Homeland Security: Federal Protective Service Continues to Face Challenges with Contract Guards and Risk Assessments at Federal Facilities
Published: 2013-12-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: As part of the Department of Homeland Security (DHS), the Federal Protective Service (FPS) is responsible for protecting federal employees and visitors in approximately 9,600 federal facilities under the control and custody of the General Services Administration (GSA). Recent incidents at federal facilities demonstrate their continued vulnerability to attacks or other acts of violence. To help accomplish its mission, FPS conducts facility security assessments and has approximately 13,500 contract security guards deployed to federal facilities.
This testimony discusses challenges FPS faces in (1) ensuring contract security guards deployed to federal facilities are properly trained and certified and (2) conducting risk assessments at federal facilities. It is based on GAO work issued from 2008 through 2013 on FPS's contract guard and risk assessment programs, and preliminary results of GAO's ongoing work to determine the extent to which FPS and select federal agencies' facility risk assessment methodologies align with federal risk assessment standards. To perform this work, GAO reviewed FPS's and eight federal agencies' risk assessment documentation and compared it to the Interagency Security Committee (ISC) standards. These agencies were selected based on their missions and types of facilities.
section_title: What GAO Found
paragraphs: FPS faces challenges ensuring that contract guards have been properly trained and certified before being deployed to federal facilities around the country. In its September 2013 report, GAO found that providing active shooter response and screener training is a challenge for FPS. For example, according to officials at five guard companies, their contract guards have not received training on how to respond during incidents involving an active shooter. Without ensuring that all guards receive training on how to respond to incidents at federal facilities involving an active-shooter, FPS has limited assurance that its guards are prepared for this threat. Similarly, an official from one of FPS's contract guard companies stated that 133 (about 38 percent) of its approximately 350 guards have never received screener training. As a result, guards deployed to federal facilities may be using x-ray and magnetometer equipment that they are not qualified to use which raises questions about their ability to screen access control points at federal facilities--one of their primary responsibilities. GAO was unable to determine the extent to which FPS's guards have received active-shooter response and screener training, in part, because FPS lacks a comprehensive and reliable system for guard oversight. FPS agreed with GAO's 2013 recommendation that they take steps to identify guards that have not had required training and provide it to them. GAO also found that FPS continues to lack effective management controls to ensure its guards have met its training and certification requirements. For instance, although FPS agreed with GAO's 2012 recommendation that it develop a comprehensive and reliable system for managing information on guards' training, certifications, and qualifications, it does not yet have such a system.
FPS also continues to face challenges assessing risk at federal facilities. GAO reported in 2012 that FPS is not assessing risks at federal facilities in a manner consistent with federal standards. GAO's preliminary results from its ongoing work on risk assessments at federal facilities indicate that this is still a challenge for FPS and several other federal agencies. Federal standards, such as the National Infrastructure Protection Plan 's risk management framework and ISC's risk assessment provisions, state that a risk assessment should include threat, vulnerability, and consequence assessments. Risk assessments help decision-makers identify and evaluate security risks and implement protective measures to mitigate the risk. Instead of conducting risk assessments, FPS is using an interim vulnerability assessment tool, referred to as the Modified Infrastructure Survey Tool (MIST) to assess federal facilities until it develops a longer-term solution. However, MIST does not assess consequence (the level, duration, and nature of potential loss resulting from an undesirable event). Three of the four risk assessment experts GAO spoke with generally agreed that a tool that does not estimate consequences does not allow an agency to fully assess risks. Thus, FPS has limited knowledge of the risks facing about 9,600 federal facilities around the country. FPS officials stated that they did not include consequence information in MIST because it was not part of the original design. GAO will continue to monitor this issue and plans to report its final results early next year.
section_title: What GAO Recommends
paragraphs: DHS and FPS agreed with the recommendations in GAO's 2012 and 2013 reports to improve FPS's contract guard and risk assessment processes.

section_title: Letter
paragraphs: We are pleased to be here to discuss the efforts of the Department of  Homeland Security’s (DHS) Federal Protective Service (FPS) to protect  the nearly 9,600 federal facilities that are under the control and custody of  the General Services Administration (GSA), including the challenges  associated with FPS’s use of contract guards and risk assessments. The  2012 shooting at the Anderson Federal Building in Long Beach,  California, the results of our 2009 covert testing, and FPS’s ongoing  penetration testing demonstrate the continued vulnerability of federal  facilities. Although FPS does not protect the Washington Navy Yard, the  recent killing of 13 people there once again showed how federal facilities  can become targets of violence. The challenge of protecting federal  facilities is one of the major reasons why we have designated federal real  property management as a high-risk area.
FPS is authorized to (1) protect the buildings, grounds, and property that  are under the control and custody of GSA, as well as the persons on the  property; (2) enforce federal laws and regulations aimed at protecting  such property and persons on the property; and (3) investigate offenses  against these buildings and persons.providing security services through two types of activities:   FPS conducts its mission by physical security activities—conducting security assessments and  recommending countermeasures aimed at preventing incidents—and  law enforcement activities—proactively patrolling facilities, responding  to incidents, conducting criminal investigations, and exercising arrest  authority. To accomplish its mission, FPS currently has almost 1,200  full-time employees and about 13,500 contract guards deployed at  federal facilities across the country. It expects to receive  approximately $1.3 billion in fees for fiscal year 2013.
Since 2008, we have reported on the challenges FPS faces with carrying  out its mission, including overseeing its contract guards and assessing  risk at federal facilities. FPS’s contract guard program is the most visible  component of the agency’s operations, and the agency relies on its  guards to be its “eyes and ears” while performing their duties. However,  we reported in 2010 and again in 2013 that FPS continues to experience  difficulty ensuring that its guards have the required training and  certifications. Before guards are assigned to a post (an area of  responsibility) at a federal facility, FPS requires that they all undergo  employee fitness determinations and complete approximately 120 hours  of training provided by the contractor and FPS, including basic training  and firearms training. Among other duties, contract guards are  responsible for controlling access to facilities; conducting screening at  access points to prevent the introduction of prohibited items, such as  weapons and explosives; and responding to emergency situations  involving facility safety and security. FPS also faces challenges  assessing risks at the 9,600 facilities under the control and custody of  GSA. For instance, in 2012, we reported that FPS’s ability to protect and  secure federal facilities has been hampered by the absence of a risk  assessment program that is consistent with federal standards. To address  this issue, we made several recommendations which FPS agreed to  implement. These recommendations and their status are discussed later  in this statement.
This testimony discusses challenges FPS faces in (1) ensuring contract  security guards deployed to federal facilities are properly trained and  certified and (2) conducting risk assessments at federal facilities. It is  based on our reports and testimonies issued from 2008 through 2013 on  FPS’s contract guard and risk assessment programs.related products appears at the end of my statement. As part of the work  for these products, we reviewed relevant statutes and federal guidance;  examined FPS contract guard and risk assessment processes and  procedures; reviewed a sample of contract guard files; conducted site  visits to FPS’s 11 regions where we interviewed FPS officials; and  interviewed FPS’s 31 guard companies and 4 risk management experts.  This testimony is also based on preliminary results of our ongoing effort to  determine the extent to which FPS and select other federal agencies  assess risk in accordance with federal risk assessment standards. We  plan to issue our report early next year. As part of that work, we reviewed  and analyzed risk assessment documentation and interviewed officials at  nine federal agencies and compared each agency’s methodology to  Interagency Security Committee (ISC) standards. The nine selected  agencies include: Department of Energy, Office of Health, Safety, and  Security; Department of Interior; Department of Justice, Justice Protective  Service; Department of State, Diplomatic Security; Department of  Veterans Affairs; Federal Emergency Management Agency; Federal  Protective Service; Nuclear Regulatory Commission; and Office of  Personnel Management. These agencies were selected to achieve  diversity with respect to the number and types of agencies’ facilities, as  well as the agencies’ missions.
We conducted our ongoing work from August 2012 to December 2013 in  accordance with generally accepted government auditing standards. Also,  our previously issued testimonies and reports were conducted in  accordance with these standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
Additional details about the scope and methodology can be found in each  of these related reports.
subsections: section_title: FPS Faces Challenges Ensuring Contract Guards Have Been Properly Trained and Certified before Being Deployed to Federal Facilities
subsections: section_title: Some FPS Contract Guards Have Not Received Required Training on Responding to Active-Shooter Scenarios
paragraphs: According to FPS officials, since 2010 the agency has required its guards  to receive training on how to respond to an active-shooter scenario.  However, as our 2013 report shows, FPS faces challenges providing  active-shooter response training to all of its guards. Without ensuring that  all guards receive training on how to respond to active-shooter incidents,  FPS has limited assurance that its guards are prepared for this threat.  According to FPS officials, the agency provides guards with information  on how they should respond during an active-shooter incident as part of  the 8-hour FPS-provided orientation training. FPS officials were not able  to specify how much time is devoted to this training, but said that it is a   According to FPS’s  small portion of the 2-hour special situations training.training documents, this training includes instructions on how to notify law  enforcement personnel, secure the guard’s area of responsibility,  appropriate use of force, and direct building occupants according to  emergency plans.
We were unable to determine the extent to which FPS’s guards have  received active-shooter response training, in part, because FPS lacks a  comprehensive and reliable system for guard oversight (as discussed  below). When we asked officials from 16 of the 31 contract guard  companies we contacted if their guards had received training on how to  respond during active-shooter incidents, responses varied.of the 16 contract guard companies we interviewed about this topic: officials from eight contract guard companies stated that their guards  had received active-shooter scenario training during FPS orientation; officials from five guard companies stated that FPS has not provided  active-shooter scenario training to their guards during the FPS- provided orientation training; and officials from three guard companies stated that FPS had not provided  active-shooter scenario training to their guards during the FPS- provided orientation training, but that the topic was covered at some  other time.
DHS and FPS agreed with our 2013 recommendation to take immediate  steps to determine which guards have not had screener or active-shooter  scenario training and provide it to them and, as part of developing a  national curriculum, decide how and how often these trainings will be  provided in the future.
section_title: Some FPS Contract Guards Have Not Received Required Screener Training
paragraphs: As part of their 120 hours of training required by FPS, guards must  receive 8 hours of screener training from FPS on how to use x-ray and  magnetometer equipment. However, in our September 2013 report, we  found that FPS has not provided required screener training to all guards.  Screener training is important because many guards control access  points at federal facilities and thus must be able to properly operate x-ray  and magnetometer machines and understand their results. In 2009 and  2010, we reported that FPS had not provided screener training to 1,500   In response to those reports, FPS  contract guards in one FPS region.stated that it planned to implement a program to train its inspectors to  provide screener training to all its contract guards.
We were unable to determine the extent to which FPS’s guards have  received screener training, but information from guard companies we  contacted indicate that guards continue to be deployed to federal facilities  who have never received this training. For example, an official at one  contract guard company stated that 133 of its approximately 350 guards  (about 38 percent) on three separate FPS contracts (awarded in 2009)  have never received their initial x-ray and magnetometer training from  FPS. The official stated that some of these guards are working at  screening posts. Further, officials at another contract guard company in a  different FPS region stated that, according to their records, 78 of 295  (about 26 percent) guards deployed under their contract have never  received FPS’s x-ray and magnetometer training. These officials stated  that FPS’s regional officials were informed of the problem, but allowed  guards to continue to work under this contract, despite not having  completed required training. Because FPS is responsible for this training,  according to guard company officials no action was taken against the  company. Consequently, some guards deployed to federal facilities may  be using x-ray and magnetometer equipment that they are not qualified to  use─thus raising questions about the ability of some guards to execute a  primary responsibility to properly screen access control points at federal  facilities.
As noted above, FPS agreed with our 2013 recommendation to determine  which guards have not had screener training and agreed to provide it to  them.
section_title: FPS Lacks Effective Management Controls to Ensure Contract Guards Have Met Training and Certification Requirements
paragraphs: In our September 2013 report, we found that FPS continues to lack  effective management controls to ensure that guards have met training  and certification requirements. For example, although FPS agreed with  our 2012 recommendation to develop a comprehensive and reliable  system for contract guard oversight, it has not yet established such a  system. Without a comprehensive guard management system, FPS has  no independent means of ensuring that its contract guard companies  have met contract requirements, such as providing qualified guards to  federal facilities. Instead, FPS requires its guard companies to maintain  files containing guard-training and certification information and to provide  it with a monthly report containing this information. In our September  2013 report, we reported that 23 percent of the 276 guard files we  reviewed (maintained by 11 of the 31 guard companies we interviewed)  lacked required training and certification documentation.table 1, some guard files lacked documentation of basic training, semi- annual firearms qualifications, screener training, the 40-hour refresher  training (required every 3 years), and CPR certification.
FPS has also identified guard files that did not contain required  documentation. FPS’s primary tool for ensuring that guard companies  comply with contractual requirements for guards’ training, certifications,  and qualifications is to review guard companies’ guard files monthly.
From March 2012 through March 2013, FPS reviewed more than 23,000  guard files. It found that a majority of the guard files had the required  documentation but more than 800 (about 3 percent) did not. FPS’s file  reviews for that period showed files missing, for example, that  documented screener training, initial weapons training, CPR certification,  and firearms qualifications. However, as our September 2013 report  explains, FPS’s process for conducting monthly file reviews does not  include requirements for reviewing and verifying the results, and we  identified instances in which FPS’s monthly review results did not  accurately reflect the contents of guard files. For instance, FPS’s review  indicated that required documentation was present for some guard files,  but we were not able to find documentation of training and certification,  such as initial weapons training, DHS orientation, and pre-employment  drug screenings.not able to provide reasonable assurance that guards have met training  and certification requirements.
As a result of the lack of management controls, FPS is  DHS and FPS agreed with our 2013 recommendation to develop and  implement procedures for monthly guard-file reviews to ensure  consistency in selecting files and verifying the results.
section_title: FPS Continues to Face Challenges with Assessing Risk at Federal Facilities
paragraphs: We reported in 2012 that FPS is not assessing risks at federal facilities in  a manner consistent with federal standards. The preliminary results of our  ongoing review of risk assessments of federal facilities indicate that this is  still a challenge for FPS and several other federal agencies. Federal  standards such as the National Infrastructure Protection Plan’s (NIPP)  risk management framework and ISC risk assessment provisions call for  a risk assessment to include threat, vulnerability, and consequence  assessments. Risk assessments help decision-makers identify and  evaluate security risk and implement protective measures to mitigate risk.  Moreover, risk assessments play a critical role in helping agencies tailor  protective measures to reflect their facilities’ unique circumstances and  enable them to allocate security resources effectively.
Instead of conducting risk assessments, FPS uses an interim vulnerability  assessment tool, referred to as the Modified Infrastructure Survey Tool  (MIST), with which it assesses federal facilities until it develops a longer- term solution. According to FPS, MIST is allowing it to resume assessing  federal facilities’ vulnerabilities and recommend countermeasures— something FPS has not done consistently for several years. However,  MIST has some limitations. Most notably, it does not assess  consequence (the level, duration, and nature of potential loss resulting  from an undesirable event). Three of the four risk assessment experts we  spoke with generally agreed that a tool that does not estimate  consequences does not allow an agency to fully assess risks. FPS  officials stated that they did not include consequence information in MIST  because it was not part of the original design and thus requires more time  to validate. MIST also was not designed to compare risks across federal  facilities. Consequently, FPS does not have the ability to take a  comprehensive approach to risk management across its portfolio of 9,600  facilities and recommending countermeasures to federal tenant agencies.
As of December 2013, according to an FPS official, FPS had used MIST  to complete vulnerability assessments of approximately 1,800 federal  facilities and have presented approximately 1,000 of them to the facility  security committees. We will continue to monitor this issue and plan to  report the results early next year.
DHS agreed with our 2012 recommendations to incorporate NIPP’s risk  management framework in any future risk assessment tool; coordinate  with federal agencies to reduce any unnecessary duplication in FPS’s  assessments; and address limitations with its interim tool to better assess  risk at federal facilities. However, it has not yet implemented them.
section_title: Contact Information
paragraphs: For further information on this testimony, please contact Mark Goldstein  at (202) 512-2834 or by email at GoldsteinM@gao.gov. Individuals  making key contributions to this testimony include Tammy Conquest,  Assistant Director; Geoff Hamilton; Bob Homan; and Sara Ann  Moessbauer.
section_title: Related GAO Products
paragraphs: Homeland Security: Challenges Associated with Federal Protective  Service’s Contract Guards and Risk Assessments at Federal Facilities.  GAO-14-128T. Washington, D.C.: October 30, 2013.
Federal Protective Service: Challenges with Oversight of Contract Guard  Program Still Exist, and Additional Management Controls Are Needed.  GAO-13-694. Washington, D.C.: September 17, 2013.
Facility Security: Greater Outreach by DHS on Standards and  Management Practices Could Benefit Federal Agencies. GAO-13-222.  Washington, D.C.: January 24, 2013.
Federal Protective Service: Actions Needed to Assess Risk and Better  Manage Contract Guards at Federal Facilities. GAO-12-739. Washington,  D.C.: August 10, 2012.
Homeland Security: Protecting Federal Facilities Remains a Challenge for  the Department of Homeland Security’s Federal Protective Service.   GAO-11-813T. Washington, D.C.: July 13, 2011.
Federal Facility Security: Staffing Approaches Used by Selected  Agencies. GAO-11-601. Washington, D.C.: June 30, 2011.
Homeland Security: Preliminary Observations on the Federal Protective  Service’s Workforce Analysis and Planning Efforts. GAO-10-802R.  Washington, D.C.: June 14, 2010.
Homeland Security: Federal Protective Service’s Use of Contract Guards  Requires Reassessment and More Oversight. GAO-10-614T.  Washington, D.C.: April 14, 2010.
Homeland Security: Federal Protective Service’s Contract Guard Program  Requires More Oversight and Reassessment of Use of Contract Guards.  GAO-10-341. Washington, D.C.: April 13, 2010.
Homeland Security: Ongoing Challenges Impact the Federal Protective  Service’s Ability to Protect Federal Facilities. GAO-10-506T. Washington,  D.C.: March 16, 2010.
Homeland Security: Greater Attention to Key Practices Would Improve  the Federal Protective Service’s Approach to Facility Protection.   GAO-10-142. Washington, D.C.: October 23, 2009.
Homeland Security: Federal Protective Service Has Taken Some Initial  Steps to Address Its Challenges, but Vulnerabilities Still Exist.   GAO-09-1047T. Washington, D.C.: September 23, 2009.
Homeland Security: Federal Protective Service Should Improve Human  Capital Planning and Better Communicate with Tenants. GAO-09-749.  Washington, D.C.: July 30, 2009.
Homeland Security: Preliminary Results Show Federal Protective  Service’s Ability to Protect Federal Facilities Is Hampered by  Weaknesses in Its Contract Security Guard Program. GAO-09-859T.  Washington, D.C.: July 8, 2009.
Homeland Security: The Federal Protective Service Faces Several  Challenges That Raise Concerns About Protection of Federal Facilities.  GAO-08-897T. Washington, D.C.: June 19, 2008.
Homeland Security: The Federal Protective Service Faces Several  Challenges That Raise Concerns About Protection of Federal Facilities.  GAO-08-914T. Washington, D.C.: June 18, 2008.
Homeland Security: The Federal Protective Service Faces Several  Challenges That Hamper Its Ability to Protect Federal Facilities.   GAO-08-683. Washington, D.C.: June 11, 2008.
Homeland Security: Preliminary Observations on the Federal Protective  Service’s Efforts to Protect Federal Property. GAO-08-476T. Washington,  D.C.: February 8, 2008.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.