High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others
Published: 2017-02-15T00:00:00

Fast Facts:
Every 2 years, we examine federal programs and operations that are especially vulnerable to waste, fraud, abuse, and mismanagement, or that need transformative change—our High Risk List. This testimony reviews the status of areas on the list and outlines steps to lasting solutions.
This year, we added 3 areas, expanded 2 existing ones, and found many areas still in need of substantial attention. Yet, a number of agencies have made solid progress, including in 1 area that we removed and 2 others we narrowed.
The new High Risk areas are:
Federal Indian education, health, and energy programs
Federal environmental liabilities
The 2020 Census

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government is one of the world's largest and most complex entities: about $3.9 trillion in outlays in fiscal year 2016 funded a broad array of programs and operations. GAO's high-risk program identifies government operations with greater vulnerabilities to fraud, waste, abuse, and mismanagement or the need for transformation to address economy, efficiency, or effectiveness challenges.
This biennial update describes the status of high-risk areas listed in 2015 and actions that are still needed to assure further progress, and identifies new high-risk areas needing attention by Congress and the executive branch. Solutions to high-risk problems potentially save billions of dollars, improve service to the public, and strengthen government performance and accountability.
GAO uses five criteria to assess progress in addressing high-risk areas: (1) leadership commitment, (2) agency capacity, (3) an action plan, (4) monitoring efforts, and (5) demonstrated progress.
section_title: What GAO Found
paragraphs: Since GAO's last high-risk update, many of the 32 high-risk areas on the 2015 list have shown solid progress. Twenty-three high-risk areas, or two-thirds of all the areas, have met or partially met all five criteria for removal from the High-Risk List; 15 of these areas fully met at least one criterion. Progress has been possible through the concerted efforts of Congress and leadership and staff in agencies. For example, Congress enacted over a dozen laws since GAO's last report in February 2015 to help address high-risk issues.
GAO removed 1 high-risk area on managing terrorism-related information, because significant progress had been made to strengthen how intelligence on terrorism, homeland security, and law enforcement is shared among federal, state, local, tribal, international, and private sector partners. Sufficient progress was made to remove segments of 2 areas related to supply chain management at the Department of Defense (DOD) and gaps in geostationary weather satellite data.
Two high-risk areas expanded—DOD's polar-orbiting weather satellites and the Department of the Interior's restructuring of offshore oil and gas oversight. Several other areas need substantive attention including VA health care, DOD financial management, ensuring the security of federal information systems and cyber critical infrastructure, resolving the federal role in housing finance, and improving the management of IT acquisitions and operations.
GAO is adding 3 areas to the High-Risk List, bringing the total to 34:
Management of Federal Programs That Serve Tribes and Their Members. GAO has reported that federal agencies, including the Department of the Interior's Bureaus of Indian Education and Indian Affairs and the Department of Health and Human Services' Indian Health Service, have ineffectively administered Indian education and health care programs and inefficiently developed Indian energy resources. Thirty-nine of 41 GAO recommendations on this issue remain unimplemented.
U.S. Government's Environmental Liabilities. In fiscal year 2016 this liability was estimated at $447 billion (up from $212 billion in 1997). The Department of Energy is responsible for 83 percent of these liabilities and DOD for 14 percent. Agencies spend billions each year on environmental cleanup efforts but the estimated environmental liability continues to rise. Since 1994, GAO has made at least 28 recommendations related to this area; 13 are unimplemented.
The 2020 Decennial Census. The cost of the census has been escalating over the last several decennials; the 2010 Census was the costliest U.S. Census in history at about $12.3 billion, about 31 percent more than the 2000 Census (in 2020 dollars). The U.S. Census Bureau (Bureau) plans to implement several innovations—including IT systems—for the 2020 Census. Successfully implementing these innovations, along with other challenges, risk the Bureau's ability to conduct a cost-effective census. Since 2014, GAO has made 30 recommendations related to this area; however, only 6 have been fully implemented.
GAO's 2017 High-Risk List
section_title: What GAO Recommends
paragraphs: This report contains GAO's views on progress made and what remains to be done to bring about lasting solutions for each high-risk area. Perseverance by the executive branch in implementing GAO's recommended solutions and continued oversight and action by Congress are essential to achieving greater progress.

section_title: Letter
paragraphs: Since the early 1990s, our high-risk program has focused attention on  government operations with greater vulnerabilities to fraud, waste, abuse,  and mismanagement or that are in need of transformation to address  economy, efficiency, or effectiveness challenges. This effort, supported  by the Senate Committee on Homeland Security and Governmental  Affairs and by the House of Representatives Committee on Oversight and  Government Reform, has brought much-needed attention to problems  impeding effective government and costing billions of dollars each year.
To help improve these high-risk operations, we have made hundreds of  recommendations. Executive agencies either have addressed or are  addressing many of them and, as a result, progress is being made in a  number of areas. Congress also continues to take important actions. For  example, Congress enacted over a dozen laws since our last report in  February 2015 to help make progress on high-risk issues. Progress in  high-risk areas over the past decade (fiscal year 2007 through fiscal year  2016) resulted in financial benefits totaling approximately $240 billion or  an average of about $24 billion per year.
Our 2017 high-risk update, which is being released today, describes (1)  progress made addressing high-risk areas and the reasons for that  progress, and (2) actions that are still needed to assure further progress.  It also identifies three new high-risk areas, which include the  management of federal programs that serve tribes and their members,  the federal government’s environmental liabilities, and the 2020 Census.
subsections: section_title: High-Risk Areas Making Progress
paragraphs: Since our last high-risk update, while progress has varied, many of the 32  high-risk areas on our 2015 list have shown solid progress. One area  related to sharing and managing terrorism-related information is now  being removed from the list.
Agencies can show progress by addressing our five criteria for removal  from the list: leadership commitment, capacity, action plan, monitoring,  and demonstrated progress. As shown in table 1, 23 high-risk areas, or  two-thirds of all the areas, have met or partially met all five criteria for  removal from our High-Risk List; 15 of these areas fully met at least one  criterion. Compared with our last assessment, 11 high-risk areas showed  progress in one or more of the five criteria. Two areas declined since  2015. These changes are indicated by the up and down arrows in table 1.
subsections: section_title: High-Risk Areas Showing Progress
paragraphs: Of the 11 high-risk areas showing progress between 2015 and 2017,  sufficient progress was made in 1 area—Establishing Effective  Mechanisms for Sharing and Managing Terrorism-Related Information to  Protect the Homeland—to be removed from the list. In two other areas,  enough progress was made that we removed a segment of the high-risk  area—Mitigating Gaps in Weather Satellite Data and Department of  Defense (DOD) Supply Chain Management. The other eight areas  improved in at least one criterion rating by either moving from “not met” to  “partially met” or from “partially met” to “met.”
subsections: section_title: One High-Risk Designation Removed
paragraphs: We removed the area of Establishing Effective Mechanisms for Sharing  and Managing Terrorism-Related Information to Protect the Homeland  from the High-Risk List because the Program Manager for the Information  Sharing Environment (ISE) and key departments and agencies have  made significant progress to strengthen how intelligence on terrorism,  homeland security, and law enforcement, as well as other information  (collectively referred to in this section as terrorism-related information), is  shared among federal, state, local, tribal, international, and private sector  partners. As a result, the Program Manager and key stakeholders have  met all five criteria for addressing our high-risk designation, and we are  removing this issue from our High-Risk List. While this progress is  commendable, it does not mean the government has eliminated all risk  associated with sharing terrorism-related information. It remains  imperative that the Program Manager and key departments and agencies  continue their efforts to advance and sustain ISE. Continued oversight  and attention is also warranted given the issue’s direct relevance to  homeland security as well as the constant evolution of terrorist threats  and changing technology.
The Program Manager, the individual responsible for planning,  overseeing, and managing ISE, along with the key departments and  agencies—the Departments of Homeland Security (DHS), Justice (DOJ),  State (State), and Defense (DOD), and the Office of the Director of  National Intelligence (ODNI)—are critical to implementing and sustaining  ISE. Following the terrorist attacks of 2001, Congress and the executive  branch took numerous actions aimed explicitly at establishing a range of  new measures to strengthen the nation’s ability to identify, detect, and  deter terrorism-related activities. For example, ISE was established in  accordance with the Intelligence Reform and Terrorism Prevention Act of  2004 (Intelligence Reform Act) to facilitate the sharing of terrorism-related  information. Figure 1 depicts the relationship between the various  stakeholders and disciplines involved with the sharing and safeguarding  of terrorism-related information through ISE.
The Program Manager and key departments and agencies met the  leadership commitment and capacity criteria in 2015, and have  subsequently sustained efforts in both these areas. For example, the  Program Manager clearly articulated a vision for ISE that reflects the  government’s terrorism-related information sharing priorities. Key  departments and agencies also continued to allocate resources to  operations that improve information sharing, including developing better  technical capabilities.
The Program Manager and key departments and agencies also  developed, generally agreed upon, and executed the 2013 Strategic  Implementation Plan (Implementation Plan), which includes the overall  strategy and more specific planning steps to achieve ISE. Further, they  have demonstrated that various information-sharing initiatives are being  used across multiple agencies as well as state, local, and private-sector  stakeholders. For example, the project manager has developed a  comprehensive framework for managing enterprise architecture to help  share and integrate terrorism-related information among multiple  stakeholders in ISE. Specifically, the Project Interoperability initiative  includes technical resources and other guidance that promote greater  information system compatibility and performance. Furthermore, the key  departments and agencies have applied the concepts of the Project  Interoperability Initiative to improve mission operations by better linking  different law enforcement databases and facilitating better geospatial  analysis, among other things.
In addition, the Program Manager and key departments and agencies  have continued to devise and implement ways to measure the effect of  ISE on information sharing to address terrorist and other threats to the  homeland. They developed performance metrics for specific information- sharing initiatives (e.g., fusion centers) used by various stakeholders to  receive and share information. The Program Manager and key  departments and agencies have also documented mission-specific  accomplishments (e.g., related to maritime domain awareness) where the  Program Manager helped connect previously incompatible information  systems. The Program Manager has also partnered with DHS to create  an Information Sharing Measure Development Pilot that intends to better  measure the effectiveness of information sharing across all levels of ISE.
Further, the Program Manager and key departments and agencies have  used the Implementation Plan to track progress, address challenges, and  substantially achieve the objectives in the National Strategy for  Information Sharing and Safeguarding. The Implementation Plan  contains 16 priority objectives, and by the end of fiscal year 2016, 13 of  the 16 priority objectives were completed. The Program Manager  transferred the remaining three objectives, which were all underway, to  other entities with the appropriate technical expertise to continue  implementation through fiscal year 2019.
In our 2013 high-risk update, we listed nine action items that were critical  for moving ISE forward. In that report, we determined that two of those  action items—demonstrating that the leadership structure has the needed  authority to leverage participating departments, and updating the vision  for ISE—had been completed. In our 2015 update, we determined that  the Program Manager and key departments had achieved four of the  seven remaining action items—demonstrating that departments are  defining incremental costs and funding; continuing to identify  technological capabilities and services that can be shared collaboratively;  demonstrating that initiatives within individual departments are, or will be,  leveraged to benefit all stakeholders; and demonstrating that  stakeholders generally agree with the strategy, plans, time frames,  responsibilities, and activities for substantially achieving ISE.
For the 2017 update, we determined that the remaining three action items  have been completed: establishing an enterprise architecture  management capability; demonstrating that the federal government can  show, or is more fully developing a set of metrics to measure, the extent  to which sharing has improved under ISE; and demonstrating that  established milestones and time frames are being used as baselines to  track and monitor progress. Achieving all nine action items has, in effect,  addressed our high-risk criteria.
While this demonstrates significant and important progress, sharing  terrorism-related information remains a constantly evolving work in  progress that requires continued effort and attention from the Program  Manager, departments, and agencies. Although no longer a high-risk  issue, sharing terrorism-related information remains an area with some  risk, and continues to be vitally important to homeland security, requiring  ongoing oversight as well as continuous improvement to identify and  respond to changing threats and technology. Table 2 summarizes the  Program Manager’s and key departments’ and agencies’ progress in  achieving the action items.
As we have with areas previously removed from the High-Risk List, we  will continue to monitor this area, as appropriate, to ensure that the  improvements we have noted are sustained. If significant problems again  arise, we will consider reapplying the high-risk designation.
Additional Information on Establishing Effective Mechanisms for Sharing  and Managing Terrorism-Related Information to Protect the Homeland is  provided on page 653 of the report.
section_title: Two High-Risk Areas Narrowed
paragraphs: In the 2 years since our last high-risk update, sufficient progress has been  made in two areas—DOD Supply Chain Management and Mitigating  Gaps in Weather Satellite Data—that we are narrowing their scope.
DOD manages about 4.9 million secondary inventory items, such as  spare parts, with a reported value of approximately $91 billion as of  September 2015. Since 1990, DOD’s inventory management has been  included on our High-Risk List due to the accumulation of excess  inventory and weaknesses in demand forecasting for spare parts. In  addition to DOD’s inventory management, the supply chain management  high-risk area focuses on materiel distribution and asset visibility within  DOD. Based on DOD’s leadership commitment and demonstrated  progress to address weaknesses since 2010, we are removing the  inventory management component from the supply chain management  high-risk area. Specifically, DOD has taken the following actions:  Implemented a congressionally mandated inventory management  corrective action plan and institutionalized a performance  management framework, including regular performance reviews and  standardized metrics. DOD has also developed and begun  implementing a follow-on improvement plan.
Reduced the percentage and value of its “on-order excess inventory”  (i.e., items already purchased that may be excess due to subsequent  changes in requirements) and “on-hand excess inventory” (i.e., items  categorized for potential reuse or disposal). DOD’s data show that the  proportion of on-order excess inventory to the total amount of on- order inventory decreased from 9.5 percent at the end of fiscal year  2009 to 7 percent at the end of fiscal year 2015, the most recent fiscal  year for which data are available. During these years, the value of on- order excess inventory also decreased from $1.3 billion to $701  million. DOD’s data show that the proportion of on-hand excess  inventory to the total amount of on-hand inventory dropped from 9.4  percent at the end of fiscal year 2009 to 7.3 percent at the end of  fiscal year 2015. The value of on-hand excess inventory also  decreased during these years from $8.8 billion to $6.8 billion.
Implemented numerous actions to improve demand forecasting and  began tracking department-wide forecasting accuracy metrics in 2013,  resulting in forecast accuracy improving from 46.7 percent in fiscal  year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for  which complete data are available.
Implemented 42 of our recommendations since 2006 and is taking  actions to implement an additional 13 recommendations, which are  focused generally on reassessing inventory goals, improving  collaborative forecasting, and making changes to information  technology (IT) systems used to manage inventory.
Additional information on DOD Supply Chain Management is provided on  page 248 of the report.
Mitigating Gaps in Weather Satellite Data  The United States relies on two complementary types of satellite systems  for weather observations and forecasts: (1) polar-orbiting satellites that  provide a global perspective every morning and afternoon, and (2)  geostationary satellites that maintain a fixed view of the United States.  Both types of systems are critical to weather forecasters, climatologists,  and the military, who map and monitor changes in weather, climate, the  oceans, and the environment. Federal agencies are planning or executing  major satellite acquisition programs to replace existing polar and  geostationary satellite systems that are nearing or beyond the end of their  expected life spans. The Department of Commerce’s National Oceanic  and Atmospheric Administration (NOAA) is responsible for the polar  satellite program that crosses the equator in the afternoon and for the  nation’s geostationary weather satellite program; DOD is responsible for  the polar satellite program that crosses the equator in the early morning  orbit.
Over the last several years, we have reported on the potential for a gap in  satellite data between the time that the current satellites are expected to  reach the end of their lifespans and the time when the next satellites are  expected to be in orbit and operational. We added this area to our High- Risk List in 2013. According to NOAA program officials, a satellite data  gap would result in less accurate and timely weather forecasts and  warnings of extreme events—such as hurricanes, storm surges, and  floods. Such degraded forecasts and warnings would endanger lives,  property, and our nation’s critical infrastructures. Similarly, according to  DOD officials, a gap in space-based weather monitoring capabilities could  affect the planning, execution, and sustainment of U.S. military operations  around the world. In our prior high-risk updates, we reported on NOAA’s  efforts to mitigate the risk of a gap in its polar and geostationary satellite  programs.
With strong congressional support and oversight, NOAA has made  significant progress in its efforts to mitigate the potential for gaps in  weather satellite data on its geostationary weather satellite program.  Specifically, the agency demonstrated strong leadership commitment to  mitigating potential gaps in geostationary satellite data by revising and  improving its gap mitigation/contingency plans. Previously, in December  2014, we reported on shortfalls in the satellite program’s gap  mitigation/contingency plans and made recommendations to NOAA to  address these shortfalls. For example, we noted that the plan did not  sufficiently address  strategies for preventing a launch delay,  timelines and triggers to prevent a launch delay, and whether any of its mitigation strategies would meet minimum  performance levels.
NOAA agreed with these recommendations and released a new version  of its geostationary satellite contingency plan in February 2015 that  addressed the recommendations, thereby meeting the criterion for having  an action plan.
We rated capacity as partially met in our 2015 report due to concerns  about NOAA’s ability to complete critical testing activities because it was  already conducting testing on a round-the-clock, accelerated schedule.  Since then, NOAA adjusted its launch schedule to allow time to complete  critical integration and testing activities. In doing so, the agency  demonstrated that it met the capacity criterion.
NOAA has also met the criterion for demonstrating progress by mitigating  schedule risks and successfully launching the satellite. In September  2013, we reported that the agency had weaknesses in its schedule- management practices on its core ground system and spacecraft. We  made recommendations to address those weaknesses, which included  sequencing all activities, ensuring there are adequate resources for the  activities, and analyzing schedule risks. NOAA agreed with the  recommendations and the Geostationary Operational Environmental  Satellite-R series (GOES-R) program improved its schedule management  practices. By early 2016, the program had improved the links between  remaining activities on the spacecraft schedule, included needed  schedule logic for a greater number of activities on the ground schedule,  and included indications on the ground schedule that the results of a  schedule risk analysis were used in calculating its durations. In addition,  the program successfully launched the GOES-R satellite in November  2016.
Oversight by Congress has been instrumental in reducing the risk of  geostationary weather satellite gaps. For example, Subcommittees of the  House Science, Space, and Technology Committee held multiple  hearings to provide oversight of the satellite acquisition and the risk of  gaps in satellite coverage.
As a result, the agency now has a robust constellation of operational and  backup satellites in orbit and has made significant progress in addressing  the risk of a gap in geostationary data coverage. Accordingly, there is  sufficient progress to remove this segment from the high-risk area.
Additional information on Mitigating Gaps in Weather Satellite Data is  provided on pages 19 and 430 of the high-risk report.
section_title: Progress in Other Areas
paragraphs: Below are selected examples of areas where progress has been made.
Strengthening Department of Homeland Security Management  Functions. The Department of Homeland Security (DHS) continues  to strengthen and integrate its management functions and progressed  from partially met to met for the monitoring criterion. Since our 2015  high-risk update, DHS has strengthened its monitoring efforts for  financial system modernization programs by entering into a contract  for independent verification and validation services to help ensure that  the modernization projects meet key requirements. These programs  are key to effectively supporting the department’s financial  management operations.
Additionally, DHS continued to meet the criteria for leadership  commitment and a corrective action plan. DHS’s top leadership has  demonstrated exemplary support and a continued focus on  addressing the department’s management challenges by, among  other things, issuing 10 updated versions of DHS’s initial January  2011 Integrated Strategy for High Risk Management.
The National Defense Authorization Act for Fiscal Year 2017  reinforces this focus with the inclusion of a mandate that the DHS  Under Secretary for Management report to us every 6 months to  demonstrate measurable, sustainable progress made in implementing  DHS’s corrective action plans to address the high-risk area until we  submit written notification of the area’s removal from the High-Risk  List to the appropriate congressional committees. Similar provisions  were included in the DHS Headquarters Reform and Improvement Act  of 2015, the DHS Accountability Act of 2016, and the DHS Reform  and Improvement Act. Additional information on this high-risk area is  provided on page 354 of the report.
Strategic Human Capital Management. This area progressed from  partially met to met on leadership commitment. The Office of  Personnel Management (OPM), agencies, and Congress have taken  actions to improve efforts to address mission critical skills gaps.  Specifically, OPM has demonstrated leadership commitment by  publishing revisions to its human capital regulations in December  2016 that require agencies to, among other things, implement human  capital policies and programs that address and monitor government- wide and agency-specific skills gaps. This initiative has increased the  likelihood that skills gaps with the greatest operational effect will be  addressed in future efforts.
At the same time, Congress has provided agencies with authorities  and flexibilities to manage the federal workforce and make the federal  government a more accountable employer. For example, Congress  included a provision in the National Defense Authorization Act for  Fiscal Year 2016 to extend the probationary period for newly-hired  civilian DOD employees from 1 to 2 years. This action is consistent  with our 2015 reporting that better use of probationary periods gives  agencies the ability to ensure an employee’s skills are a good fit for all  critical areas of a particular job. Additional information on this high-risk  area is provided on page 61 of the report.
Transforming the Environmental Protection Agency’s Processes  for Assessing and Controlling Toxic Chemicals. Overall, this high- risk area progressed from not met to partially met on two criteria— capacity and demonstrated progress—and continued to partially meet  the criterion for monitoring due to progress in one program area. The  Environmental Protection Agency’s (EPA) ability to effectively  implement its mission of protecting public health and the environment  is critically dependent on assessing the risks posed by chemicals in a  credible and timely manner. EPA assesses these risks under a variety  of actions, including the Integrated Risk Information System (IRIS)  program and EPA’s Toxic Substances Control Act (TSCA) program.  The IRIS program has made some progress on the capacity,  monitoring, and demonstrated progress criteria. In terms of IRIS  capacity, EPA has partially met this criterion by finalizing a Multi-Year  Agenda to better assess how many people and resources should be  dedicated to the IRIS program. In terms of IRIS monitoring, EPA has  met this criterion in part by using a Chemical Assessment Advisory  Committee to review IRIS assessments, among other actions. In  terms of IRIS demonstrated progress, EPA has partially met this  criterion as of January 2017 by issuing five assessments since fiscal  year 2015.
The Frank R. Lautenberg Chemical Safety for the 21st Century Act  amended TSCA and was enacted on June 22, 2016. Passing TSCA  reform may facilitate EPA’s effort to improve its processes for  assessing and controlling toxic chemicals in the years ahead. The  new law provides EPA with greater authority and the ability to take  actions that could help EPA implement its mission of protecting  human health and the environment. EPA officials stated that the  agency is better positioned to take action to require chemical  companies to report chemical toxicity and exposure data. Officials  also stated that the new law gives the agency additional authorities,  including the authority to require companies to develop new  information relating to a chemical as necessary for prioritization and  risk evaluation.
Using both new and previously existing TSCA authorities should  enhance the agency’s ability to gather new information as necessary  to evaluate hazard and exposure risks. Continued leadership  commitment from EPA officials and Congress will be needed to fully  implement reforms. Additional work will also be needed to issue a  workload analysis to demonstrate capacity, complete a corrective  action plan, and demonstrate progress implementing the new  legislation. Additional information on this high-risk area is provided on  page 417 of the report.
Managing Federal Real Property. The federal government continued  to meet the criteria for leadership commitment, now partially meets  the criterion for demonstrated progress, and made some progress in  each of the other high-risk criteria. The Office of Management and  Budget (OMB) issued the National Strategy for the Efficient Use of  Real Property (National Strategy) on March 25, 2015, which directs  Chief Financial Officer (CFO) Act agencies to take actions to reduce  the size of the federal real property portfolio, as we recommended in  2012. In addition, in December 2016, two real property reform bills  were enacted that could address the long-standing problem of federal  excess and underutilized property. The Federal Assets Sale and  Transfer Act of 2016 may help address stakeholder influence by  establishing an independent board to identify and recommend five  high-value civilian federal buildings for disposal within 180 days after  the board members are appointed, as well as develop  recommendations to dispose and redevelop federal civilian real  properties.
Additionally, the Federal Property Management Reform Act of 2016  codified the Federal Real Property Council (FRPC) for the purpose of  ensuring efficient and effective real property management while  reducing costs to the federal government. FRPC is required to  establish a real property management plan template, which must  include performance measures, and strategies and government-wide  goals to reduce surplus property or to achieve better utilization of  underutilized property. In addition, federal agencies are required to  annually provide FRPC a report on all excess and underutilized  property, and identify leased space that is not fully used or occupied.
In addressing our 2016 recommendation to improve the reliability of  real property data, GSA conducted an in-depth survey that focused on  key real property data elements maintained in the Federal Real  Property Profile, formed a working group of CFO Act agencies to  analyze the survey results and reach consensus on reforms, and  issued a memorandum to CFO Act agencies designed to improve the  consistency and quality of real property data. The Federal Protective  Service, which protects about 9,500 federal facilities, implemented our  recommendation aimed at improving physical security by issuing a  plan that identifies goals and describes resources that support its risk  management approach. In addition, the Interagency Security  Committee, a DHS-chaired organization, issued new guidance  intended to make the most effective use of physical security  resources. Additional information on this high-risk area is provided on  page 77 of the report.
Enforcement of Tax Laws. The Internal Revenue Service’s (IRS)  continued efforts to enforce tax laws and address identity theft refund  fraud (IDT) have resulted in the agency meeting one criterion for  removal from the High-Risk List (leadership commitment) and partially  meeting the remaining four criteria (capacity, action plan, monitoring,  and demonstrating progress). IDT is a persistent and evolving threat  that burdens legitimate taxpayers who are victims of the crime. It cost  the U.S. Treasury an estimated minimum of $2.2 billion during the  2015 tax year.
Congress and IRS have taken steps to address this challenge. IRS  has deployed new tools and increased resources dedicated to  identifying and combating IDT refund fraud. In addition, the  Consolidated Appropriations Act, 2016, amended the tax code to  accelerate Wage and Tax Statement (W-2) filing deadlines to January  31. We had previously reported that the wage information that  employers report on Form W-2 was not available to IRS until after it  issues most refunds. With earlier access to W-2 wage data, IRS could  match such information to taxpayers’ returns and identify  discrepancies before issuing billions of dollars of fraudulent IDT  refunds. Such matching could also provide potential benefits for other  IRS enforcement programs, such as preventing improper payments  via the Earned Income Tax Credit. Additional information on this high- risk area is provided on page 500 of the report.
section_title: Congressional Action Aided Progress on Government-wide High- Risk Issues
paragraphs: In addition to being instrumental in supporting progress in individual high- risk areas, Congress also has taken actions to enact various statutes that,  if implemented effectively, will help foster progress on high-risk issues  government-wide. These include the following:
Program Management Improvement Accountability Act:  Enacted in December 2016, the act seeks to improve program and  project management in federal agencies. Among other things, the act  requires the Deputy Director of the Office of Management and Budget  (OMB) to adopt and oversee implementation of government-wide  standards, policies, and guidelines for program and project  management in executive agencies. The act also requires the Deputy  Director to conduct portfolio reviews to address programs on our  High-Risk List. It further creates a Program Management Policy  Council to act as an interagency forum for improving practices related  to program and project management. The Council is to review  programs on the High-Risk List and make recommendations to the  Deputy Director or designee. We are to review the effectiveness of  key efforts under the act to improve federal program management.
Fraud Reduction and Data Analytics Act of 2015 (FRDA): FRDA,  enacted in June 2016, is intended to strengthen federal anti-fraud  controls, while also addressing improper payments. FRDA requires  OMB to use our Fraud Risk Framework to create guidelines for  federal agencies to identify and assess fraud risks, and then design  and implement control activities to prevent, detect, and respond to  fraud. Agencies, as part of their annual financial reports beginning in  fiscal year 2017, are further required to report on their fraud risks and  their implementation of fraud reduction strategies, which should help  Congress monitor agencies’ progress in addressing and reducing  fraud risks. To aid federal agencies in better analyzing fraud risks,  FRDA requires OMB to establish a working group tasked with  developing a plan for the creation of an interagency library of data  analytics and data sets to facilitate the detection of fraud and the  recovery of improper payments. This working group and the library  should help agencies to coordinate their fraud detection efforts and  improve their ability to use data analytics to monitor databases for  potential improper payments. The billions of dollars of improper  payments are a central part of the Medicare Program, Medicaid  Program, and Enforcement of Tax Laws (Earned Income Tax Credit)  high-risk areas.
IT Acquisition Reform, Legislation known as the Federal  Information Technology Acquisition Reform Act (FITARA):  FITARA, enacted in December 2014, was intended to improve how  agencies acquire IT and enable Congress to monitor agencies’  progress and hold them accountable for reducing duplication and  achieving cost savings. FITARA includes specific requirements  related to seven areas: the federal data center consolidation initiative,  enhanced transparency and improved risk management, agency  Chief Information Officer authority enhancements, portfolio review,  expansion of training and use of IT acquisition cadres, government- wide software purchasing, and maximizing the benefit of the federal  strategic sourcing initiative. Effective implementation of FITARA is  central to making progress in the Improving the Management of IT  Acquisitions and Operations government-wide area we added to the  High-Risk List in 2015.
section_title: High-Risk Areas Highlighted for Significant Attention
paragraphs: In the 2 years since the last high-risk update, two areas—Mitigating Gaps  in Weather Satellite Data and Management of Federal Oil and Gas  Resources—have expanded in scope because of emerging challenges  related to these overall high-risk areas. In addition, while progress is  needed across all high-risk areas, particular areas need significant  attention.
subsections: section_title: Expanding High-Risk Area: Mitigating Gaps in DOD Weather Satellite Data
subsections: section_title: DOD’s Polar-Orbiting Weather Satellites
paragraphs: While NOAA has made significant progress, as described earlier, in its  geostationary weather satellite program, DOD has made limited progress  in meeting its requirements for the polar satellite program. In 2010, when  the Executive Office of the President decided to disband a tri-agency  polar weather satellite program, DOD was given responsibility for  providing polar-orbiting weather satellite capabilities in the early morning  orbit. This information is used to provide updated information for weather  observations and models. However, the department was slow to develop  plans to replace the existing satellites that provide this coverage.  Because DOD delayed establishing plans for its next generation of  weather satellites, there is a risk of a satellite data gap in the early  morning orbit.
The last satellite that the department launched in 2014 called Defense  Meteorological Satellite Program (DMSP)-19, stopped providing recorded  data used in weather models in February 2016. A prior satellite, called  DMSP-17, is now the primary satellite operating in the early morning orbit.  However, this satellite, which was launched in 2006, is operating with  limitations due to the age of its instruments. DOD had developed another  satellite, called DMSP-20, but plans to launch that satellite were canceled  after the department did not certify that it would launch the satellite by the  end of calendar year 2016.
The department conducted a requirements review and analysis of  alternatives from February 2012 through September 2014 to determine  the best way forward for providing needed polar-orbiting satellite  environmental capabilities in the early morning orbit. In October 2016,  DOD approved plans for its next generation of weather satellites, called  the Weather System Follow-on—Microwave program, which will meet the  department’s needs for satellite information on oceanic wind speed and  direction to protect ships on the ocean’s surface. The department plans to  launch a demonstration satellite in 2017 and to launch its first operational  satellite developed under this program in 2022. However, DOD’s plans for  the early morning orbit are not comprehensive.
The department did not thoroughly assess options for providing its two  highest-priority capabilities, cloud descriptions and area-specific weather  imagery. These capabilities were not addressed due to an incorrect  assumption about the capabilities that would be provided by international  partners. The Weather System Follow-on—Microwave program does not  address these two highest-priority capabilities and the department has not  yet determined its long-term plans for providing these capabilities. As a  result, the department will need to continue to rely on the older DMSP-17  satellite until its new satellite becomes operational in 2022, and it  establishes and implements plans to address the high-priority capabilities  that the new satellite will not address. Given the age of the DMSP-17  satellite and uncertainty on how much longer it will last, the department  could face a gap in critical satellite data.
In August 2016, DOD reported to Congress its near-term plans to address  potential satellite data gaps. These plans include a greater reliance on  international partner capabilities, exploring options to move a  geostationary satellite over an affected region, and plans to explore  options for acquiring and fielding new equipment, such as satellites and  satellite components to provide the capabilities. In addition, the  department anticipates that the demonstration satellite to be developed  as a precursor to the Weather System Follow-on—Microwave program  could help mitigate a potential gap by providing some useable data.  However, these proposed solutions may not be available in time or be  comprehensive enough to avoid near-term coverage gaps. Such a gap  could negatively affect military operations that depend on weather data,  such as long-range strike capabilities and aerial refueling.
DOD needs to demonstrate progress on its new Weather Satellite Follow- on—Microwave program and to establish and implement plans to address  the high-priority capabilities that are not included in the program.  Additional information on Mitigating Gaps in Weather Satellite Data is  provided on page 430 of the high-risk report.
section_title: Expanding High-Risk Area: Management of Federal Oil and Gas Resources
subsections: section_title: Restructuring of Offshore Oil and Gas Oversight
paragraphs: On April 20, 2010, the Deepwater Horizon drilling rig exploded in the Gulf  of Mexico, resulting in 11 deaths, serious injuries, and the largest marine  oil spill in U.S. history. In response, in May 2010, the Department of the  Interior (Interior) first reorganized its offshore oil and gas management  activities into separate offices for revenue collection, under the Office of  Natural Resources Revenue, and energy development and regulatory  oversight, under the Bureau of Ocean Energy Management, Regulation  and Enforcement. Later, in October 2011, Interior further reorganized its  energy development and regulatory oversight activities when it  established two new bureaus to oversee offshore resources and  operational compliance with environmental and safety requirements. The  new Bureau of Ocean Energy Management (BOEM) is responsible for  leasing and approving offshore development plans while the new Bureau  of Safety and Environmental Enforcement (BSEE) is responsible for lease  operations, safety, and enforcement.
In 2011, we added Interior’s management of federal oil and gas resources  to the High-Risk List based on three concerns: (1) Interior did not have  reasonable assurance that it was collecting its share of billions of dollars  of revenue from federal oil and gas resources; (2) Interior continued to  experience problems hiring, training, and retaining sufficient staff to  oversee and manage federal oil and gas resources; and (3) Interior was  engaged in restructuring its oil and gas program, which is inherently  challenging, and there were questions about whether Interior had the  capacity to reorganize while carrying out its range of responsibilities,  especially in a constrained resource environment.
Immediately after reorganizing, Interior developed memorandums and  standard operating procedures to define roles and responsibilities, and  facilitate and formalize coordination between BOEM and BSEE. Interior  also revised polices intended to improve its oversight of offshore oil and  gas activities, such as new requirements designed to mitigate the risk of a  subsea well blowout or spill. In 2013, we determined that progress had  been made, because Interior had fundamentally completed reorganizing  its oversight of offshore oil and gas activities. As a result, in 2013, we  removed the reorganization segment from this high-risk area.
However, in February 2016, we reported that BSEE had undertaken  various reform efforts since its creation in 2011, but had not fully  addressed deficiencies in its investigative, environmental compliance, and  enforcement capabilities identified by investigations after the Deepwater  Horizon incident.
BSEE’s ongoing restructuring has made limited progress enhancing the  bureau’s investigative capabilities. BSEE continues to use pre– Deepwater Horizon incident policies and procedures. Specifically, BSEE  has not completed a policy outlining investigative responsibilities or  updated procedures for investigating incidents—among the goals of  BSEE’s restructuring, according to restructuring planning documents, and  consistent with federal standards for internal control. The use of outdated  investigative policies and procedures is a long-standing deficiency. Post– Deepwater Horizon incident investigations found that Interior’s policies  and procedures did not require it to plan investigations, gather and  document evidence, and ensure quality control, and determined that  continuing to use them posed a risk to the effectiveness of bureau  investigations. Without completing and updating its investigative policies  and procedures, BSEE continues to face this risk.
BSEE’s ongoing restructuring of its environmental compliance program  reverses actions taken to address post–Deepwater Horizon incident  concerns, and risks weakening the bureau’s environmental compliance  oversight capabilities. In 2011, in response to two post–Deepwater  Horizon incident investigations that found that BSEE’s predecessor’s  focus on oil and gas development might have been at the expense of  protecting the environment, BSEE created an environmental oversight  division with region-based staff reporting directly to the headquarters- based division chief instead of regional management. This reporting  structure was to help ensure that environmental issues received  appropriate weight and consideration within the bureau.
Under the restructuring, since February 2015, field-based environmental  compliance staff again report to their regional directors. BSEE’s rationale  for this action is unclear, as it was not documented or analyzed as part of  the bureau’s restructuring planning. Under federal standards for internal  control, management is to assess the risks posed by external and internal  sources and decide what actions to take to mitigate them. Without  assessing the risk of reversing its reporting structure, Interior cannot be  sure that BSEE will have reasonable assurance that environmental issues  are receiving the appropriate weight and consideration, as called for by  post–Deepwater Horizon incident investigations.
When we reviewed BSEE’s environmental compliance program, we found  that the interagency agreements between Interior and EPA designed to  coordinate water quality monitoring under the National Pollutant  Discharge Elimination System were decades old. According to BSEE  annual environmental compliance activity reports, the agreements may  not reflect the agency’s current resources and needs. For example, a  1989 agreement stipulates that Interior shall inspect no more than 50  facilities on behalf of EPA per year, and shall not conduct water sampling  on behalf of EPA. Almost 30 years later, after numerous changes in  drilling practices and technologies, it is unclear whether inspecting no  more than 50 facilities per year is sufficient to monitor water quality.
Nevertheless, senior BSEE officials told us that the bureau has no plans  to update its agreements with EPA, and some officials said that a  previous headquarters-led effort to update the agreements was not  completed because it did not sufficiently describe the bureau’s offshore oil  and gas responsibilities. According to Standards for Internal Control in the  Federal Government, as programs change and agencies strive to improve  operational processes and adopt new technologies, management officials  must continually assess and evaluate internal controls to ensure that  control activities are effective and updated when necessary.
BSEE’s ongoing restructuring has made limited progress in enhancing its  enforcement capabilities. In particular, BSEE has not developed  procedures with criteria to guide how it uses enforcement tools—such as  warnings and fines—which are among the goals of BSEE’s restructuring,  according to planning documents, and consistent with federal standards  for internal control. BSEE restructuring plans state that the current lack of  criteria causes BSEE to act inconsistently, which makes oil and gas  industry operators uncertain about BSEE’s oversight approach and  expectations. The absence of enforcement climate criteria is a long- standing deficiency. For example, post–Deepwater Horizon incident  investigations recommended BSEE assess its enforcement tools and how  to employ them to deter safety and environmental violations. Without  developing procedures with defined criteria for taking enforcement  actions, BSEE continues to face risks to the effectiveness of its  enforcement capabilities.
To enhance Interior’s oversight of oil and gas development, we  recommended in February 2016 that the Secretary of the Interior direct  the Director of BSEE to take the following nine actions as it continues to  restructure.
To address risks to the effectiveness of BSEE’s investigations,  environmental compliance, and enforcement capabilities, we  recommended that BSEE complete policies outlining the  responsibilities of investigations, environmental compliance, and  enforcement programs, and update and develop procedures to guide  them.
To enhance its investigative capabilities, we recommended that BSEE establish a capability to review investigation policy and collect and  analyze incidents to identify trends in safety and environmental  hazards; develop a plan with milestones for implementing the case  management system for investigations;  clearly communicate the purpose of BSEE’s investigations  program to industry operators; and  clarify policies and procedures for assigning panel investigation  membership and referring cases of suspected criminal  wrongdoing to the Inspector General.
To enhance its environmental compliance capabilities, we  conduct and document a risk analysis of the regional-based  reporting structure of its Environmental Compliance Division,  including actions to mitigate any identified risks;  coordinate with the Administrator of the Environmental Protection  Agency to consider the relevance of existing interagency  agreements for monitoring operator compliance with National  Pollutant Discharge Elimination System permits on the Outer  Continental Shelf and, if necessary, update agreements to reflect  current oversight needs; and develop a plan to address documented environmental oversight  staffing needs.
To enhance its enforcement capabilities, we recommended that BSEE  develop a mechanism to ensure that it reviews the maximum daily  civil penalty and adjusts it to reflect changes in the Consumer Price  Index within the time frames established by statute.
In its written comments, Interior agreed that additional reforms—such as  documented policies and procedures—are needed to address offshore oil  and gas oversight deficiencies, but Interior neither agreed nor disagreed  with our specific recommendations. Additional information on  Management of Federal Oil and Gas Resources is provided on page 136  of the high-risk report.
section_title: Additional High-Risk Areas Needing Significant Attention
paragraphs: Managing Risks and Improving VA Health Care. Since we added  Department of Veterans Affairs (VA) health care to our High-Risk List  in 2015, VA has acknowledged the significant scope of the work that  lies ahead in each of the five areas of concern we identified: (1)  ambiguous policies and inconsistent processes; (2) inadequate  oversight and accountability; (3) information technology (IT)  challenges; (4) inadequate training for VA staff; and (5) unclear  resource needs and allocation priorities. It is imperative that VA  maintain strong leadership support, and as the new administration  sets its priorities, VA will need to integrate those priorities with its  high-risk related actions.
VA developed an action plan for addressing its high-risk designation,  but the plan describes many planned outcomes with overly ambitious  deadlines for completion. We are concerned about the lack of root  cause analyses for most areas of concern, and the lack of clear  metrics and needed resources for achieving stated outcomes. In  addition, with the increased use of community care programs, it is  imperative that VA’s action plan discuss the role of community care in  decisions related to policies, oversight, IT, training, and resource  needs.
Finally, to help address its high-risk designation, VA should continue  to implement our recommendations, as well as recommendations  from others. While VA’s leadership has increased its focus on  implementing our recommendations in the last 2 years, additional  work is needed. We made 66 VA health care-related  recommendations in products issued since the VA health care high- risk designation in February 2015, for a total of 244 recommendations  from January 1, 2010, through December 31, 2016. VA has  implemented 122 (about 50 percent) of the 244 recommendations, but  over 100 recommendations remain open as of December 31, 2016  (with about 25 percent being open for 3 or more years). It is critical  that VA implement our recommendations in a timely manner.
Additional information on Managing Risks and Improving VA Health  Care is provided on page 627 of the report.
DOD Financial Management. The effects of DOD’s financial  management problems extend beyond financial reporting and  negatively affect DOD’s ability to manage the department and make  sound decisions on mission and operations. In addition, DOD remains  one of the few federal entities that cannot demonstrate its ability to  accurately account for and reliably report its spending or assets.  DOD’s financial management problems continue as one of three  major impediments preventing us from expressing an opinion on the  consolidated financial statements of the federal government.
Sustained leadership commitment will be critical to DOD’s success in  achieving financial accountability, and in providing reliable information  for day-to-day management decision making as well as financial audit  readiness. DOD needs to assure the sustained involvement of  leadership at all levels of the department in addressing financial  management reform and business transformation. In addition, further  action is needed in the areas of capacity and action planning.  Specifically, DOD needs to  continue building a workforce with the level of training and  experience needed to support and sustain sound financial  management;  continue to develop and deploy enterprise resource planning  systems as a critical component of DOD’s financial improvement  and audit readiness strategy, as well as strengthen automated  controls or design manual workarounds for the remaining legacy  systems to satisfy audit requirements and improve data used for  day-to-day decision making; and effectively implement its Financial Improvement and Audit  Readiness Plan and related guidance to focus on strengthening  processes, controls, and systems to improve the accuracy,  reliability, and reporting for its priority areas, including budgetary  information and mission-critical assets.
Further, DOD needs to monitor and assess the progress the  department is making to remediate its internal control deficiencies.  DOD should (1) require the military services to improve their policies  and procedures for monitoring their corrective action plans for  financial management-related findings and recommendations, and (2)  improve its process for monitoring the military services’ audit  remediation efforts by preparing a consolidated management  summary that provides a comprehensive picture of the status of  corrective actions throughout the department. DOD is continuing to  work toward undergoing a full financial statement audit by fiscal year  2018; however, it expects to receive disclaimers of opinion on its  financial statements for a number of years.
A lack of comprehensive information on the corrective action plans  limits the ability of DOD and Congress to evaluate DOD’s progress  toward achieving audit readiness, especially given the short amount of  time remaining before DOD is required to undergo an audit of the  department-wide financial statements for fiscal year 2018. Being able  to demonstrate progress in remediating its financial management  deficiencies will be useful as the department works toward  implementing lasting financial management reform to ensure that it  can generate reliable, useful, and timely information for financial  reporting as well as for decision making and effective operations.  Moreover, stronger financial management would show DOD’s  accountability for funds and would help it operate more efficiently.
Additional information on DOD Financial Management is provided on  page 280 of the high-risk report.
Modernizing the U.S. Financial Regulatory System and the  Federal Role in Housing Finance. Resolving the role of the federal  government in housing finance will require leadership commitment  and action by Congress and the administration. The federal  government has directly or indirectly supported more than two-thirds  of the value of new mortgage originations in the single-family housing  market since the beginning of the 2007-2009 financial crisis.  Mortgages with federal support include those backed by Fannie Mae  and Freddie Mac, two large government-sponsored enterprises (the  enterprises). Out of concern that their deteriorating financial condition  threatened the stability of financial markets, the Federal Housing  Finance Agency (FHFA) placed the enterprises into federal  conservatorship in 2008, creating an explicit fiscal exposure for the  federal government. As of September 2016, the Department of the  Treasury (Treasury) had provided about $187.5 billion in funds as  capital support to the enterprises, with an additional $258.1 billion  available to the enterprises should they need further assistance. In  accordance with the terms of agreements with Treasury, the  enterprises had paid dividends to Treasury totaling about $250.5  billion through September 2016.
More than 8 years after entering conservatorship, the enterprises’  futures remain uncertain and billions of federal dollars remain at risk.  The enterprises have a reduced capacity to absorb future losses due  to a capital reserve amount that falls to $0 by 2018. Without a capital  reserve, any quarterly losses—including those due to market  fluctuations and not necessarily to economic conditions—would  require the enterprises to draw additional funds from Treasury.  Additionally, prolonged conservatorships and a change in leadership  at FHFA could shift priorities for the conservatorships, which in turn  could send mixed messages and create uncertainties for market  participants and hinder the development of the broader secondary  mortgage market. For this reason, we said in November 2016 that  Congress should consider legislation establishing objectives for the  future federal role in housing finance, including the structure of the  enterprises, and a transition plan to a reformed housing finance  system that enables the enterprises to exit conservatorship.
The federal government also supports mortgages through insurance  or guarantee programs, the largest of which is administered by the  Department of Housing and Urban Development’s Federal Housing  Administration (FHA). During the financial crisis, FHA served its  traditional role of helping to stabilize the housing market, but also  experienced financial difficulties from which it only recently recovered.  Maintaining FHA’s long-term financial health and defining its future  role also will be critical to any effort to overhaul the housing finance  system.
We previously recommended that Congress or FHA specify the  economic conditions that FHA’s Mutual Mortgage Insurance Fund  would be expected to withstand without requiring supplemental funds.  As evidenced by the $1.68 billion FHA received in 2013, the current 2  percent capital requirement for FHA’s fund may not always be  adequate to avoid the need for supplemental funds under severe  stress scenarios. Implementing our recommendation would be an  important step not only in addressing FHA’s long-term financial  viability, but also in clarifying FHA’s role.
Additional information on Modernizing the U.S. Financial Regulatory  System and the Federal Role in Housing Finance is provided on page  107 of the report.
Pension Benefit Guaranty Corporation Insurance Programs. The  Pension Benefit Guaranty Corporation (PBGC) is responsible for  insuring the defined benefit pension plans of nearly 40 million  American workers and retirees who participate in nearly 24,000  private sector plans. PBGC faces an uncertain financial future due, in  part, to a long-term decline in the number of traditional defined benefit  plans and the collective financial risk of the many underfunded  pension plans that PBGC insures. PBGC’s financial portfolio is one of  the largest of all federal government corporations and, at the end of  fiscal year 2016, PBGC’s net accumulated financial deficit was over  $79 billion—having more than doubled since fiscal year 2013. PBGC  has estimated that, without additional funding, its multiemployer  insurance program will likely be exhausted by 2025 as a result of  current and projected pension plan insolvencies. The agency’s single- employer insurance program is also at risk due to the continuing  decline of traditional defined benefit pension plans, increased financial  risk and reduced premium payments.
While Congress and PBGC have taken significant and positive steps  to strengthen the agency over recent years, challenges related to  PBGC’s funding and governance structure remain. Addressing the  significant financial risk and governance challenges that PBGC faces  requires additional congressional action. To improve the long-term  financial stability of PBGC’s insurance programs, Congress should  consider: (1) authorizing a redesign of PBGC’s single employer  program premium structure to better align rates with sponsor risk; (2)  adopting additional changes to PBGC’s governance structure—in  particular, expanding the composition of its board of directors; (3)  strengthening funding requirements for plan sponsors as appropriate  given national economic conditions; (4) working with PBGC to develop  a strategy for funding PBGC claims over the long term, as the defined  benefit pension system continues to decline; and (5) enacting  additional structural reforms to reinforce and stabilize the  multiemployer system that balance the needs and potential sacrifices  of contributing employers, participants and the federal government.  Absent additional steps to improve PBGC’s finances, the long-term  financial stability of the agency remains uncertain and the retirement  benefits of millions of American workers and retirees could be at risk  of dramatic reductions.
Additional information on Pension Benefit Guaranty Corporation  Insurance Programs is provided on page 609 of the report.
Ensuring the Security of Federal Information Systems and Cyber  Critical Infrastructure and Protecting the Privacy of Personally  Identifiable Information. Federal agencies and our nation’s critical  infrastructures—such as energy, transportation systems,  communications, and financial services—are dependent on  computerized (cyber) information systems and electronic data to carry  out operations and to process, maintain, and report essential  information. The security of these systems and data is vital to public  confidence and the nation’s safety, prosperity, and well-being.  However, safeguarding computer systems and data supporting the  federal government and the nation’s critical infrastructure is a  concern. We first designated information security as a government- wide high-risk area in 1997.
This high-risk area was expanded to include the protection of critical  cyber infrastructure in 2003 and protecting the privacy of personally  identifiable information (PII) in 2015. Ineffectively protecting cyber  assets can facilitate security incidents and cyberattacks that disrupt  critical operations; lead to inappropriate access to and disclosure,  modification, or destruction of sensitive information; and threaten  national security, economic well-being, and public health and safety.  In addition, the increasing sophistication of hackers and others with  malicious intent, and the extent to which both federal agencies and  private companies collect sensitive information about individuals, have  increased the risk of PII being exposed and compromised.
Over the past several years, we have made about 2,500  recommendations to agencies aimed at improving the security of  federal systems and information. These recommendations would help  agencies strengthen technical security controls over their computer  networks and systems, fully implement aspects of their information  security programs, and protect the privacy of PII held on their  systems. As of October 2016, about 1,000 of our information security– related recommendations had not been implemented. In addition, the  federal government needs, among other things, to improve its abilities  to detect, respond to, and mitigate cyber incidents; expand efforts to  protect cyber critical infrastructure; and oversee the protection of PII,  among other things.
Additional information on Ensuring the Security of Federal Information  Systems and Cyber Critical Infrastructure and Protecting the Privacy  of Personally Identifiable Information is provided on page 338 of the  report.
section_title: New High-Risk Areas
paragraphs: For 2017, we are adding three new areas to the High-Risk List.
subsections: section_title: Improving Federal Management of Programs That Serve Tribes and Their Members
paragraphs: We, along with inspectors general, special commissions, and others,  have reported that federal agencies have ineffectively administered Indian  education and health care programs, and inefficiently fulfilled their  responsibilities for managing the development of Indian energy  resources. In particular, we have found numerous challenges facing  Interior’s Bureau of Indian Education (BIE) and Bureau of Indian Affairs  (BIA) and the Department of Health and Human Services’ (HHS) Indian  Health Service (IHS) in administering education and health care services,  which put the health and safety of American Indians served by these  programs at risk. These challenges included poor conditions at BIE  school facilities that endangered students, and inadequate oversight of  health care that hindered IHS’s ability to ensure quality care to Indian  communities. In addition, we have reported that BIA mismanages Indian  energy resources held in trust and thereby limits opportunities for tribes  and their members to use those resources to create economic benefits  and improve the well-being of their communities.
Congress recently noted, “through treaties, statutes, and historical  relations with Indian tribes, the United States has undertaken a unique  trust responsibility to protect and support Indian tribes and Indians.” In  light of this unique trust responsibility and concerns about the federal  government ineffectively administering Indian education and health care  programs and mismanaging Indian energy resources, we are adding  these programs as a high-risk issue because they uniquely affect tribal  nations and their members.
Federal agencies have performed poorly in the following broad areas: (1)  oversight of federal activities; (2) collaboration and communication; (3)  federal workforce planning; (4) equipment, technology, and infrastructure;  and (5) federal agencies’ data. While federal agencies have taken some  actions to address the 41 recommendations we made related to Indian  programs, there are currently 39 that have yet to be fully resolved.
We plan to continue monitoring federal efforts in these areas. To this end,  we have ongoing work focusing on accountability for safe schools and  school construction, and tribal control of energy delivery, management,  and resource development.
subsections: section_title: What Needs to Be Done
paragraphs: Education: We have identified weaknesses in how Indian Affairs  oversees school safety and construction and in how it monitors the way  schools use Interior funds. We have also found limited workforce planning  in several key areas related to BIE schools. Moreover, aging BIE school  facilities and equipment contribute to degraded and unsafe conditions for  students and staff. Finally, a lack of internal controls and other  weaknesses hinder Indian Affairs’ ability to collect complete and accurate  information on the physical conditions of BIE schools.
In the past 3 years, we issued three reports on challenges with Indian  Affairs’ management of BIE schools in which we made 13  recommendations. Eleven recommendations below remain open.
To help ensure that BIE schools provide safe and healthy facilities for  students and staff, we made four recommendations which remain  open, including that Indian Affairs ensure the inspection information it  collects on BIE schools is complete and accurate; develop a plan to  build schools’ capacity to promptly address safety and health  deficiencies; and consistently monitor whether BIE schools have  established required safety committees.
To help ensure that BIE conducts more effective oversight of school  spending, we made four recommendations which remain open,  including that Indian Affairs develop a workforce plan to ensure that  BIE has the staff to effectively oversee school spending; put in place  written procedures and a risk-based approach to guide BIE in  overseeing school spending; and improve information sharing to  support the oversight of BIE school spending.
To help ensure that Indian Affairs improves how it manages Indian  education, we made five recommendations. Three recommendations  remain open, including that Indian Affairs develop a strategic plan for  BIE that includes goals and performance measures for how its offices  are fulfilling their responsibilities to provide BIE with support; revise  Indian Affairs’ strategic workforce plan to ensure that BIA regional  offices have an appropriate number of staff with the right skills to  support BIE schools in their regions; and develop and implement  decision-making procedures for BIE to improve accountability for BIE  schools.
Health Care: IHS provides inadequate oversight of health care, both of its  federally operated facilities and through the Purchase Referred Care  program (PRC). Other issues include ineffective collaboration— specifically, IHS does not require its area offices to inform IHS  headquarters if they distribute funds to local PRC programs using  different criteria than the PRC allocation formula suggested by  headquarters. As a result, IHS may be unaware of additional funding  variation across areas. We have also reported that IHS officials told us  that an insufficient workforce was the biggest impediment to ensuring  patients could access timely primary care.
In the past 6 years, we have made 12 recommendations related to Indian  health care that remain open. Although IHS has taken several actions in  response to our recommendations, such as improving the data collected  for the PRC program and adopting Medicare-like rates for nonhospital  services, much more needs to be done.
To help ensure that Indian people receive quality health care, the  Secretary of HHS should direct the Director of IHS to take the  following two actions: (1) as part of implementing IHS’s quality  framework, ensure that agency-wide standards for the quality of care  provided in its federally operated facilities are developed, and  systematically monitor facility performance in meeting these standards  over time; and (2) develop contingency and succession plans for  replacing key personnel, including area directors.
To help ensure that timely primary care is available and accessible to  Indians, IHS should: (1) develop and communicate specific agency- wide standards for wait times in federally-operated facilities, and (2)  monitor patient wait times in federally-operated facilities and ensure  that corrective actions are taken when standards are not met.
To help ensure that IHS has meaningful information on the timeliness  with which it issues purchase orders authorizing payment under the  PRC program, and to improve the timeliness of payments to  providers, we recommended that IHS: (1) modify IHS’s claims  payment system to separately track IHS referrals and self-referrals,  revise Government Performance and Results Act measures for the  PRC program so that it distinguishes between these two types of  referrals, and establish separate time frame targets for these referral  types; and (2) better align PRC staffing levels and workloads by  revising its current practices, where available, used to pay for PRC  program staff. In addition, as HHS and IHS monitor the effect that new  coverage options available to IHS beneficiaries through PPACA have  on PRC funds, we recommend that IHS concurrently develop potential  options to streamline requirements for program eligibility.
To help ensure successful outreach efforts regarding PPACA  coverage expansions, we recommended that IHS realign current  resources and personnel to increase capacity to deal with enrollment  in Medicaid and the exchanges, and prepare for increased billing to  these payers.
If payments for physician and other nonhospital services are capped,  we recommended that IHS monitor patient access to these services.
To help ensure a more equitable allocation of funds per capita across  areas, we recommended that Congress consider requiring IHS to  develop and use a new method for allocating PRC funds.
To develop more accurate data for estimating the funds needed for  the PRC program and improve IHS oversight, we recommended that  IHS develop a written policy documenting how it evaluates the need  for the PRC program, and disseminate it to area offices so they  understand how unfunded services data are used to estimate overall  program needs. We also recommended that IHS develop written  guidance for PRC programs outlining a process to use when funds  are depleted but recipients continue to need services.
Energy: We have reported on issues with BIA oversight of federal  activities, such as the length of time it takes the agency to review energy- related documents. We also reported on challenges with collaboration—in  particular, while working to form an Indian Energy Service Center, BIA did  not coordinate with key regulatory agencies, including the Department of  the Interior’s Fish and Wildlife Service, the U.S. Army Corps of Engineers,  and the Environmental Protection Agency. In addition, we found  workforce planning issues at BIA contribute to management shortcomings  that have hindered Indian energy development. Lastly, we found issues  with outdated and deteriorating equipment, technology, and infrastructure,  as well as incomplete and inaccurate data.
In the past 2 years, we issued three reports on developing Indian energy  resources in which we made 14 recommendations to BIA. All  recommendations remain open.
To help ensure BIA can verify ownership in a timely manner and  identify resources available for development, we made two  recommendations, including that Interior take steps to improve its  geographic information system mapping capabilities.
To help ensure BIA’s review process is efficient and transparent, we  made two recommendations, including that Interior take steps to  develop a documented process to track review and response times for  energy-related documents that must be approved before tribes can  develop energy resources.
To help improve clarity of tribal energy resource agreement  regulations, we recommended BIA provide additional guidance to  tribes on provisions that tribes have identified to Interior as unclear.
To help ensure that BIA streamlines the review and approval process  for revenue-sharing agreements, we made three recommendations,  including that Interior establish time frames for the review and  approval of Indian revenue-sharing agreements for oil and gas, and  establish a system for tracking and monitoring the review and  approval process to determine whether time frames are met.
To help improve efficiencies in the federal regulatory process, we  made four recommendations, including that BIA take steps to  coordinate with other regulatory agencies so the Service Center can  serve as a single point of contact or lead agency to navigate the  regulatory process.
To help ensure that BIA has a workforce with the right skills,  appropriately aligned to meet the agency’s goals and tribal priorities,  we made two recommendations, including that BIA establish a  documented process for assessing BIA’s workforce composition at  agency offices.
Congressional Actions Needed: It is critical that Congress maintain its  focus on improving the effectiveness with which federal agencies meet  their responsibilities to serve tribes and their members. Since 2013, we  testified at six hearings to address significant weaknesses we found in the  federal management of programs that serve tribes and their members.  Sustained congressional attention to these issues will highlight the  challenges discussed here and could facilitate federal actions to improve  Indian education and health care programs, and the development of  Indian energy resources.
See pages 200-219 of the high-risk report for additional details on what  we found.
section_title: U.S. Government’s Environmental Liabilities
paragraphs: The federal government’s environmental liability has been growing for the  past 20 years and is likely to continue to increase. For fiscal year 2016,  the federal government’s estimated environmental liability was $447  billion—up from $212 billion for fiscal year 1997. However, this estimate  does not reflect all of the future cleanup responsibilities facing federal  agencies. Because of the lack of complete information and the often  inconsistent approach to making cleanup decisions, federal agencies  cannot always address their environmental liabilities in ways that  maximize the reduction of health and safety risks to the public and the  environment in a cost-effective manner.
The federal government is financially liable for cleaning up areas where  federal activities have contaminated the environment. Various federal  laws, agreements with states, and court decisions require the federal  government to clean up environmental hazards at federal sites and  facilities—such as nuclear weapons production facilities and military  installations. Such sites are contaminated by many types of waste, much  of which is highly hazardous.
Federal accounting standards require agencies responsible for cleaning  up contamination to estimate future cleanup and waste disposal costs,  and to report such costs in their annual financial statements as  environmental liabilities. Per federal accounting standards, federal  agencies’ environmental liability estimates are to include probable and  reasonably estimable costs of cleanup work. Federal agencies’  environmental liability estimates do not include cost estimates for work for  which reasonable estimates cannot currently be generated.  Consequently, the ultimate cost of addressing the U.S. government’s  environmental cleanup is likely greater than $447 billion. Federal  agencies’ approaches to addressing their environmental liabilities and  cleaning up the contamination from past activities are often influenced by  numerous site-specific factors, stakeholder agreements, and legal  provisions.
We have also found that some agencies do not take a holistic, risk- informed approach to environmental cleanup that aligns limited funds with  the greatest risks to human health and the environment. Since 1994, we  have made at least 28 recommendations related to addressing the federal  government’s environmental liability. These include 22 recommendations  to the Departments of Energy (DOE) or Defense (DOD), 1  recommendation to OMB to consult with Congress on agencies’  environmental cleanup costs, and 4 recommendations to Congress to  change the laws governing cleanup activities. Of these, 13  recommendations remain unimplemented. If implemented, these steps  would improve the completeness and reliability of the estimated costs of  future cleanup responsibilities, and lead to more risk-based management  of the cleanup work.
subsections: section_title: What Needs to Be Done
paragraphs: Of the federal government’s estimated $447 billion environmental liability,  DOE is responsible for by far the largest share of the liability, and DOD is  responsible for the second largest share. The rest of the federal  government makes up the remaining 3 percent of the liability with  agencies such as the National Aeronautics and Space Administration  (NASA) and the Departments of Transportation, Veteran’s Affairs,  Agriculture (USDA), and Interior holding large liabilities (see figure 2).
Agencies spend billions each year on environmental cleanup efforts but  the estimated environmental liability continues to rise. For example,  despite billions spent on environmental cleanup, DOE’s environmental  liability has roughly doubled from a low of $176 billion in fiscal year 1997  to the fiscal year 2016 estimate of $372 billion. In the last 6 years alone,  DOE’s Office of Environmental Management (EM) has spent $35 billion,  primarily to treat and dispose of nuclear and hazardous waste, and  construct capital asset projects to treat the waste; however, EM’s portion  of the environmental liability has grown over this same time period by  over $90 billion, from $163 billion to $257 billion (see figure 3).
Progress in addressing the U.S. government’s environmental liabilities  depends on how effectively federal departments and agencies set  priorities, under increasingly restrictive budgets, that maximize the risk  reduction and cost-effectiveness of cleanup approaches. As a first step,  some departments and agencies may need to improve the completeness  of information about long-term cleanup responsibilities and their  associated costs so that decision makers, including Congress, can  consider the full scope of the federal government’s cleanup obligations.  As a next step, certain departments, such as DOE, may need to change  how they establish cleanup priorities. For example, DOE’s current  practice of negotiating agreements with individual sites without  considering other sites’ agreements or available resources may not  ensure that limited resources will be allocated to reducing the greatest  environmental risks, and costs will be minimized.
We have recommended actions to federal agencies that, if implemented,  would improve the completeness and reliability of the estimated costs of  future cleanup responsibilities, and lead to more risk-based management  of the cleanup work. These recommendations include the following.
section_title: Completeness of Environmental Liability Estimates
paragraphs: In 1994, we recommended that Congress amend certain legislation to  require agencies to report annually on progress in implementing plans  for completing site inventories, estimates of the total costs to clean up  their potential hazardous waste sites, and agencies’ progress toward  completing their site inventories and on their latest estimates of total  cleanup costs. We believe these recommendations are as relevant, if  not more so, today.
In 2015, we recommended that USDA develop plans and procedures  for completing its inventories of potentially contaminated sites. USDA  disagreed with this recommendation. However, we continue to believe  that USDA’s inventory of contaminated and potentially contaminated  sites—in particular, abandoned mines, primarily on Forest Service  land—is insufficient for effectively managing USDA’s overall cleanup  program. Interior is also faced with an incomplete inventory of  abandoned mines that it is working to improve.
section_title: Reliability of Environmental Liability Estimates
paragraphs: In 2006, we recommended that DOD develop, document, and  implement a program for financial management review, assessment,  and monitoring of the processes for estimating and reporting  environmental liabilities. This recommendation has not been  implemented.
section_title: Risk-Based Decision Making
paragraphs: We have found in the past that DOE’s cleanup strategy is not risk  based and should be re-evaluated. DOE’s decisions are often driven  by local stakeholders and certain requirements in federal facilities  agreements and consent decrees. In 1995, we recommended that  DOE set national priorities for cleaning up its contaminated sites using  data gathered during ongoing risk evaluations. This recommendation  has not been implemented.
In 2003, we recommended that DOE ask Congress to clarify its  authority for designating certain waste with relatively low levels of  radioactivity as waste incidental to reprocessing, and therefore not  managed as high-level waste. In 2004, DOE received this specific  authority from Congress for the Savannah River and Idaho Sites,  thereby allowing DOE to save billions of dollars in waste treatment  costs. The law, however, excluded the Hanford Site.
More recently, in 2015, we found that DOE is not comprehensively  integrating risks posed by National Nuclear Security Administration’s  (NNSA) nonoperational contaminated facilities with EM’s portfolio of  cleanup work. By not integrating nonoperational facilities from  NNSA, EM is not providing Congress with complete information about  EM’s current and future cleanup obligations as Congress deliberates  annually about appropriating funds for cleanup activities. We  recommended that DOE integrate its lists of facilities prioritized for  disposition with all NNSA facilities that meet EM’s transfer  requirements, and that EM should include this integrated list as part of  the Congressional Budget Justification for DOE. DOE neither agreed  nor disagreed with this recommendation.
See pages 232-247 of the high-risk report for additional details on what  we found.
section_title: 2020 Decennial Census
paragraphs: One of the most important functions of the U.S. Census Bureau (Bureau)  is conducting the decennial census of the U.S. population, which is  mandated by the Constitution and provides vital data for the nation. This  information is used to apportion the seats of the U.S. House of  Representatives; realign the boundaries of the legislative districts of each  state; allocate billions of dollars in federal financial assistance; and  provide social, demographic, and economic profiles of the nation’s people  to guide policy decisions at each level of government. A complete count  of the nation’s population is an enormous challenge as the Bureau seeks  to control the cost of the census while it implements several new  innovations and manages the processes of acquiring and developing new  and modified IT systems supporting them. Over the past 3 years, we have  made 30 recommendations to help the Bureau design and implement a  more cost-effective census for 2020; however, only 6 of them had been  fully implemented as of January 2017.
The cost of the census, in terms of cost for counting each housing unit,  has been escalating over the last several decennials. The 2010 Census  was the costliest U.S. Census in history at about $12.3 billion, and was  about 31 percent more costly than the $9.4 billion cost of the 2000  Census (in 2020 dollars). The average cost for counting a housing unit  increased from about $16 in 1970 to around $92 in 2010 (in 2020  constant dollars). Meanwhile, the return of census questionnaires by mail  (the primary mode of data collection) declined over this period from 78  percent in 1970 to 63 percent in 2010. Declining mail response rates—a  key indicator of a cost-effective census—are significant and lead to higher  costs. This is because the Bureau sends enumerators to each  nonresponding household to obtain census data. As a result,  nonresponse follow-up is the Bureau’s largest and most costly field  operation. In many ways, the Bureau has had to invest substantially more  resources each decade to match the results of prior enumerations.
The Bureau plans to implement several new innovations in its design of  the 2020 Census. In response to our recommendations regarding past  decennial efforts and other assessments, the Bureau has fundamentally  reexamined its approach for conducting the 2020 Census. Its plan for  2020 includes four broad innovation areas that it believes will save it over  $5 billion (2020 constant dollars) when compared to what it estimates  conducting the census with traditional methods would cost. The Bureau’s  innovations include (1) using the Internet as a self-response option, which  the Bureau has never done on a large scale before; (2) verifying most  addresses using “in-office” procedures and on-screen imagery rather than  street-by-street field canvassing; (3) re-engineering data collection  methods such as by relying on an automated case management system;  and (4) in certain instances, replacing enumerator collection of data with  administrative records (information already provided to federal and state  governments as they administer other programs). These innovations  show promise for a more cost-effective head count. However, they also  introduce new risks, in part, because they include new procedures and  technology that have not been used extensively in earlier decennials, if at  all.
The Bureau is also managing the acquisition and development of new  and modified IT systems, which add complexity to the design of the  census. To help control census costs, the Bureau plans to significantly  change the methods and technology it uses to count the population, such  as offering an option for households to respond to the survey via the  Internet or phone, providing mobile devices for field enumerators to  collect survey data from households, and automating the management of  field operations. This redesign relies on acquiring and developing many  new and modified IT systems, which could add complexity to the design.
These cost risks, new innovations, and acquisition and development of IT  systems for the 2020 Census, along with other challenges we have  identified in recent years, raise serious concerns about the Bureau’s  ability to conduct a cost-effective enumeration. Based on these concerns,  we have concluded that the 2020 Census is a high-risk area and have  added it to the High-Risk List in 2017.
subsections: section_title: What Needs to Be Done
paragraphs: To help the Bureau mitigate the risks associated with its fundamentally  new and complex innovations for the 2020 Census, the commitment of  top leadership is needed to ensure the Bureau’s management, culture,  and business practices align with a cost-effective enumeration. For  example, the Bureau needs to continue strategic workforce planning  efforts to ensure it has the skills and competencies needed to support  planning and executing the census. It must also rigorously test individual  census-taking activities to provide information on their feasibility and  performance, their potential for achieving desired results, and the extent  to which they are able to function together under full operational  conditions.
We have recommended that the Bureau also ensure that its scheduling  adheres to leading practices and be able to support a quantitative  schedule risk assessment, such as by having all activities associated with  the levels of resources and effort needed to complete them. The Bureau  has stated that it has begun maturing project schedules to ensure that the  logical relationships are in place and plans to conduct a quantitative risk  assessment. We will continue to monitor the Bureau’s efforts.
The Bureau must also improve its ability to manage, develop, and secure  its IT systems. For example, the Bureau needs to prioritize its IT  decisions and determine what information it needs in order to make those  decisions. In addition, the Bureau needs to make key IT decisions for the  2020 Census in order to ensure they have enough time to have the  production systems in place to support the end-to-end system test. To  this end, we recommended the Bureau ensure that the methodologies for  answering the Internet response rate and IT infrastructure research  questions are determined and documented in time to inform key design  decisions. Further, given the numerous and critical dependencies  between the Census Enterprise Data Collection and Processing and 2020  Census programs, their parallel implementation tracks, and the 2020  Census’s immovable deadline, we recommended that the Bureau  establish a comprehensive and integrated list of all interdependent risks  facing the two programs, and clearly identify roles and responsibilities for  managing this list. The Bureau stated that it plans to take actions to  address our recommendations.
It is also critical for the Bureau to have better oversight and control over  its cost estimation process and we have recommended that the Bureau  ensure its cost estimate is consistent with our leading practices. For  example, the Bureau will need to, among other practices, document all  cost-influencing assumptions; describe estimating methodologies used for  each cost element; ensure that variances between planned and actual  cost are documented, explained, and reviewed; and include a  comprehensive sensitivity analysis, so that it can better estimate costs.  We also recommended that the Bureau implement and institutionalize  processes or methods for ensuring control over how risk and uncertainty  are accounted for and communicated within its cost estimation process.  The Bureau agreed with our recommendations, and we are currently  conducting a follow-up audit of the Bureau’s most recent cost estimate  and will determine whether the Bureau has implemented them.
Sustained congressional oversight will be essential as well. In 2015 and  2016, congressional committees held five hearings focusing on the  progress of the Bureau’s preparations for the decennial. Going forward,  active oversight will be needed to ensure these efforts stay on track, the  Bureau has needed resources, and Bureau officials are held accountable  for implementing the enumeration as planned.
We will continue monitoring the Bureau’s efforts to conduct a cost- effective enumeration. To this end, we have ongoing work focusing on  such topics as the Bureau’s updated lifecycle cost estimate and the  readiness of IT systems for the 2018 End-to-End Test.
See pages 219–231 of the high-risk report for additional details on what  we found.
section_title: Monitoring Previous High-Risk Areas
paragraphs: After we remove areas from the High-Risk List we continue to monitor  them, as appropriate, to determine if the improvements we have noted  are sustained and whether new issues emerge. If significant problems  again arise, we will consider reapplying the high-risk designation. DOD’s  Personnel Security Clearance Program is one former high-risk area that  we continue to closely monitor in light of government-wide reform efforts.
subsections: section_title: Personnel Security Clearances
paragraphs: The Office of the Director of National Intelligence (ODNI) estimates that  approximately 4.2 million federal government and contractor employees  held or were eligible to hold a security clearance as of October 1, 2015.  Personnel security clearances provide personnel with access to classified  information, the unauthorized disclosure of which could, in certain  circumstances, cause exceptionally grave damage to national security.  High profile security incidents, such as the disclosure of classified  programs and documents by a National Security Agency contractor and  the OPM data breach of 21.5 million records, demonstrate the continued  need for high quality background investigations and adjudications, strong  oversight, and a secure IT process, which have been areas of long- standing challenges for the federal government.
In 2005, we designated the DOD personnel security clearance program,  as a high-risk area because of delays in completing background  investigations and adjudications. We continued the high-risk designation  in the 2007 and 2009 updates to our High-Risk List because of issues  with the quality of investigation and adjudication documentation and  because delays in the timely processing of security clearances  continued.
In our 2011 high-risk report, we removed DOD’s personnel security  clearance program from the High-Risk List because DOD took actions to  develop guidance to improve its adjudication process, develop and  implement tools and metrics to assess quality of investigations and  adjudications, and improve timeliness for processing clearances. We  also noted that DOD continues to be a prominent player in the overall  security clearance reform effort, which includes entities within the OMB,  OPM, and ODNI that comprise the Performance Accountability Council  (PAC) which oversees security clearance reform. The executive branch  has also taken steps to monitor its security clearance reform efforts. The  GPRA Modernization Act of 2010 requires OMB to report through a  website—performance.gov—on long-term cross-agency priority goals,  which are outcome-oriented goals covering a limited number of  crosscutting policy areas, as well as goals to improve management  across the federal government. Among the cross-agency priority goals,  the executive branch identified security clearance reform as one of the  key areas it is monitoring.
Since removing DOD’s personnel security clearance program from the  High-Risk List, the government’s overall reform efforts that began after  passage of the Intelligence Reform and Terrorism Prevention Act of 2004  have had mixed progress, and key reform efforts have not yet been  implemented. In the aftermath of the June 2013 disclosure of classified  documents by a former National Security Agency contractor and the  September 2013 shooting at the Washington Navy Yard, OMB issued, in  February 2014, the Suitability and Security Processes Review Report to  the President, a 120-day review of the government’s processes for  granting security clearances, among other things.
The 120-day review resulted in 37 recommendations, 65 percent of which  have been implemented, as of October 2016, including the issuance of  executive branch-wide quality assessment standards for investigations in  January 2015. Additionally, the recommendations led to expanding  DOD’s ability to continuously evaluate the continued eligibility of cleared  personnel. However, other recommendations from the 120-day review  have not yet been implemented. For example, the reform effort is still  trying to fully implement the revised background investigation standards  issued in 2012 and improve data sharing between local, state, and federal  entities.
In addition, the 120-day review further found that performance measures  for investigative quality are neither standardized nor implemented  consistently across the government, and that measuring and ensuring  quality continues to be a challenge. The review contained three  recommendations to address the development of quality metrics, but the  PAC has only partially implemented those recommendations. We  previously reported that the executive branch had developed some  metrics to assess quality at different phases of the personnel security  clearance process; however, those metrics had not been fully developed  and implemented.
The development of metrics to assess quality throughout the security  clearance process has been a long-standing concern. Since the late  1990s we have emphasized the need to build and monitor quality  throughout the personnel security clearance process. In 2009, we again  noted that clearly defined quality metrics can improve the security  clearance process by enhancing oversight of the time required to process  security clearances and the quality of the investigation and adjudicative  decisions. We recommended that OMB provide Congress with results of  metrics on comprehensive timeliness and the quality of investigations and  adjudications. According to ODNI, in October 2016, ODNI began  implementation of a Quality Assessment and Reporting Tool to document  customer issues with background investigations. The tool will be used to  report on the quality of 5 percent of each executive branch agency’s  background investigations.
ODNI officials stated that they plan to develop metrics in the future as  data are gathered from the tool, but did not identify a completion date for  these metrics. Separately, the NDAA for Fiscal Year 2017, among other  things, requires DOD to institute a program to collect and maintain data  and metrics on the background investigation process, in the context of  developing a system for performance of background investigations. The  PAC’s effort to fully address the 120-day review and our  recommendations on establishing metrics on the quality of investigations  as well as DOD’s efforts to address the broader requirements in the  NDAA for Fiscal Year 2017 remain open and will need to be a continued  focus of the department moving forward in its effort to improve its  management of the security clearance process.
Further, in response to the 2015 OPM data breach, the PAC completed a  90-day review which led to an executive order establishing the National  Background Investigations Bureau, within OPM, to replace the Federal  Investigative Services and transferred responsibility to develop, maintain  and secure new IT systems for clearances to DOD. Additionally, the  Executive Order made DOD a full principal member of the PAC. The  Executive Order also directed the PAC to review authorities, roles, and  responsibilities, including submitting recommendations related to revising,  as appropriate, executive orders pertaining to security clearances. This  effort is ongoing.
In addition to addressing the quality of security clearances and other  goals and recommendations outlined in the 120-day and 90-day reviews  and the government’s cross-agency priority goals, the PAC has the added  challenge of addressing recent changes that may result from the NDAA  for Fiscal Year 2017. Specifically, section 951 of the act requires the  Secretary of Defense to develop an implementation plan for the Defense  Security Service to conduct background investigations for certain DOD  personnel—presently conducted by OPM—after October 1, 2017. The  Secretary of Defense must submit the plan to the congressional defense  committees by August 1, 2017. It also requires the Secretary of Defense  and Director of OPM to develop a plan by October 1, 2017, to transfer  investigative personnel and contracted resources to DOD in proportion to  the workload if the plan for DOD to conduct the background investigations  were implemented. It is unknown if these potential changes will impact  recent clearance reform efforts.
Given the history and inherent challenges of reforming the government- wide security clearance process, coupled with recent amendments to a  governing Executive Order and potential changes arising from the NDAA  for Fiscal Year 2017, we will continue reviewing critical functions for  personnel security clearance reform and monitor the government’s  implementation of key reform efforts. We have ongoing work assessing  progress being made on the overall security clearance reform effort and  in implementing a continuous evaluation process, a key reform effort  considered important to improving the timeliness and quality of  investigations. We anticipate issuing a report on the status of the  government’s continuous evaluation process in the fall of 2017.  Additionally, we have previously reported on the importance of securing  federal IT systems and anticipate issuing a report in early 2017 that  examines IT security at OPM and efforts to secure these types of critical  systems. Continued progress in reforming personnel security  clearances is essential in helping to ensure a federal workforce entrusted  to protect U.S. government information and property, promote a safe and  secure work environment, and enhance the U.S. government’s risk  management approach.
The high-risk assessment continues to be a top priority and we will  maintain our emphasis on identifying high-risk issues across government  and on providing insights and sustained attention to help address them,  by working collaboratively with Congress, agency leaders, and OMB. As  part of this effort, with the new administration and Congress in 2017 we  hope to continue to participate in regular meetings with the incoming  OMB Deputy Director for Management and with top agency officials to  discuss progress in addressing high-risk areas. Such efforts have been  critical for the progress that has been made.
This high-risk update is intended to help inform the oversight agenda for  the 115th Congress and to guide efforts of the administration and  agencies to improve government performance and reduce waste and  risks.
Thank you, Chairman Johnson, Ranking Member McCaskill, and  Members of the Committee. This concludes my testimony. I would be  pleased to answer any questions.
For further information on this testimony, please contact J. Christopher  Mihm at mihmj@gao.gov or (202) 512-6806. Contact points for the  individual high-risk areas are listed in the report and on our high-risk  website. Contact points for our Congressional Relations and Public Affairs  offices may be found on the last page of this statement.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.