of PBGC’s single employer program premium  structure to better align rates with sponsor risk; adopting additional changes to PBGC’s governance structure—in  particular, expanding the composition of its board of directors;  strengthening funding requirements for plan sponsors as appropriate  given national economic conditions; working with PBGC to develop a strategy for funding PBGC claims  over the long term, as the defined benefit pension system continues to  decline; and enacting additional structural reforms to reinforce and stabilize the  multiemployer system that balance the needs and potential sacrifices  of contributing employers, participants and the federal government.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Charles A.  Jeszeck at (202) 512-7215 or jeszeckc@gao.gov.
section_title: Related GAO Products
paragraphs: Pension Plan Valuation: Views on Using Multiple Measures to Offer a  More Complete Financial Picture. GAO-14-264. Washington, D.C.:  September 30, 2014.
Private Pensions: Timely Action Needed to Address Impending  Multiemployer Plan Insolvencies. GAO-13-240. Washington, D.C.: March  28, 2013.
Private Pensions: Multiemployer Plans and PBGC Face Urgent  Challenges. GAO-13-428T. Washington, D.C.: March 5, 2013.
Pension Benefit Guaranty Corporation: Redesigned Premium Structure  Could Better Align Rates with Risk from Plan Sponsors. GAO-13-58.  Washington, D.C.: November 7, 2012.
Pension Benefit Guaranty Corporation: Improvements Needed to  Strengthen Governance Structure and Strategic Management.  GAO-11-182T. Washington, D.C.: December 1, 2010.
Private Pensions: Changes Needed to Better Protect Multiemployer  Pension Benefits. GAO-11-79. Washington, D.C.: October 18, 2010.
section_title: National Flood Insurance Program
subsections: section_title: Why Area Is High Risk
paragraphs: The National Flood Insurance Program (NFIP) is a key component of the  federal government’s efforts to limit the damage and financial effect of  floods. However, it likely will not generate sufficient revenues to repay the  billions of dollars borrowed from the Department of the Treasury  (Treasury) to cover claims from the 2005 and 2012 hurricanes or potential  claims related to future catastrophic losses. This lack of sufficient revenue  highlights what have been structural weaknesses in how the program is  funded. Since the program offers rates that do not fully reflect the risk of  flooding, NFIP’s overall rate-setting structure was not designed to be  actuarially sound in the aggregate, nor was it intended to generate  sufficient funds to fully cover all losses.
Instead, Congress authorized the Federal Emergency Management  Agency (FEMA)—the agency within the Department of Homeland  Security (DHS) responsible for managing NFIP—to borrow from Treasury,  within certain limits, when needed. Until the 2005 hurricanes, FEMA had  used its authority to borrow intermittently and was able to repay the loans.  As of March 2016, FEMA owed Treasury $23 billion, up from $20 billion  as of November 2012. FEMA made a $1 billion principal repayment at the  end of December 2014—its first such payment since 2010.
The Biggert-Waters Flood Insurance Reform Act of 2012 (Biggert-Waters  Act) contained provisions to help strengthen the financial solvency of the  program, including phasing out almost all discounted insurance premiums  (for example, subsidized premiums). However, the extent to which its  changes would have reduced NFIP’s financial exposure is unclear. In July  2013, we reported that FEMA was starting to implement some of the  required changes. However, on March 21, 2014, the Homeowner Flood  Insurance Affordability Act of 2014 (HFIAA) was enacted. HFIAA  reinstated certain premium subsidies and slowed down certain premium  rate increases that had been included in the Biggert-Waters Act. Aspects  of HFIAA were intended to address affordability concerns for certain  property owners, but may also increase NFIP’s long-term financial burden  on taxpayers. Further, an outdated policy and claims management  system has also placed the program at risk. As a result of its substantial  financial exposure and management and operations challenges, the  program has been on our High-Risk List since 2006.
section_title: What GAO Found
paragraphs: Congress and FEMA have made progress in meeting the criteria for  removing NFIP from the High-Risk List. In July 2012, the Biggert-Waters  Act was enacted. The Biggert-Waters Act contained provisions to help  strengthen the financial solvency of the program, including phasing out  almost all discounted insurance premiums (for example, subsidized  premiums). In March 2014, HFIAA was enacted. HFIAA reinstated certain  premium subsidies and slowed down certain premium rate increases that  had been included in the Biggert-Waters Act.
FEMA leadership has also shown a commitment to taking a number of  actions to implement our recommendations. However, implementing  required changes under the Biggert-Waters Act, as amended by HFIAA,  and addressing allegations of improper claims adjusting practices after  Hurricane Sandy have created capacity challenges for FEMA in  addressing the financial exposure created by NFIP as well as improving  program administration. FEMA has identified actions to implement our  recommendations, but it has not yet developed a comprehensive plan to  address all the issues that have placed NFIP on our High-Risk List.
For example, FEMA has a process in place to monitor progress in taking  actions to implement our recommendations related to NFIP. But broader  monitoring of the effectiveness and sustainability of its actions would help  ensure that FEMA takes appropriate corrective actions. While FEMA has  demonstrated progress toward improving NFIP’s financial stability and  program efficiency, these efforts are not complete. For example, FEMA  has addressed our recommendations to improve the monitoring and  reporting of NFIP contractor performance and validate data system  changes before they become effective.
FEMA also has initiated actions to improve the accuracy of full-risk rates,  but some of these efforts will continue over the next 5 to 10 years. In  addition, we estimate that policyholders with certain subsidized premiums  paid $216 million more in premiums as of the end of fiscal year 2015 than  they would have paid prior to the enactment of the Biggert-Waters Act as  a result of changes FEMA made in rates for these properties. However,  FEMA still does not have all the necessary information to appropriately  revise premium rates for certain subsidized properties. Other important  actions, such as modernizing its policy and claims management system,  also remain to be completed.
section_title: What Remains to Be Done
paragraphs: While FEMA leadership has displayed a commitment to addressing the  challenges that have placed NFIP on the High-Risk List and has made  progress in a number of areas, FEMA needs to take the following actions.
Complete Biggert-Waters Act and HFIAA requirements that have not  been fully met.
Develop a comprehensive plan for removing NFIP from the High-Risk  List.
Initiate broader monitoring of the effectiveness and sustainability of its  actions to help ensure that appropriate corrective actions are being  taken.
Continue ongoing efforts to improve its NFIP rate-setting methods and  evaluate approaches to obtain flood risk information needed to  determine full-risk rates for properties with previously subsidized  rates.
Complete efforts to establish a new information technology system for  NFIP.
By completing the actions noted above, FEMA will likely improve its ability  to address the financial exposure of the program and help ensure that the  funds allocated to NFIP and premiums paid to the program are used  effectively.
In addition, Congress should continue to consider changing the program  to further address the competing goals of financial solvency and  affordability.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: FEMA partially meets this criterion. FEMA’s leadership continues to show  a commitment to implement our recommendations designed to help  strengthen NFIP’s future financial solvency and administrative efficiency.  However, the 2014 enactment of HFIAA continues to present  administrative challenges for FEMA leadership and affect the program’s  capacity to address the financial exposure created by NFIP. For example,  HFIAA reinstated certain premium subsidies and slowed down some  premium rate increases that had been included in the Biggert-Waters Act.  In addition, the Biggert-Waters Act required that FEMA establish a  reserve fund to be available for meeting the expected future obligations of  NFIP, and HFIAA includes an annual surcharge for all policies ($25 for  most policies) to be added to the reserve fund. However, FEMA stated in  its June 2016 Quarterly NFIP Reserve Fund Report to Congress that it  would not reach the required reserve fund balance of $12.8 billion for  fiscal year 2015.
FEMA stated that as long as the NFIP maintains outstanding debt, it  would expect that the reserve fund will not reach the required balance, as  amounts collected may be periodically transferred to Treasury to reduce  the NFIP’s debt or to pay claims and expenses in years when claims are  high. For example, according to DHS officials, FEMA notified Congress in  October 2016 that it planned to use reserve funds to pay for claims  related to the 2016 flooding in Louisiana and Hurricane Matthew because  the National Flood Insurance Fund had been exhausted. FEMA further  stated in its June 2016 report that in order to make any significant  progress toward increasing the reserve fund balance or paying down the  NFIP debt, the reserve assessment would need to be significantly  increased. In January 2017, FEMA obtained reinsurance for NFIP  effective January 1, 2017 through January 1, 2018. A FEMA official noted  that securing reinsurance was a key step toward building a stronger  financial framework for NFIP. Under the agreement, reinsurers agreed to  cover 26 percent of NFIP claims between $4 billion and $8 billion on  losses from events that occur in 2017.
section_title: Capacity
paragraphs: FEMA partially meets this criterion. FEMA’s capacity continues to be  strained as it deals with multiple challenges, including implementing  required changes under the Biggert-Waters Act, as amended by HFIAA.  For example, as we reported in December 2016, FEMA officials told us  that the agency’s progress implementing the Biggert-Waters Act  requirement to revise its compensation methodology had slowed as  litigation over Hurricane Sandy claims escalated and more resources  were assigned to that issue.
FEMA has made some progress to address weaknesses that we  previously noted could limit its ability to effectively and efficiently  implement NFIP. For example, we made two recommendations in a  January 2014 report aimed at improving FEMA’s monitoring and reporting  of contractor performance, such as ensuring that federal contracting  officials have complete and timely information about contractor  performance. FEMA provided us with documentation describing how the  agency plans to ensure the timeliness of contractor performance  assessments and address our other concerns.
We also recommended in a December 2014 report that FEMA institute  controls to validate changes to the NFIP data system. In March 2015,  FEMA instituted the use of a new procedure manual, including a testing  plan, for data system programming changes required to implement NFIP  rate and rule changes. This procedure manual outlines the steps and  approvals needed to plan, develop, test, and deploy NFIP data system  changes.
However, FEMA faces challenges implementing required Biggert-Waters  Act and HFIAA requirements, including the complexity of the legislation  and timing of the enactment of HFIAA, resource constraints, and the  competing program goals of financial solvency and affordability. In  October 2016, DHS officials told us that FEMA had met requirements to  complete 20 of the 34 Biggert-Waters sections and 14 of the 25 HFIAA  sections and was taking action on other sections.
section_title: Action Plan
paragraphs: FEMA partially meets this criterion. FEMA has identified actions to  address the recommendations from our individual reports. In January  2017, a FEMA official noted that the agency tracks GAO  recommendations through its internal controls program. The official added  that FEMA is planning to enhance its Enterprise Risk Management  approach to track those GAO recommendations that impact its risk  profile. However, FEMA lacks a comprehensive plan that addresses the  issues that have placed NFIP on our High-Risk List. While addressing our  recommendations is part of such a plan, a comprehensive plan defines  the root causes, identifies effective solutions, and provides for  substantially completing corrective measures near term. Such a plan  could help FEMA ensure that all important issues, and all aspects of  those issues, are addressed.
section_title: Monitoring
paragraphs: FEMA partially meets this criterion. FEMA has a process in place to  monitor progress in taking actions to implement our recommendations  related to NFIP. For example, the status of efforts to address the  recommendations is regularly discussed both within FEMA and at the  DHS level, according to a DHS official. However, FEMA lacks a specific  process for independently validating the effectiveness or sustainability of  those actions. According to a DHS official, once FEMA implements a  recommendation related to NFIP, it does not track separately the effects  of the actions taken to do so, but instead regularly reviews the  effectiveness of the entire program. Additional monitoring of the  effectiveness and sustainability of its specific actions taken to address our  recommendations would help ensure that appropriate corrective actions  are being taken.
section_title: Demonstrated Progress
paragraphs: FEMA partially meets this criterion. FEMA has demonstrated progress  toward improving NFIP’s financial stability and program operations. As  previously discussed, FEMA has taken steps to address our  recommendations to improve how it monitors and reports NFIP contractor  performance and validates data system changes before they become  effective. However, progress is needed in other areas. For example, in  2008 we recommended that FEMA take steps to ensure that rate-setting  methods and the data used to set rates result in full-risk premiums that  accurately reflect the risk of flooding. We found that FEMA’s method for  setting its full-risk rates may not ensure that the rates accurately reflect  the actual risk of flood damage. In 2013, we also recommended that  FEMA develop and implement a plan to obtain flood risk information  needed to determine full-risk rates for properties with previously  subsidized rates. We found that FEMA generally lacks information  needed to apply full-risk rates to certain subsidized properties.
As of March 2016, FEMA officials identified a number of actions the  agency has taken or has underway to improve its NFIP rate-setting  methods, but the officials noted that some of these efforts would continue  over the next 5 to 10 years. In addition, as a result of changes FEMA has  made in rates for certain subsidized properties (specifically, subsidies for  primary residences, non-primary residences, and residential severe  repetitive loss properties), we estimate that policyholders with these  subsidized premiums paid $216 million more in premiums as of the end of  fiscal year 2015 than they would have paid prior to the enactment of the  Biggert-Waters Act. FEMA officials also said that they are evaluating  approaches, including using new technologies, to collect elevation  information for subsidized properties without financially burdening  policyholders.
FEMA has demonstrated progress in improving other areas of the  program’s operations, such as continuity planning. However, some  important actions, such as modernizing its information technology  systems—including those for financial reporting and its policy and claims  management system—remain to be completed. In 2011, we  recommended that FEMA develop guidance and a related plan for  continuing operations during federal disasters to help ensure consistent  day-to-day operations when staff are deployed to disaster sites or  reassigned to work on disaster-related issues. As part of developing its  2012 continuity plan, FEMA identified critical staff as well as the key  operations that need to continue when staff are deployed in response to a  federal disaster and how operations will continue during such periods.
In 2011, in our review of FEMA’s financial management, we reported that  staff faced multiple challenges in their day-to-day operations due to  limitations in the systems they must use to perform these operations. In  this same report, we also noted that FEMA faces challenges modernizing  NFIP’s insurance policy and claims management system. After 7 years  and $40 million, FEMA ultimately canceled its NextGen effort in  November 2009 because the system did not meet user expectations.  Since that time, FEMA established a steering committee tasked with  overseeing FEMA’s next attempt to modernize its policy and claims  processing system and began implementing some changes to its  acquisition management practices. It remains to be seen if these efforts  will help FEMA avoid some of the problems that led to NextGen’s failure.  In late-November 2014, FEMA officials told us that the agency was in the  acquisition stage for a new system called “Phoenix” that will replace  NextGen and NFIP’s current financial and reporting system. In January  2017, a FEMA official stated the DHS acquisition review board had  granted FEMA permission to procure and build the new system.
section_title: GAO Contact
paragraphs: For additional information about this high risk area, contact Alicia Puente  Cackley at (202) 512-8678 or cackleya@gao.gov.
section_title: Related GAO Products
paragraphs: Flood Insurance: FEMA Needs to Address Data Quality and Consider  Company Characteristics When Revising Its Compensation Methodology.  GAO-17-36. Washington, D.C.: December 8, 2016.
Flood Insurance: Review of FEMA Study and Report on Community- Based Options. GAO-16-766. Washington, D.C.: August 24, 2016.
Flood Insurance: Potential Barriers Cited to Increased Use of Private  Insurance. GAO-16-611. Washington, D.C.: July 14, 2016.
National Flood Insurance Program: Continued Progress Needed to Fully  Address Prior GAO Recommendations on Rate-Setting Methods. GAO- 16-59. Washington, D.C.: March 17, 2016.
National Flood Insurance Program: Options for Providing Affordability  Assistance. GAO-16-190. Washington, D.C.: February 10, 2016.
Flood Insurance: Status of FEMA's Implementation of the Biggert-Waters  Act, as Amended. GAO-15-178. Washington, D.C.: February 19, 2015.
Flood Insurance: Forgone Premiums Cannot Be Measured and FEMA  Should Validate and Monitor Data System Changes. GAO-15-111.  Washington, D.C.: December 11, 2014.
Overview of GAO’s Past Work on the National Flood Insurance Program.  GAO-14-297R. Washington, D.C.: April 9, 2014.
Flood Insurance: Strategies for Increasing Private Sector Involvement.  GAO-14-127. Washington, D.C.: January 22, 2014.
National Flood Insurance Program: Progress Made on Contract  Management but Monitoring and Reporting Could Be Improved. GAO-14- 160. Washington, D.C.: January 15, 2014.
Flood Insurance: More Information Needed on Subsidized Properties.  GAO-13-607. Washington, D.C.: July 3, 2013.
FEMA: Action Needed to Improve Administration of the National Flood  Insurance Program. GAO-11-297. Washington, D.C.: June 9, 2011.
section_title: Managing Risks and Improving VA Health Care
subsections: section_title: Why Area Is High Risk
paragraphs: Since designating Department of Veterans Affairs (VA) health care as a  high-risk area in 2015, we continue to be concerned about VA’s ability to  ensure its resources are being used cost-effectively and efficiently to  improve veterans’ timely access to health care, and to ensure the quality  and safety of that care. VA’s Veterans Health Administration (VHA)  operates one of the largest health care delivery systems in the nation,  with 168 medical centers and more than 1,000 outpatient facilities  organized into regional networks. VA has faced a growing demand by  veterans for its health care services—due, in part, to servicemembers  returning from the United States’ military operations in Afghanistan and  Iraq and the needs of an aging veteran population—and that trend is  expected to continue. For example, the total number of veteran enrollees  in VA’s health care system rose from 7.9 million to almost 9 million from  fiscal year 2006 through fiscal year 2016. Over that same period, VHA’s  total budgetary resources have increased substantially, from $37.8 billion  in fiscal year 2006 to $91.2 billion in fiscal year 2016.
Although VA’s budget and the total number of medical appointments  provided have substantially increased for at least a decade, there have  been numerous reports in this same period of time—by us, VA’s Office of  the Inspector General, and others—of VA facilities failing to provide timely  health care. In some cases, the delays in care or VA’s failure to provide  care at all reportedly have resulted in harm to veterans. In response to  these serious and longstanding problems with VA health care, the  Veterans Access, Choice, and Accountability Act of 2014 (Pub. L. No.  113-146, 128 Stat. 1754) was enacted, which provided temporary  authority and $10 billion in funding through August 7, 2017 (or sooner, if  those funds are exhausted) for veterans to obtain health care services  from community (non-VA) providers to address long wait times, lengthy  travel distances, or other challenges accessing VA health care. Under this  authority, VA introduced the Veterans Choice Program in November  2014. The $10 billion is meant to supplement VA’s medical services  budget and is funded through a separate appropriations account, the  Veterans Choice Fund. The 2014 law also appropriated $5 billion to  expand VA’s capacity to deliver care to veterans by hiring additional  clinicians and improving the physical infrastructure of VA’s medical  facilities. agency officials projected a fiscal year 2015 funding gap of about $3  billion in its medical services appropriation account. The projected  funding gap was largely due to administrative weaknesses that slowed  the utilization of the Veterans Choice Program in fiscal year 2015 and  resulted in higher-than-expected demand for VA’s previously established  VA community care programs. In particular, VA officials expected that the  Veterans Choice Program would absorb much of the increased demand  from veterans for health care services delivered by non-VA providers, but  instead the slow utilization resulted in veterans continuing to receive care  through previously established VA community care programs that drew  funds from VA’s medical services appropriation account. To avoid a  projected funding gap in VA’s medical services appropriation account, the  VA Budget and Choice Improvement Act provided VA temporary authority  to use up to $3.3 billion from the Veterans Choice Program appropriation  for obligations incurred for other specified medical services, starting May  1, 2015, until October 1, 2015.
While timely and cost-effective access to needed health care services is  essential, care coordination between VA and community providers, and  between VA and the Department of Defense (DOD) (for transitioning  servicemembers), is also critical to preventing unfavorable health  outcomes for veterans. With the increased utilization of community  providers that has occurred as a result of the Veterans Access, Choice,  and Accountability Act, veterans are required to navigate multiple  complex health care systems—the VA health care system and those of  community providers—to obtain needed health care services. The quality  of veterans’ care may be adversely affected if VA and community  providers do not promptly communicate important clinical information. In  addition, servicemembers transitioning from DOD to VA health care may  experience problems if, for example, VA inappropriately discontinues  medications, such as those for mental health conditions, because of a  lack of clarity in VA’s medication continuation policy, potentially increasing  the risk for adverse health effects.
section_title: What GAO Found
paragraphs: Overall, VA has partially met the criteria for leadership commitment and  an action plan to address the five areas of concern we identified when we  placed VA health care on our High-Risk List in 2015. These five areas of  concern are: (1) ambiguous policies and inconsistent processes; (2)  inadequate oversight and accountability; (3) information technology (IT)  challenges; (4) inadequate training for VA staff; and (5) unclear resource  needs and allocation priorities. VA has not met the other criteria for  removal: capacity to address the areas of concern, monitoring  implementation of corrective actions, and demonstrating progress.
Although we concluded in our overall assessment that VA’s actions  partially met two of our five criteria for removal from the High-Risk List, it  is worth noting that the department made significantly less progress in  addressing the action plan criterion than it has in demonstrating  leadership commitment. Specifically, VA partially met the action plan  criterion for only one of the five areas of concern—ambiguous policies  and inconsistent processes—whereas VA partially met the leadership  commitment criterion for four out of five areas of concern (VA did not  meet the leadership commitment criterion for inadequate training for VA  staff). The department must make significant progress on the action plan  criterion for all five areas of concern we identified in order to meet this  criterion for removal from our High-Risk List.
VA officials have expressed their commitment to addressing the  department’s High-Risk List designation, and have taken actions such as  establishing a task force, working groups, and a governance structure for  addressing the issues contributing to the designation. For example, in  July 2016, VA chartered the GAO High-Risk List Area Task Force for  Managing Risk and Improving VA Health Care (task force) to develop and  oversee implementation of VA’s plan to address the root causes of the  five areas of concern we identified. VHA’s Deputy Under Secretary for  Health (USH) for Organizational Excellence serves as the executive  agent for the task force, with support from a combination of permanent  and temporary staff. This senior VHA position was created in 2015 and is  responsible for overseeing offices focused on assessing and improving  health care quality and safety, providing VA leadership with analytics to  assess VHA’s performance, and addressing issues related to public trust  and integrity. For each of the five areas of concern we identified, VA has  established a working group with two senior-level VA officials as leaders.  These workgroups and officials are responsible for developing and  executing VA’s high-risk mitigation plan for each of our five areas of  concern.
VA has also contracted with two entities to support VA’s actions to  address the high-risk designation. The first contract—with a Federally  Funded Research and Development Center operated by the MITRE  Corporation—is focused on (1) developing and executing an action plan,  (2) creating a plan to enhance VA’s capacity to manage High-Risk List  areas, and (3) recommending changes to the organizational structure VA  set up to address the high-risk designation. The total contract value is  $5.2 million, with an 8-month performance period that began on June 20,  2016 and 1 option year. The second contract—with Atlas Research,  LLC—is for project management staff who will help establish a program  executive office within the office of the VHA Deputy USH for  Organizational Excellence, and assist with establishing the management  functions necessary to oversee the five high-risk area working groups.  The total contract value is $2.6 million, with a 1-year performance period  that began on September 9, 2016 and the option to extend services for up  to 6 additional months.
Since we added VA health care to our High-Risk List in 2015, VA’s  leadership has increased its focus on implementing our  recommendations. Between January 2010 and February 2015 (when we  designated VA health care as a high-risk area), we issued products  containing 178 recommendations related to VA health care. When we  made our designation in 2015, the department had only implemented  about 22 percent of them—39 of the 178 recommendations. In the last 2  years, VA has made good progress, but additional work is needed. Since  we designated VA health care as a high-risk area, we have made 66 new  recommendations related to VA health care, for a total of 244  recommendations from January 1, 2010 through December 31, 2016. VA  has implemented about 50 percent of the recommendations we have  made since 2010—122 of the 244 recommendations. (See table 9.) It is  critical that VA implement our recommendations not only to remedy the  specific weaknesses identified, but because they may be symptomatic of  larger underlying problems that also need to be addressed.
On August 18, 2016, VA provided us with an action plan for addressing  the High-Risk List designation that acknowledged the deep-rooted nature  of the areas of concern we identified, and stated that these concerns  would require substantial time and work to address. Although the action  plan outlined some steps VA plans to take over the next several years to  address its high-risk designation, the overall document did not satisfy the  action plan criterion for removal. Specifically, several sections were  missing actions that support our criteria for removal, such as analyzing  the root causes of the issues and measuring progress with clear metrics.  In our feedback to VHA on drafts of their action plan, we highlighted these  missing actions and also stressed the need for specific timelines and an  assessment of needed resources for implementation. For example, VA  plans to use staff from various sources, including contractors and  temporarily detailed employees, to support their high-risk area working  groups, so it will be important for VA to ensure that these efforts are  sufficiently resourced.
While VA has demonstrated partial leadership commitment in most of the  five areas of concern, significant gaps remain between VA’s stated plans  and its actual progress. This lack of progress is evidenced by findings  from our recent work, which have led us to make new recommendations  that relate to each of the five areas of concern we highlighted in 2015.  (See table 10.)
Managing Risks and Improving VA Health Care Number of  recommendations prior to  GAO high-risk designation  (Jan. 1, 2010 through Feb.  11, 2015)
Number of  recommendations added  since GAO high-risk  designation  (Feb. 11, 2015 through Dec.  31, 2016)
Recommendation counts listed include both implemented and not implemented recommendations as  of the dates indicated.
section_title: What Remains to Be Done
paragraphs: Since we added VA health care to our High-Risk List in 2015, VA has  acknowledged the significant scope of the work that lies ahead. VA took  an important step toward addressing our criteria for removal by  establishing the leadership structure necessary to ensure that actions  related to the High-Risk List are prioritized within the department. It is  imperative, however, that VA maintain strong leadership support as it  completes its transition into a new presidential administration. strategies that link strategic goals to actions and guidance. In addition, VA  will need to demonstrate that it has the capacity to sustain efforts by  devoting appropriate resources—including people, training, and funds—to  address the high-risk challenges we identified.
VA’s action plan for addressing its high-risk designation describes many  planned outcomes with overly ambitious deadlines for completion. We are  concerned about the lack of root cause analyses for most areas of  concern, and the lack of clear metrics and needed resources for  achieving stated outcomes. This is especially evident in VA’s plans to  address the IT and training areas of concern. In addition, with the  increased use of community care programs, it is imperative that VA’s  action plan include a discussion of the role of community care in  decisions related to policies, oversight, IT, training, and resource needs.  We will continue to monitor VA’s institutional capacity to fully implement  and sustain needed changes, including those related to its IT  transformation, comprehensive training management plan, and  resourcing decisions.
Finally, to help address our high-risk designation, VA should continue to  implement our recommendations and recommendations from other  reviews such as the Commission on Care. The Veterans Access, Choice,  and Accountability Act of 2014 established the Commission on Care to  examine, assess, and report on veterans’ access to VA health care and to  strategically examine how best to organize VHA, locate health resources,  and deliver health care to veterans during the next 20 years. The  Commission’s June 2016 report to the President included 18  recommendations to improve veterans’ access to care and, more broadly,  to improve the quality and comprehensiveness of that care. For example,  the Commission recommended that VHA create local, networked systems  of care that integrate VA-based care and community care and remove  restrictions to veterans seeking care from community providers. On  September 1, 2016, the President concurred with 15 of the 18  recommendations and directed VA to implement them. including its policy development and dissemination process; controls and  oversight for controlled substances; Veterans Choice Program  implementation; physician recruitment and retention; the process for  enrolling veterans in VA health care. In particular, the following selected  recommendations require VA’s immediate attention:  improving oversight of access to timely medical appointments,  including the development of wait-time measures that are more  reliable and not prone to user error or manipulation, as well as  ensuring that medical centers consistently and accurately implement  VHA’s scheduling policy.  improved oversight of VA community care to ensure—among other  things—timely payment to community providers.  improved planning, deployment and oversight of VA/VHA IT systems,  including identifying outcome-oriented metrics and defining goals for  interoperability with DOD. ensuring that recommendations resulting from internal and external  reviews of VHA’s organizational structure are evaluated for  implementation. This process should include the documentation of  decisions and assigning officials or offices responsibility for ensuring  that approved recommendations are implemented.
It is critical that Congress maintain its focus on oversight of VA health  care to help address this high-risk area. Congressional committees  responsible for authorizing and overseeing VA health care programs held  more than 70 hearings in 2015 and 2016 to examine and address VA  health care challenges. In addition, as VA continues to change its health  care service delivery in the coming years, some changes may require  congressional action—such as VA’s planned consolidation of community  care programs after the Veterans Choice Program expires. Sustained  congressional attention to these issues will help ensure that VA continues  to improve its management and delivery of health care services to  veterans.
section_title: Additional Details on What GAO Found
subsections: section_title: Ambiguous Policies and Inconsistent Processes
paragraphs: When we designated VA health care as a high-risk area in 2015, we  reported that ambiguous VA policies led to inconsistent processes at local  VA medical facilities. Based on actions taken since 2015, VA has partially  met our criteria for removal for its leadership commitment and action plan.  However, VA has not met our criteria for removal for capacity, monitoring,  and demonstrated progress for this area of concern.
subsections: section_title: Leadership Commitment
paragraphs: one example of an action that would contribute to meeting the leadership  commitment criterion for removal from our High-Risk List.
section_title: Capacity
paragraphs: VA has not met the capacity criterion because of significant gaps between  its stated goals and the resources available to achieve them. VA’s high- risk working group on ambiguous policies and inconsistent processes is a  first step towards establishing the capacity necessary to address this area  of concern. VA has allocated staff and awarded contracts to support the  department’s overall high-risk effort, but its action plan for this area does  not explain how VA will allocate staff and resources to support its plans to  address ambiguous policies and inconsistent processes, such as the  professional policy writers VA states it needs to ensure consistent policy  content and quality.
Other actions VA needs to take to demonstrate capacity in this area of  concern include maintaining procedures that have recently been  established; training appropriate staff in policy development,  implementation, and oversight; and addressing gaps such as unofficial  policy documents. One example of unofficial policy is memoranda sent by  the VHA Deputy USH for Operations and Management to regional  network offices and VA medical centers. These memoranda are treated  as new policy, but they have not been vetted by other VA offices,  potentially creating confusion at the local level between mandatory and  suggested actions.
section_title: Action Plan
paragraphs: fully-established policy revision process in place, or the professional  policy writers available to revise policies, VA cannot effectively meet  these milestones. VA needs to use the root cause analysis results to  develop more realistic milestones and metrics for this area, and ensure  that critical actions and outcomes are prioritized given any identified  limitations in capacity.
section_title: Monitoring
paragraphs: VA has not met the monitoring criterion for our concerns related to  ambiguous policies and inconsistent processes. VA has many planned  actions that have not yet been implemented, including plans to ensure  policy is implemented consistently at local and national levels, as well as  plans to identify and address unofficial sources of policy. We also have  continued to find evidence in our recent work of inconsistencies in policy  application that will need to be addressed to show that VA is monitoring  policies. For example, we highlighted the inconsistent application of  policies in two recent reports examining mental health and primary care  access at VA medical facilities in 2015 and 2016, respectively. In both  reports, we found wide variation in the time that veterans waited for  primary and mental health care, which was in part caused by a lack of  clear, updated policies for scheduling—therefore, we recommended that  VA update these policies. These ambiguous policies contributed to errors  made by appointment schedulers, which led to inconsistent and unreliable  wait-time data. For mental health, we also found that two policies  conflicted, leading to confusion among VA medical center staff as to  which wait-time policy to follow. In 2015, VA resolved this policy conflict  by revising its mental health handbook, but other inconsistent applications  of mental health policy have not yet been addressed, such as our  recommendation to issue guidance about the definitions used to calculate  veteran appointment wait times, and communicate any changes to those  definitions within and outside VHA.
section_title: Demonstrated Progress
paragraphs: VA has not met the demonstrated progress criterion for removal. We are  unable to assess VA’s actions in this area because without the clear  milestones and metrics necessary to track performance, VA cannot  demonstrate that its actions are linked to identified root causes and that it  is effectively managing this area of concern. We have ongoing work  examining VA’s actions to ensure that policies related to veterans’ health  care are consistently communicated and implemented, and we will  continue to monitor VA’s progress in this area.
section_title: Inadequate Oversight and Accountability
paragraphs: In our 2015 high-risk report, we found that VA has had problems holding  its facilities accountable for their performance because it relied on self- reported data from facilities, its oversight activities were not sufficiently  focused on compliance, and it did not routinely assess policy  implementation. VA has partially met the leadership commitment criterion  for this area of concern because it established a high-level governance  structure and adopted a new model to guide the department’s oversight  and accountability activities. However, VA has not met our criteria for  removal for capacity, action plan, monitoring, or demonstrated progress  because the department continues to rely on existing processes that  contribute to inadequate oversight and accountability.
subsections: section_title: Leadership Commitment
paragraphs: yet approved the draft directive establishing this office and authorizing it  to carry out its planned functions.
section_title: Capacity
paragraphs: VA has not taken sufficient actions to meet the capacity criterion for  removing this area of concern from our High-Risk List. Although VA has  begun to allocate staff and resources by establishing the VHA office of  the Assistant Deputy USH for Integrity, the success of its new oversight  and accountability model depends on establishing consistent policies and  ensuring that staff at all levels are complying with them. VA staff will need  sufficient guidance and training to address skills gaps and to correct  identified deficiencies, and VA’s new office of Internal Audit and Risk  Assessment (a key component of its new oversight and accountability  model) will need to be fully resourced, staffed, and operational. In  addition, VA identified a need for increased training in ethics, as well as a  need for staff with this specific expertise at the local level. However, VA’s  action plan does not discuss how these actions will be resourced,  including hiring staff or obtaining other resources necessary to ensure  that such knowledge is in place.
section_title: Action Plan
paragraphs: VA also has not met the action plan criterion for addressing our concerns  about oversight and accountability. In its action plan, VA identifies root  causes based on an “environmental analysis” of its health care oversight  structure, such as the lack of a formal audit capacity. However, the  identified root causes are not linked to clear milestones, metrics, or  processes for reporting on progress. VA plans to include metrics in every  new or revised policy to allow officials to determine whether the policy is  being appropriately implemented and meets objectives. However, as  described earlier, VHA’s new policy development and revision process is  still in its early stages. Without clear milestones and metrics linked to root  causes of the problem, VA cannot assess its implementation status or  demonstrate progress against goals. For example, in our May 2016 report  on the Veterans Crisis Line (a 24-hour telephone line staffed by  responders who assist veterans in emotional crisis), we found VA  established key performance indicators to evaluate crisis line operations  but had no measureable targets or time frames established for their  completion. One of the indicators related to rate at which crisis line callers  abandoned their calls prior to speaking with a responder, but VA did not  set a minimum or ideal performance target for this indicator. We  recommended that VA document clearly stated and measurable targets  and time frames for key performance indicators needed to assess  Veterans Crisis Line performance, in order to improve the timeliness and  quality of crisis line responses to veterans.
section_title: Monitoring
paragraphs: VA has not met the criterion for monitoring its progress in improving  oversight and accountability. VA’s action plan for this area of concern  does not explain how it will ensure that medical facilities are consistently  reporting reliable data, which is critical to monitoring actions. We have  continued to find instances where VA lacked reliable data to determine  whether its medical centers were following policies, which will continue to  make it difficult for VA to monitor improved oversight and accountability.  For example, in 2015, as part of our review of VA’s primary care  oversight, we found inaccuracies in VA’s data on primary care panel  sizes, which are used to help medical centers manage their workload and  ensure that veterans receive timely and efficient care. We found that  while VA’s primary care panel management policy requires facilities to  ensure the reliability of their panel size data, it does not assign  responsibility for verifying data reliability to regional- or national-level  officials or require them to use the data for monitoring purposes. As a  result, VA could not be assured that local panel size data were reliable, or  whether its medical centers have met VA’s goals for efficient, timely, and  quality care. We recommended that VA incorporate an oversight process  in its primary care panel management policy that assigns responsibility,  as appropriate, to regional networks and central office for verifying and  monitoring panel sizes.
section_title: Demonstrated Progress
paragraphs: safety, and dignity of women veterans when they receive care at VA  medical facilities.
section_title: Information Technology Challenges
paragraphs: In our 2015 high-risk report, we identified limitations in the capacity of  VA’s existing IT systems, including the outdated, inefficient nature of  certain systems and a lack of system interoperability—the ability to  exchange and use electronic health information—as contributors to VA’s  IT challenges related to VA health care. These challenges present risks to  the timeliness, quality, and safety of VA health care. VA has partially met  our leadership commitment criterion by involving top leadership in this  area of concern, but it has not met our four remaining criteria for removing  IT challenges from the High-Risk List.
subsections: section_title: Leadership Commitment
paragraphs: VA has partially met the leadership commitment criterion for addressing  IT challenges. Specifically, VA outlined in its action plan a high-level  governance structure that designates an official within VA’s department- level Office of Information and Technology (OI&T) as responsible for this  area of concern. In addition, VA’s Chief Information Officer (CIO) has  recently initiated an effort to transform the focus and functions of OI&T in  response to the Secretary’s goal of making VA a more veteran-focused  organization. The CIO’s transformation strategy, initiated in January 2016,  calls for the office to stabilize and streamline processes, mitigate  weaknesses highlighted in our assessments, and improve outcomes by  institutionalizing a new set of IT management capabilities. As part of this  transformation, in January 2016, the CIO began transitioning the  oversight and accountability of IT projects to a new project management  process called the veteran-focused integration process, in an effort to  streamline its systems development and delivery of new IT capabilities. intended to serve as OI&T’s portfolio management and project tracking  organization; (2) account management, led by three account managers  responsible for managing the IT needs of VA’s major components; (3)  quality and compliance, responsible for establishing effective policy  governance and standards, and ensuring VA adheres to the policies and  standards; (4) data management, intended to improve both service  delivery and the veteran experience by engaging with data stewards to  ensure the accuracy and security of the information collected by VA; and  (5) strategic sourcing, which is expected to be responsible for establishing  an approach to working with vendors that can supply solutions to VA’s IT  requirements. However, VA is in the early stages of implementing these  new functions, and it will need to sustain leadership commitment by  maintaining OI&T’s transformation through the presidential transition.
section_title: Capacity
paragraphs: VA has not taken sufficient action to demonstrate it has the capacity to  address the IT challenges we identified. VA has extensive IT resources in  terms of staff and funding. In fiscal year 2016, VA’s IT appropriations  were approximately $4.1 billion, and in our August 2016 report on VA’s IT  management, OI&T reported nearly 7,300 federal employees and  approximately 7,800 contractor staff working in support of IT-related  functions. However, VA has not demonstrated improvement in several  capacity actions, such as establishing specific responsibilities for its new  functions, improving collaboration between internal and external  stakeholders, and addressing skill gaps. For example, in our August 2016  report, we found that OI&T was still in the process of fully defining the  roles and responsibilities of its new organizational units, as of July 2016.
With regard to collaboration, VA designated an account manager for VHA  as of May 2016, which has the potential to improve VHA and VA  collaboration on IT needs. However, its August 2016 action plan for IT  challenges describes plans rather than actions already taken to  implement the account management function. In addition, we have  repeatedly reported on the importance of VA working with DOD to  achieve electronic health record interoperability. In August 2015, we  reported on the status of these interoperability efforts and noted that the  departments have engaged in several near-term efforts focused on  expanding interoperability between their existing electronic health record  systems. However, we were concerned by the lack of outcome-oriented  goals and metrics that would more clearly define what VA and DOD aim  to achieve from their interoperability efforts. Accordingly, we  recommended that the departments establish a time frame for identifying  outcome-oriented metrics and define related goals for achieving  interoperability.
Finally, in our August 2016 report, we found that while OI&T conducted  annual skill gap analyses and developed training courses, and  recommended other actions for addressing these gaps, the office had not  identified potential gaps that may exist in future years. This led us to  recommend that OI&T identify IT skills needed beyond the current fiscal  year to assist in identifying future skill gaps. By focusing on the current  year, OI&T may not be aware of skill gaps that need to be filled to assure  its staff can deliver long-term IT support that contributes to improved  services for veterans.
section_title: Action Plan
paragraphs: VA has not met the action plan criterion for addressing the IT challenges  we identified. VA’s action plan for this area provides a descriptive problem  statement—reflecting our previously stated concerns—and high-level  information about VA-wide IT strategies and initiatives. However, it does  not contain a root cause analysis that would help identify and prioritize  critical actions and outcomes to address IT challenges. As a result, VA’s  stated milestones and dates appear unrealistic and disconnected from the  challenges identified. For example, VA set a goal of having 50 percent of  its active IT projects on budget and on schedule by the end of 2016, but it  does not state what supporting actions and processes would be  necessary to achieve this ambitious goal. Also, without a root cause  analysis, VA cannot be certain this action will address its IT challenges. A  significant concern we identified in our August 2015 report on VA’s and  DOD’s interoperability efforts is that the two departments had not  identified outcome-oriented goals and metrics that would more clearly  define what they aim to achieve from their interoperability efforts and the  value and benefits these efforts are intended to yield.
section_title: Monitoring
paragraphs: VA has not met the criterion related to monitoring actions to address IT  challenges. Without outcome-oriented goals and metrics to measure  progress, VA cannot demonstrate that it is effectively monitoring  implementation and tracking progress against goals. As we have stressed  in our prior work, assessing the performance of a program should include  measuring its outcomes in terms of the desired results of products or  services. In this case, such outcomes could include improving the quality  of health care or clinician satisfaction. Establishing outcome-oriented  goals and metrics is essential to determining whether a program is  operating as intended and delivering value.
section_title: Demonstrated Progress
paragraphs: sustained. A key action within the criterion for demonstrated progress is  implementing recommendations. We have made several  recommendations to VA to address outdated systems such as its  scheduling and community care claims processing systems, but VA has  not yet implemented these recommendations. For example, in May 2016,  we recommended that VA develop a sound plan for modernizing its  claims processing system. We found that, due to recent increases in  utilization of community care, VA has had difficulty with the timely  processing of claims from community providers and the contractors  responsible for administering the Veterans Choice Program. VA officials  and claims processing staff indicated that IT limitations, manual  processes, and staffing challenges had delayed claims processing. The  department had implemented interim measures to address some of the  system’s challenges, but it did not expect to deploy solutions to address  all challenges, including those related to IT, until fiscal year 2018 or later.
section_title: Inadequate Training for VA Staff
paragraphs: When identifying this area of concern in our 2015 high-risk report, we  described several gaps in VA’s training, as well as burdensome training  requirements, that we found in our prior work. Since we issued the 2015  report, VA has expressed its desire to improve the department’s  standardization and management of training, but has not met any of our  criteria for removing this area of concern from the High-Risk List.
subsections: section_title: Leadership Commitment
paragraphs: process, VA’s action plan states that it will set goals that enable VA  medical center involvement in training planning, but those goals are not  fully articulated in the document. The high-level nature of the descriptions  in the action plan and lack of action to update outdated policies and set  goals for improving training shows that VA lacks leadership commitment  to address the concerns that led to our inclusion of this area in the 2015  high-risk report.
section_title: Capacity
paragraphs: VA also has not demonstrated that it has the capacity to address our  concerns regarding inadequate training. Since identifying these concerns  in our 2015 high-risk report, we have continued to find VA health care  training gaps that need to be addressed. VA needs to determine the  resources needed, actions required, and systems that need to be  established to support improvements in how it manages training.
In our September 2015 report on nurse recruitment and retention, for  example, we found that VA did not know whether its medical center staff  had sufficient training to support its national initiatives to recruit and retain  nurses. As a result, we recommended that VA evaluate the adequacy of  these training resources to help ensure the effective recruitment and  retention of nurses across VA medical centers. In our December 2016  report on VHA’s human resources (HR) capacity, we found that VA’s  competency assessment tool did not address two of the three personnel  systems under which VHA staff may be hired. We recommended that  VHA (1) develop a comprehensive competency assessment tool for HR  staff that evaluates knowledge of all three of VHA’s personnel systems  and (2) ensure that all VHA HR staff complete it so that VHA may use the  data to identify and address competency gaps among HR staff. Without  such a tool, VHA will have limited insights into the abilities of its HR staff  and be ill-positioned to provide necessary support and training.
section_title: Action Plan
paragraphs: VA also has not met the action plan criterion for this area of concern. In  its action plan, VA identified an outdated 2002 policy and a decentralized  approach to training as potential root causes of the lack of effective  training management and oversight we previously identified. VA did not,  however, take the additional steps in its action plan of conducting an  analysis to confirm its assumptions. It is also not clear from the action  plan whether VA plans to establish clear milestones and metrics to review  and measure its progress in addressing the root causes of inadequate  training for VA staff.
section_title: Monitoring
paragraphs: measures and its progress against goals. One key monitoring action is  reporting on program progress to senior managers. VA’s action plan for  this area states that VHA leadership, including the VHA Under Secretary  for Health, will review and approve an annual training plan, but the action  plan does not describe what data will support that review, and how it will  define progress against goals.
section_title: Demonstrated Progress
paragraphs: Because VA’s comprehensive training management strategy is in the  early stages of development, VA has not met the criterion for  demonstrated progress in addressing this high-risk area of concern.  Without clear priorities and goals for improving training, an action plan  with clear milestones and metrics, and data to support reports on  progress, it is not possible for VA to demonstrate progress in effectively  addressing this area.
section_title: Unclear Resource Needs and Allocation Priorities
paragraphs: In our prior work, we reported on gaps in the availability of data needed  for VA to identify the resources it needs and ensure they are effectively  allocated across VA’s health care system. We included this area of  concern when we designated VA health care as a high-risk area in 2015.  Over the past 2 years, VA’s actions have partially met our criterion for  leadership commitment but not met the other four criteria for removing  this area of concern from the High-Risk List.
subsections: section_title: Leadership Commitment
paragraphs: cycles. However, VA’s planned actions do not make clear how VHA, as  the agency managing VA health care, is or will be incorporated into VA’s  department-level framework, or how that framework will be communicated  and reflected at the regional network and medical center levels. Actions  that will assist VA in demonstrating progress in leadership commitment  for this area of concern include clarifying the role and responsibilities of  VHA in the Managing for Results framework, and ensuring continued  oversight and accountability of the framework’s implementation.
section_title: Capacity
paragraphs: VA has not met our criterion for capacity for this area of concern. In its  action plan, VA names several initiatives that are underway to enable  Managing for Results, including establishing a mission-requirements- planning function to supply the ground rules and assumptions necessary  to inform cost analysis of major VA initiatives. However, VA does not  explain how it intends to establish the mission-requirements-planning  function, or what resources may be necessary to establish and maintain  that function at the national and local levels. Understanding the resources  necessary to establish a new process can help to identify skills gaps and  training that VA staff may need to facilitate implementation.
section_title: Action Plan
paragraphs: VA has not met our action plan criterion for this area of concern because  it has not established performance measures based on a root cause  analysis of its unclear resource needs and allocation priorities. VA’s  action plan states that the fragmented nature of the department’s data  and information management systems limits its ability to integrate  priorities, requirements, and solutions. While Managing for Results is  intended to facilitate that integration, the action plan does not contain an  analysis or explanation for how VA determined that fragmented systems  was a cause of unclear resource needs and allocation priorities, or how  their chosen framework would address that cause. As a result, VA lacks  reasonable assurance that planned actions are addressing the root cause  of the problem. correspond to all of its strategic goals and objectives, VHA’s regional  networks and medical centers had limited guidance to help them  operationalize VA’s strategic goals and objectives. Moreover, the day-to- day activities and initiatives developed by VHA regional networks and  medical centers may not appropriately align with national goals and  objectives for VA health care. Directly aligning strategic goals and their  associated strategies is important in assessing an organization’s ability to  achieve those goals.
section_title: Monitoring
paragraphs: VA has not met our criteria for monitoring because its planned actions do  not address our previously stated concerns about data quality. VA’s  planned actions to address unclear resource needs and allocation  priorities include incorporating information from VHA’s resource allocation  model, enrollment projection model, and health care staffing utilization  data to improve the accuracy of its resource decisions. However, we have  described our concerns about the accuracy of data used for health care  resourcing decisions in our 2015 high-risk report, as well as in our June  2016 report examining VA’s projected fiscal year 2015 funding gap. In the  2016 report, we found that VA’s weaknesses in estimating costs and  tracking obligations as use of VA’s community care programs increased  was one reason for VA’s projected funding gap. To better align cost  estimates for community care services with associated obligations, we  reported that VA was examining options for replacing its outdated  financial IT systems, a plan that is reiterated in VA’s high-risk action plan,  with a projected completion date of fiscal year 2020. However, VA’s high- risk action plan states that updating its financial management system will  only partly address the capability gap associated with having the systems  necessary to extract cost data. VA has made previous, unsuccessful,  attempts to update its financial IT systems. To show progress in  monitoring actions, VA will need to ensure data quality and regularly  review its status and performance compared to its goals.
section_title: Demonstrated Progress
paragraphs: care to the nation’s veterans will improve. We recommended that VA  develop a process to ensure that it evaluates organizational structure  recommendations resulting from internal and external reviews of VHA.  This process should include documenting decisions and assigning  officials or offices responsibility for ensuring that approved  recommendations are implemented. Such a process will help VA ensure  that it is using resources efficiently, monitoring and evaluating  implementation, and holding officials accountable.
section_title: Benefits Achieved by Implementing Our Recommendations
paragraphs: Both Congress and VA have taken action to address our high-risk  designation. In July 2015, the VA Budget and Choice Improvement Act  directed VA to, among other things, include in its annual budget  submission a new appropriations account for medical care delivered by  community providers. Beginning in fiscal year 2017, Congress began  funding community care through this new Medical Community Care  appropriations account. This should allow VA to better ensure that  sufficient funds are available for community care in the future.
In November 2014, we reviewed data that VA collects on veteran  suicides. We found that the data were not always complete, accurate,  or consistent because the medical centers we reviewed differed in  how they interpreted and used templates for collecting the data. We  made six recommendations, including that VA clarify guidance on how  to complete these templates and ensure that medical centers have a  process to review them. In response, VA took several actions in 2015,  including analyzing diagnostic coding practices at medical centers,  adding more specific guidance on how to complete the templates, and  requiring medical center leadership to review the templates. These  actions positioned VA to collect consistent data to better inform its  suicide prevention efforts, and we closed all six report  recommendations as implemented in fiscal year 2016. centers to assess the degree they were using alternative processes to  address the root causes of adverse events when a root cause  analysis is not required. By collecting this information, VA increased  its awareness of medical center actions to address the root causes of  adverse events.
For our 2011 review of VA’s purchasing, tracking, and reprocessing of  expendable medical supplies (e.g., needles) and reusable medical  equipment (e.g., endoscopes), we examined VA’s requirements as  well as VA central office and regional network oversight processes.  We found that both the tracking and reprocessing requirements we  reviewed were inadequate to help ensure the safety of veterans who  receive care at medical centers. We also found that VA central office  did not analyze regional network reports on noncompliance with  reusable medical equipment policies to inform its oversight. As such,  we made four recommendations, including that VA develop and  implement an approach for providing standardized training for  reprocessing reusable medical equipment; hold VAMCs accountable  for implementing the training; and use the regional network reports of  noncompliance to take action to improve compliance in areas such as  those that occur frequently, pose high risks to veterans’ safety, or  have not been addressed. In 2015 and 2016, VA took action to  require standardized training for reprocessing reusable medical  equipment and oversight of reprocessing activities, issue guidance to  clarify regional networks’ oversight responsibility, and identify areas of  noncompliance that occur frequently and issue guidance to help  address this noncompliance. All recommendations from this report  have been closed as implemented.
section_title: GAO Contacts
paragraphs: For additional information about this high-risk area, contact Debra Draper  at (202) 512-7114 or draperd@gao.gov, or Randall Williamson at (202)  512-7114 or williamsonr@gao.gov.
section_title: Related GAO Products
paragraphs: Veterans Health Administration: Management Attention Is Needed to  Address Systemic, Long-standing Human Capital Challenges.  GAO-17-30. Washington, D.C.: December 23, 2016.
VA Health Care: Improved Monitoring Needed for Effective Oversight of  Care for Women Veterans. GAO-17-52. Washington, D.C.: December 2,  2016.
Veterans Health Care: Improvements Needed in Operationalizing  Strategic Goals and Objectives. GAO-17-50. Washington, D.C.: October  21, 2016.
VA Health Care: Processes to Evaluate, Implement, and Monitor  Organizational Structure Changes Needed. GAO-16-803. Washington,  D.C.: September 27, 2016.
Veterans’ Health Care: Improved Oversight of Community Care  Physicians’ Credentials Needed. GAO-16-795. Washington, D.C.:  September 19, 2016.
VA IT Management: Organization Is Largely Centralized; Additional  Actions Could Improve Human Capital Practices and Systems  Development Processes. GAO-16-403. Washington, D.C.: August 17,  2016.
Veterans Affairs: Sustained Management Attention Needed to Address  Numerous IT Challenges. GAO-16-762T. Washington, D.C.: June 22,  2016.
VA’s Health Care Budget: In Response to a Projected Funding Gap in  Fiscal Year 2015, VA Has Made Efforts to Better Manage Future  Budgets. GAO-16-584. Washington, D.C.: June 3, 2016.
Veterans Crisis Line: Additional Testing, Monitoring, and Information  Needed to Ensure Better Quality Service. GAO-16-373. Washington,  D.C.: May 26, 2016.
Veterans’ Health Care: Proper Plan Needed to Modernize System for  Paying Community Providers. GAO-16-353. Washington, D.C.: May 11,  2016.
VA Health Care: Actions Needed to Improve Newly Enrolled Veterans’  Access to Primary Care. GAO-16-328. Washington, D.C.: March 18,  2016.
DOD and VA Health Care: Actions Needed to Help Ensure Appropriate  Medication Continuation and Prescribing Practices. GAO-16-158.  Washington, D.C.: January 5, 2016.
VA Mental Health: Clearer Guidance on Access Policies and Wait-Time  Data Needed. GAO-16-24. Washington, D.C.: October 28, 2015.
VA Primary Care: Improved Oversight Needed to Better Ensure Timely  Access and Efficient Delivery of Care. GAO-16-83. Washington, D.C.:  October 8, 2015.
VA Health Care: Oversight Improvements Needed for Nurse Recruitment  and Retention Initiatives. GAO-15-794. Washington, D.C.: September 30,  2015.
Electronic Health Records: Outcome-Oriented Metrics and Goals Needed  to Gauge DOD’s and VA’s Progress in Achieving Interoperability.  GAO-15-530. Washington, D.C.: August 13, 2015.
section_title: Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland
subsections: section_title: Why Area Was High Risk
paragraphs: Since 2015, the Program Manager (Program Manager) for the Information  Sharing Environment (ISE) and key departments and agencies have  made significant progress to strengthen how intelligence on terrorism,  homeland security, and law enforcement, as well as other information  (collectively referred to in this section as terrorism-related information) is  shared among federal, state, local, tribal, international, and private sector  partners. As a result, the Program Manager and key stakeholders have  met all five criteria for addressing our high risk designation, and we are  removing this issue from our High-Risk List. While this progress is  commendable, it does not mean the government has eliminated all risk  associated with sharing terrorism-related information. It remains  imperative that the Program Manager and key departments and agencies  continue their efforts to advance and sustain the ISE. Continued oversight  and attention is also warranted given the issue’s direct relevance to  homeland security as well as the constant evolution of terrorist threats  and changing technology. As we have with areas previously removed  from the High-Risk List, we will continue to monitor this area, as  appropriate, to ensure that the improvements are sustained. If significant  problems again arise, we will consider reapplying the high risk  designation. terrorism-related information. Figure 22 depicts the relationship between  the various stakeholders and disciplines involved with the sharing and  safeguarding of terrorism-related information through the ISE.
section_title: What GAO Found
paragraphs: The federal government has made significant progress in promoting the  sharing of information on terrorist threats, and has met all of our criteria  for removal from the High-Risk List. The Program Manager and key  departments and agencies met the leadership commitment and capacity  criteria in 2015, and have subsequently sustained efforts in both these  areas. For example, the Program Manager clearly articulated a vision for  the ISE that reflects the government’s terrorism-related information  sharing priorities. Key departments and agencies also continued to  allocate resources to operations that improve information sharing,  including developing better technical capabilities.
Implementation Plan (Implementation Plan), which includes the overall  strategy and more specific planning steps to achieve the ISE. Further,  they have demonstrated that various information sharing initiatives are  being used across multiple agencies as well as state, local, and private  sector stakeholders. For example, the Project Manager has developed a  comprehensive framework for managing enterprise architecture to help  share and integrate terrorism-related information among multiple  stakeholders in the ISE. Specifically, the Project Interoperability initiative  includes technical resources and other guidance that promote greater  information system compatibility and performance. Furthermore, the key  departments and agencies have applied the concepts of the Project  Interoperability initiative to improve mission operations by better linking  different law enforcement databases, and facilitating better geospatial  analysis, among other things. accomplishments (e.g., related to maritime domain awareness) where the  Program Manager helped connect previously incompatible information  systems. The Program Manager has also partnered with DHS to create  an Information Sharing Measure Development Pilot that intends to better  measure the effectiveness of information sharing across all levels of the  ISE.
Further, the Program Manager and key departments and agencies have  used the Implementation Plan to track progress, address challenges, and  substantially achieve the objectives in the National Strategy for  Information Sharing and Safeguarding. The Implementation Plan contains  16 priority objectives, and by the end of fiscal year 2016, 13 of the 16  priority objectives were completed. The Program Manager transferred the  remaining 3 objectives, which were all underway, to other entities with the  appropriate technical expertise to continue implementation through fiscal  year 2019.
In our 2013 high-risk update, we listed nine action items that were critical  for moving the ISE forward. In that report, we determined that two of  those action items—demonstrating that the leadership structure has the  needed authority to leverage participating departments, and updating the  vision for the ISE—had been completed. In our 2015 update, we  determined that the Program Manager and key departments had  achieved four of the seven remaining action items—demonstrating that  departments are defining incremental costs and funding; continuing to  identify technological capabilities and services that can be shared  collaboratively; demonstrating that initiatives within individual departments  are, or will be, leveraged to benefit all stakeholders; and demonstrating  that stakeholders generally agree with the strategy, plans, time frames,  responsibilities, and activities for substantially achieving the ISE.
For the 2017 update, we determined that the remaining three action items  have been completed: establishing an enterprise architecture  management capability; demonstrating that the federal government can  show, or is more fully developing a set of metrics to measure, the extent  to which sharing has improved under the ISE; and demonstrating that  established milestones and time frames are being used as baselines to  track and monitor progress. Achieving all nine action items has, in effect,  addressed our high-risk criteria.
Manager, departments, and agencies. Although no longer a high-risk  issue, sharing terrorism-related information remains an area with some  risk and continues to be vitally important to homeland security, requiring  ongoing oversight as well as continuous improvement to identify and  respond to changing threats and technology. Table 11 summarizes the  Program Manager’s and key departments’ and agencies’ progress in  achieving the action items.
section_title: Additional Details on What GAO Found
subsections: section_title: Leadership Commitment
paragraphs: In our 2013 high-risk update, we reported that the federal government  had fundamentally met this high-risk criterion—primarily because it had  established an interagency policy committee to leverage the efforts of  participating departments and agencies. In addition, the Program  Manager has continued to update the vision for the ISE as information  sharing initiatives have evolved. Further, since 2013, the government has  issued and largely executed the Implementation Plan and taken other  actions, which demonstrate continued leadership commitment.
With the majority of Implementation Plan priority objectives completed in  fiscal year 2016, the Program Manager has updated the vision and led  the establishment of new goals to strengthen the ISE. For example, now  that terrorism-related information sharing among key federal departments  and agencies has matured, the Program Manger is expanding  collaboration on information sharing initiatives with state, local, tribal,  territorial, and private sector partners. This includes promoting the use of  interoperable systems and disseminating best practices for sharing and  safeguarding information. According to the Program Manager, this  expanded stakeholder engagement is necessary given the increasing  overlap of national security and public safety. assumed key roles in governing ISE activities. The SCC is the focal point  for advancing core interoperability frameworks and standards, and the  CICC is a key forum for federal and non-federal entities to develop,  implement, and align information sharing platforms, according to the 2016  Information Sharing Environment Annual Report to the Congress. In  addition, the SCC and CICC will have key roles in overseeing the three  Implementation Plan priority objectives not completed in fiscal year 2016.  Updating the vision for the ISE, including the expanded leadership roles  for entities like the SCC and CICC, helps ensure terrorism-related  information is accessible and identifiable to relevant federal, state, local,  private, and foreign partners.
As we reported in 2015, key departments and agencies have also played  an increased leadership role by serving as stewards for the priority  objectives in the Implementation Plan. For example, DHS led the  implementation of the priority objective on fusion centers, which was  completed in fiscal year 2015, and has continued to lead efforts in this  area as the vision for the ISE evolves. Additionally, departments and  agencies have taken various actions to govern their own information  sharing activities and to coordinate with the ISE. For example, DHS has  used a governance board to serve as the decision-making body for DHS  information-sharing issues since 2007. This board has identified  information-sharing gaps and has developed a list of key initiatives to help  address those gaps. Many of these initiatives—such as those related to  safeguarding information—are consistent with established priorities for  the ISE.
section_title: Capacity
paragraphs: Among other things, the federal government met this high-risk criterion in  2015 by changing its approach to funding information-sharing activities.
Specifically, key departments are funding ISE-related activities as part of  mission activities and operations instead of seeking separate funds.  Additionally, the Implementation Plan defines the fundamental  technological capabilities and services for advancing the ISE. The  Program Manager and key departments and agencies also satisfied this  high-risk criterion through their progress in identifying technological  capabilities and services that can be shared collaboratively within and  across the ISE, consistent with a federated architecture approach.
As we reported in 2015, regarding the government’s approach to funding,  senior officials in each key department or agency explained that any  incremental costs related to implementing the ISE continue to be  embedded within each department’s mission activities and operations and  do not require separate funding. The Program Manager and department  and agency officials also noted that the Implementation Plan assigned  priority objectives to those departments and agencies whose missions  most align with the initiatives under each objective, thereby helping to  ensure that the activities received funding. begun to adopt these standards, an important step in developing federal  capabilities to establish individual accountability and facilitate the  appropriate level of information access.
There are multiple priority objectives in the Implementation Plan that  further the capacity to identify and share technical capabilities within and  across the ISE. For instance, the priority objective on discovering and  accessing information addresses the ability to discover that information  exists and retrieve it. According to the results of a 2014 questionnaire  administered by the Office of the Program Manager, over 80 percent of  agencies reported improvements over the previous year in their ability to  discover, access, and retrieve information necessary to accomplish their  missions. As of December 2016, the remaining milestones associated  with this priority objective were expected to be completed by fiscal year  2019, according to the Program Manager and key department  documentation.
The Implementation Plan also contains an objective dedicated to  standards-based acquisition, which seeks to ensure that future products  and services are interoperable and can easily exchange and interpret  data. The goal of this objective is to develop common technical standards  to guide all departments and agencies when they acquire new  technologies. The five milestones contained under this objective were  completed in fiscal year 2016, including developing a standards  handbook. The Implementation Plan also identifies capacity-related  activities consistent with a federated architecture approach, such as  identifying technological capabilities and services to be used across  communities of interest. For example, ISE stakeholders developed a  repository of capabilities and services as part of the priority objective on  interoperability. These knowledge resources include a web-based  collection of tools, best practices, and frameworks for improving  information interoperability.
section_title: Action Plan
paragraphs: The government has met this high-risk criterion by developing and largely  executing the Implementation Plan, leveraging information-sharing  initiatives across the government, and improving enterprise architecture  management as recommended in our 2011 report on the ISE.
Developing and executing the Implementation Plan were important steps  for the ISE, and as we have reported, are characteristics that can  enhance the usefulness of national strategies. Specifically, the Program  Manager and key departments and agencies generally agreed with the  plan’s actions and time frames to advance the ISE. Further, the Program  Manager has demonstrated that ISE stakeholders have taken steps to  implement concepts promoted by the Project Interoperability initiative,  including those contained in the Information Interoperability Framework  (I2F).
In addition to identifying key initiatives—such as those intended to control  information access, safeguard information, increase a user’s ability to  search for relevant information, and increase interoperability among data  systems—the Implementation Plan seeks to address gaps in information  sharing that ISE stakeholders identified and that we highlighted in our  2013 and 2015 high-risk reports. For example, the plan establishes a  priority objective dedicated to information sharing with the private sector.  This objective seeks to ensure that processes and procedures are in  place for identifying threats, including those related to cybersecurity and  to critical infrastructure—such as financial institutions, commercial  facilities, and energy production and transmission facilities, among others.  The Program Manger and key departments and agencies reached  agreement on and completed all four milestones associated with the  private sector priority objective by the end of fiscal year 2016. Among  other things, this effort is intended to make appropriate fusion center  products accessible to critical infrastructure owners and operators, and  identify systems tools that provide near real time situational awareness of  critical infrastructure vulnerabilities across the law enforcement and  intelligence communities. survey administered by the Program Manager, numerous agencies also  mentioned that they were leveraging the fusion center information sharing  initiative. Specifically, all agencies that answered the 2014 question  related to fusion center progress reported satisfaction with improvements  made in the last year to enhance the capabilities and performance of the  national network of fusion centers. This included improving how threat  and encounter information is shared between the federal government and  state, local, and private partners. In November 2014, we reported on  federal efforts to improve fusion center capabilities and results.
Additionally, in April 2013, we reported that fusion centers, along with  other field-based information sharing entities, provided a variety of  analytical activities that resulted in benefits, such as intelligence  products. We also recommended that DHS, DOJ, and the Office of  National Drug Control Policy (ONDCP) collaborate to (1) identify practices  that could enhance the coordination and reduce unnecessary overlap  across field-based information sharing entities, and (2) develop a  mechanism that will allow them to hold field-based information-sharing  entities accountable for coordinating with each other. Since our report  DHS, DOJ, and ONDCP have made significant progress toward  addressing our recommendations. Specifically, the three agencies have  taken the necessary steps to assess the extent to which practices that  can enhance coordination are being implemented at fusion centers and  other field-based information sharing entities. They have also developed  a mechanism to hold fusion centers and other field-based information  sharing entities accountable for coordinating their analytical and  investigative activities. However, the FBI has not taken action on our  recommendations for the field-based information sharing entities it leads  and, as a result, the recommendations from our report have not been fully  addressed. milestones associated with establishing aspects of the ISE architecture.  Such milestones include developing Project Interoperability and the I2F,  key elements intended to help link systems across departments to enable  information sharing (i.e., interoperability). For instance, the I2F calls for a  common profile for achieving interoperability among systems, which  among other things, can enable a user to access different departments’ or  agencies’ databases from a single workstation. In March 2014, the  Program Manager issued an initial version of I2F to guide the  implementation of information-sharing capabilities. In 2016, the Program  Manager identified several ongoing initiatives that implemented I2F  concepts. For example, officials from the Office of the Program Manager  provided documentation that illustrated how I2F was used and stated that  the framework helped:  identify security specifications for successfully exchanging data  across various maritime partners to share information via the Maritime  ISE, including services to publish and search for information about a  ship’s location;  create a virtual nationwide event deconfliction system to alert affected  agencies or officers of potential conflicts between officers who are  conducting law enforcement operations at the same time and in close  proximity; and bridge data standards to enhance geospatial exchange capabilities  (e.g., data embedded in maps) among mission partners, such as  homeland security, law enforcement, emergency management, and  public safety.
Information Network, Regional Information Sharing Systems, Law  Enforcement Enterprise Portal, and Intelink-U) are now interoperable,  providing an array of services and information through a simplified sign- on using existing credentials. The Program Manager also stated that  ongoing efforts to improve information sharing have informed future  architecture efforts, including guidance associated with Project  Interoperability 2.0, which is to provide the framework for building the next  generation of the ISE.
The Program Manager has also made progress in using the  Implementation Plan to hold key departments and entities accountable  over time for executing priority objectives and milestones associated with  establishing aspects of the ISE architecture. Specifically, the  Implementation Plan established architecture-related milestones and time  frames to track and monitor progress. Importantly, the Program Manager  and key stakeholders collaborated to create the plan and generally  agreed with its timeframes and delegation of responsibilities to advance  the ISE. In September 2015 and July 2016, the Program Manager  updated us on the status of executing these priority objectives, including  milestones with revised target dates and new entities that will assume  responsibilities to complete the priority objectives, thereby demonstrating  that the priority objectives and milestones are monitored over time. The  Program Manager has not yet demonstrated outcomes associated with all  of the priority objectives because several milestones are not complete.  We will continue to monitor these enterprise architecture activities to  ensure that they are sustained over time.
section_title: Monitoring
paragraphs: The Program Manager and key departments and agencies have made  sufficient progress to meet this high-risk criterion of monitoring by (1)  implementing initiatives that show the extent to which information sharing  has improved under the ISE and (2) continuing to develop metrics and  processes to measure results achieved, both from individual projects and  activities, as well as from the overall ISE. Developing effective  performance metrics for information sharing initiatives is challenging  given the complexity of information sharing, and the Program Manger  acknowledged in 2016 that additional work is needed in this area.  However, considering the collective efforts of the Program Manager’s  performance management framework—including the Implementation  Plan—key departments and agencies, and the ongoing Information  Sharing Measure Development Pilot, we consider this high-risk criterion  to be met.
The Program Manager has created a performance management  framework to measure the performance of key departments and agencies  in completing ISE initiatives, many of which are included in the  Implementation Plan. At a high level, performance is monitored by  executing the Implementation Plan. For example, there are clear linkages  between the plan’s 16 priority objectives, which in turn are linked to the 5  overarching goals in the 2012 National Strategy for Information Sharing  and Safeguarding: collective action, common standards, shared services,  safeguarding, and privacy. In this context, achieving milestones are a  means of measuring progress toward the overarching strategic goals. For  example, the 4 completed milestones under the governance priority  objective helped advance all 5 strategic goals by identifying governance  best practices and establishing a governance roadmap to implement  information sharing initiatives. Table 12 illustrates the alignment between  Implementation Plan priority objectives and national strategic goals.
The performance management framework also consists of several  measures, including the Performance Assessment Questionnaire. For  example, through the annual questionnaire, the Program Manager  measured results from key ISE initiatives, such as the extent that  information gathered from international partners is integrated into the  process the government uses to screen individuals for potential terrorist  threats. In 2016, the Program Manger reported that his office was revising  the format of the questionnaire, in part because the Implementation Plan  was mostly complete, but that collecting certain performance data would  continue.
The Program Manager also developed a set of homeland security  scenarios in 2011 to assist key departments in planning for and executing  the ISE’s initiatives. The scenarios were designed to demonstrate  information-sharing capabilities relevant to an agency’s mission, as well  as to allow the Program Manager and departments to determine if the ISE  is achieving desired capabilities. For example, 1 scenario described how  departments need to mature their capabilities over the next 7 years such  that an analyst does not have to manually check numerous databases to  find information related to a suspicious activity, but rather can conduct 1  search of linked databases from a single point of entry. Similarly, in 2016,  the Program Manger referred to the eight “mission stories” documented  on the Office of the Program Manager’s website as qualitative indicators  of improved information sharing over time.
The mission stories include issue areas such as cybersecurity,  counterterrorism, domain awareness, and interoperability, and according  to the Program Manager, represent causal outcomes of ISE initiatives  and are evidence of improved decision-making capability. Although the  mission story information does not encompass quantitative metrics, it  provides means to demonstrate the extent to which information sharing  has improved, and results have been achieved through individual  projects. For example, in the cybersecurity issue area, the Program  Manager partnered with the International Association of Chiefs of Police,  among other entities, to create the Law Enforcement Cyber Center, an  online portal to facilitate information sharing about cyber-crime  investigations. safeguarding measures between 2011 and 2016. Specifically, the  Program Manger solicited agency responses to 16 questionnaires that  measured agency implementation of policy recommendations related to  removable media, online identity management, insider threat programs,  access control, and enterprise audit. The results of this program—which  directly links to the Implementation Plan’s priority objective on information  safeguarding—were used to inform executive and legislative leadership of  the government’s progress in simultaneously sharing and protecting  sensitive terrorism-related information, and provided a quantitative  measure of results achieved  Separately, DHS and other stakeholders have been collecting  performance data on fusion center capabilities since 2011, which are  assessed and reported in annual reports. DHS uses an online self- assessment survey, which in 2015 included 128 questions and 10 data  tables, to collect information from individual fusion centers. The results  provide various output and outcome measures related to such areas as  information gathering, analysis, and dissemination, and enhanced threat  and domain awareness. The Program Manager’s and DHS’s efforts to  establish performance metrics for areas such as information safeguarding  and fusion centers are other means to help monitor and gain insight into  the overall state of the ISE.
In addition, in October 2016, the Program Manager and DHS initiated a  pilot to help measure and monitor the overall performance of information  sharing across the ISE. Specifically, the Information Sharing Measure  Development Pilot intends to develop a new set of information sharing  measures by analyzing how information is exchanged in various  networks. According to DHS officials, algorithms will be used to calculate  an Information Sharing Index that can quantify information sharing  efficiencies across organizations, agencies, and departments regardless  of information topic or use. The pilot project, scheduled for completion by  the end of fiscal year 2017, will focus in part on fusion center information  sharing. According to the Program Manager and DHS officials, the  resulting metrics will then be applied more broadly across the ISE. The  Program Manager and DHS have compiled a detailed Memorandum of  Agreement, which clearly defines the project’s scope, objectives, time  frames, and deliverables. If completed and broadly implemented, this  performance measures initiative could be a valuable tool to assess and  improve information sharing across the ISE.
section_title: Demonstrated progress
paragraphs: The Program Manager and key departments and agencies have met this  criterion primarily by using the Implementation Plan to track progress in  implementing priority objectives and in substantially achieving the overall  ISE. The Implementation Plan assigns stewards to each priority  objective—in most cases, a senior official within a key department or  agency—who have primary responsibility for coordinating, integrating,  and synchronizing activities to achieve the priority objectives within the  time frames established. The steward is responsible for ensuring that  participating agencies communicate and collaborate to complete the  objective, while also raising to senior management any issues that might  hinder progress. Stewards are to communicate these issues via the  Information Sharing Council (ISC), a body consisting of senior officials  from a variety of federal departments and agencies.
The Program Manager stated that 13 of the 16 priority objectives were  completed by the end of fiscal year 2016. The Program Manager  transferred the remaining 3 objectives—Data Tagging, FICAM, and  Discovery and Access—to other entities to implement through fiscal year  2019. Table 13 describes the 13 completed Implementation Plan priority  objectives and examples of demonstrated progress. For example, work  on several priority objectives—such as reference architecture and  standards-based acquisitions—resulted in concrete guidance based on  best practices that was then made available for stakeholders to use in  their own organizations. The interoperability objective resulted in  products, such as the I2F framework, that were used by multiple entities  to improve terrorism-related information sharing across different  information systems. Among other things, the fusion center and private  sector priority objectives resulted in new processes that facilitated greater  and more secure information sharing with critical infrastructure owners  and operators.
subsections: section_title: Descriptions
section_title: Complete the implementation of the Nationwide Suspicious
paragraphs: Activity Reporting (SAR) Initiative programs while  expanding training and outreach beyond law enforcement  to the rest of the public safety community. and secured funding for related training  materials.
Achieve the four Critical Operational Capabilities, four  Enabling Capabilities, and other prioritized objectives  across the National Network of Fusion Centers to help  them effectively and lawfully execute their role as a focal  point within the state and local environment for receiving,  analyzing, gathering, and sharing threat-related  information.
Ensured appropriate federal analytic  products are posted, shared, and cataloged  within DHS’s secure information network. that clearly documented the status of all priority objectives and  milestones. Among other information, these tracking documents detailed  whether milestones were completed, on track, needed attention, or  deleted, along with due dates.
The Program Manger reported that his staff request documentation from  stewards—such as white papers, emails, project completion notifications,  and formal memorandums—to prove that milestones are complete. In this  manner, over time, the Program Manager and key departments track  milestones and adjust project baselines as needed. The status of  modifying milestones was documented in regular priority objective and  milestone updates. For instance, in cases where milestones were added,  such as under the Data Tagging and FICAM priority objectives, the  Program Manger noted that the new milestones were not creating  additional tasks. Rather, the new milestones were written at a finer level  of detail, which allowed departments and agencies to demonstrate  incremental progress that was not visible under the original milestones.  Milestones were deleted if stewards and stakeholders agreed that the  milestones were no longer relevant to accomplishing priority objectives.  The Program Manager and officials from key departments and agencies  generally agreed that the Implementation Plan and process used to track  and adjust priority objectives and milestones were effective, and we  reviewed documentation that justified the status determinations for  several milestones.
Overall, the Program Manager and key departments have demonstrated  progress in advancing the ISE by using processes to track and assess  the status of priority objectives and milestones, and to make adjustments  if needed. The majority of milestones were met within the given  timeframes of the Implementation Plan, which enabled the work of the  ISE to move forward.
section_title: GAO Contact
paragraphs: For additional information about this high-risk area, contact Diana Maurer  at (202) 512-9627, or maurerd@gao.gov.
section_title: Related GAO Products
paragraphs: Information Sharing: DHS Is Assessing Fusion Center Capabilities and  Results, but Needs to More Accurately Account For Federal Funding  Provided to Centers. GAO-15-155. Washington, D.C.: November 4, 2014.
Maritime Critical Infrastructure Protection: DHS Needs to Better Address  Port Cybersecurity. GAO-14-459. Washington, D.C.: June 5, 2014.
DHS Intelligence Analysis: Additional Actions Needed to Address Analytic  Priorities and Workforce Challenges. GAO-14-397. Washington, D.C.:  June 4, 2014.
Intelligence, Surveillance, and Reconnaissance: DOD Has Taken Steps  to Improve Data Management, but Key Guidance Is Incomplete.  GAO-13-398SU. Washington, D.C.: May 8, 2013.
Intelligence, Surveillance, and Reconnaissance: DOD Has Partially  Implemented GAO’s Recommendations to Enhance Intelligence  Information Sharing. GAO-13-440SU. Washington, D.C.: April 26, 2013.
Information Sharing: Agencies Could Better Coordinate to Reduce  Overlap in Field-Based Activities. GAO-13-471. Washington, D.C.: April 4,  2013.
Information Sharing: Additional Actions Could Help Ensure That Efforts to  Share Terrorism-Related Suspicious Activity Reports Are Effective.  GAO-13-233. Washington, D.C: March 13, 2013.
Terrorist Watchlist: Routinely Assessing Impacts of Agency Actions since  the December 25, 2009, Attempted Attack Could Help Inform Future  Efforts. GAO-12-476. Washington, D.C.: May 31, 2012.
Information Sharing Environment: Better Road Map Needed to Guide  Implementation and Investments. GAO‑11‑455. Washington, D.C.: July  21, 2011.
section_title: Appendix III: GAO’s 2017 High-Risk List
paragraphs: The areas on our 2017 High-Risk List are shown in table 15.
section_title: GAO Related Products
paragraphs: The following GAO reports reflect our High-Risk Series reports issued  since 2000. For additional GAO related products issued specific to each  of the 34 high-risk areas on our updated list, see our High-Risk List  website, http://www.gao.gov/highrisk/.
High-Risk Series: Key Actions to Make Progress Addressing High-Risk  Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.
High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February  11, 2015.
High-Risk Series: An Update. GAO-13-283. Washington, D.C.: February  14, 2013.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  16, 2011.
High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January  22, 2009.
High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January  31, 2007.
High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 1,  2005.
High-Risk Series: An Update. GAO-03-119. Washington, D.C.: January 1,  2003.
High-Risk Series: An Update. GAO-01-263. Washington, D.C.: January 1,  2001.
Determining Performance and Accountability Challenges and High Risks.  GAO-01-159SP. Washington, D.C.: November 1, 2000.