2020 Census: Additional Actions Needed to Manage Risk
Released: 2019-05-31T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: With less than 1 year until Census Day, many risks remain. For example, the Bureau has had challenges developing critical information technology systems, and new innovations—such as the ability to respond via the internet—have raised questions about potential security and fraud risks. Fundamental to risk management is the development of risk mitigation and contingency plans to reduce the likelihood of risks and their impacts, should they occur.

GAO was asked to review the Bureau's management of risks to the 2020 Census. This report examines (1) what risks the Bureau has identified, (2) the risks for which the Bureau has mitigation and contingency plans, (3) the extent to which the plans included information needed to manage risk, and (4) the extent to which the Bureau's fraud risk approach aligns with leading practices in GAO's Fraud Risk Framework. GAO interviewed officials, assessed selected mitigation and contingency plans against key attributes, and assessed the Bureau's approach to managing fraud risk against GAO's Fraud Risk Framework.

section_title: What GAO Found
paragraphs: As of December 2018, the Census Bureau (Bureau) had identified 360 active risks to the 2020 Census. Of these, 242 required a mitigation plan and 232 had one; 146 required a contingency plan and 102 had one (see table). Mitigation plans detail how an agency will reduce the likelihood of a risk event and its impacts, if it occurs. Contingency plans identify how an agency will reduce or recover from the impact of a risk after it has been realized. Bureau guidance states that these plans should be developed as soon as possible after a risk is added to the risk register, but it does not establish clear time frames for doing so. Consequently, some risks may go without required plans for extended periods.

GAO reviewed the mitigation and contingency plans in detail for six risks which the Bureau identified as among the major concerns that could affect the 2020 Census. These included cybersecurity incidents and integration of the 52 systems and 35 operations supporting the census. GAO found that the plans did not consistently include key information needed to manage the risk. For example, three of the mitigation plans and five of the contingency plans did not include all key activities. Among these was the Bureau's cybersecurity mitigation plan. During an August 2018 public meeting, the Bureau's Chief Information Officer discussed key strategies for mitigating cybersecurity risks to the census—such as reliance on other federal agencies to help resolve threats—not all of which were included in the mitigation plan.

GAO found that gaps stemmed from either requirements missing from the Bureau's decennial risk management plan, or that risk owners were not fulfilling all of their risk management responsibilities. Bureau officials said that risk owners are aware of these responsibilities but do not always fulfill them given competing demands. Bureau officials also said that they are managing risks to the census, even if not always reflected in their mitigation and contingency plans. However, if such actions are reflected in disparate documents or are not documented at all, then decision makers are left without an integrated and comprehensive picture of how the Bureau is managing risks to the census.

The Bureau has designed an approach for managing fraud risk to the 2020 Census that generally aligns with leading practices in the commit, assess, and design and implement components of GAO's Fraud Risk Framework. However, the Bureau has not yet determined the program's fraud risk tolerance or outlined plans for referring potential fraud to the Department of Commerce Office of Inspector General (OIG) to investigate. Bureau officials described plans to take these actions later this year, but not for updating the antifraud strategy. Updating this strategy to include the Bureau's fraud risk tolerance and OIG referral plan will help ensure the strategy is current, complete, and conforms to leading practices.

section_title: What GAO Recommends
paragraphs: GAO is making seven recommendations, including that the Bureau set clear time frames for developing mitigation and contingency plans, require that mitigation and contingency plans include all key attributes, hold risk owners accountable for carrying out their risk management responsibilities, and update its antifraud strategy to include a fraud risk tolerance and OIG referral plan. The Department of Commerce agreed with GAO's recommendations.

section_title: Letter
paragraphs: The federal government is constitutionally mandated to count the U.S.  population every 10 years. However, achieving a complete count is  complex and costly. For example, the U.S. Census Bureau (Bureau) must  meet certain immutable deadlines, including counting the population as of  April 1, 2020 (Census Day); delivering state apportionment counts to the  President by December 31, 2020; and providing redistricting data to the  states by April 1, 2021. To meet these deadlines, the Bureau—an agency  within the Department of Commerce—carries out thousands of  interrelated activities which, for 2020, the Bureau estimates will cost  $15.6 billion after adjusting for inflation to the current 2020 Census time  frame (fiscal years 2012 to 2023), which would be the most expensive  decennial census to date. In February 2017, we added the 2020 Census  to our High-Risk List because operational and other issues were  threatening the Bureau’s ability to deliver a cost-effective enumeration,  and the census remains on our 2019 High-Risk List as these issues have  persisted.

With less than 1 year remaining until Census Day, many risks remain. For  example, as discussed in our high-risk reports, the Bureau decided to  scale back census field testing in 2017 and 2018 citing budget  uncertainty, and the Bureau has had challenges developing critical  information technology systems. Moreover, new innovations—such as an  option for the public to respond to the census using the internet—have  raised questions about potential security and fraud risks. Adequately  addressing risks is critical not just for individual operations but also for  ensuring a cost-effective and high-quality census. In our prior work, we  noted that problems with one operation can have a cascading effect and  affect subsequent activities and thus the entire enumeration.

You asked us to review the Bureau’s efforts to manage risks to the 2020  Census. This report (1) describes the risks to the 2020 Census that the  Bureau has identified, (2) identifies the risks for which the Bureau has  mitigation and contingency plans, (3) assesses the extent to which the  Bureau’s mitigation and contingency plans included information needed to  manage risk, and (4) assesses the extent to which the Bureau’s approach  to managing fraud risks to the 2020 Census aligns with leading practices  outlined in our Fraud Risk Framework.

To answer our first three objectives, we reviewed Bureau documentation  of its approach to managing risks facing the 2020 Census—including its  decennial risk management plan; operational plan; governance  management plan; guidance and training documents; and meeting  minutes and agendas from the Bureau’s 2020 Census Risk Review  Board, which is responsible for identifying, assessing, managing,  monitoring, and reporting risks to the 2020 Census. In addition, we  interviewed Bureau officials responsible for overseeing risk management  for the 2020 Census.

To describe what risks to the 2020 Census the Bureau has identified and  the risks for which the Bureau has mitigation and contingency plans, we  also reviewed the Bureau’s portfolio- and program-level decennial risk  registers. These registers catalogue information regarding all risks to the  2020 Census that the Bureau has identified, including risk descriptions  and mitigation and contingency plans.

To assess the extent to which the Bureau’s mitigation and contingency  plans included information needed to manage risk, we selected a  nongeneralizable sample of six risks from the Bureau’s risk registers  based on factors such as likelihood of occurrence and potential impact.  For each selected risk, we reviewed relevant Bureau documentation— including risk mitigation and contingency plans—and we conducted  semistructured interviews with the Bureau officials responsible for  managing the risk. In addition, drawing principally from our Enterprise  Risk Management (ERM) framework as well as secondary sources, we  identified seven key attributes for risk mitigation and contingency plans to  help ensure they contain the information needed to manage risks. We  assessed the risk mitigation and contingency plans entered in the  Bureau’s risk registers as of December 2018—as well as the separate  mitigation and contingency plans for the six selected risks—against the  seven key attributes.

To evaluate the extent to which the Bureau’s approach to managing fraud  risks to the 2020 Census aligns with leading practices outlined in our  Fraud Risk Framework, we reviewed Bureau documentation related to the  2020 Census antifraud strategy. This strategy includes a fraud risk  assessment that identifies and evaluates scenarios in which fraudulent  activity could impact the 2020 Census results. It also includes a risk  response plan that uses the fraud risk assessment to develop risk  responses and its fraud detection systems. In addition, we interviewed  Bureau officials responsible for antifraud efforts for the 2020 Census. We  evaluated the information gathered based on selected components of our  Fraud Risk Framework.

Our assessment was limited to a review of the presence or absence of  leading practices from the framework, not whether they were sufficient.  We also did not assess the Bureau’s approach against leading practices  in the “evaluate and adapt” component of the framework because the  Bureau will not be able to implement practices in this component until the  2020 Census begins. Appendix I presents a more detailed description of  our scope and methodology.

We conducted this performance audit from May 2018 to May 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The decennial census produces data vital to the nation. The data are  used to apportion the seats of the U.S. House of Representatives; realign  the boundaries of the legislative districts of each state; allocate billions of  dollars each year in federal financial assistance; and provide a social,  demographic, and economic profile of the nation’s people to guide policy  decisions at each level of government. Furthermore, businesses,  nonprofit organizations, universities, and others regularly rely on census  data to support their work.

Given the importance of the decennial census to the nation, it is important  for the Bureau to manage risks that could jeopardize a complete,  accurate, and cost-effective enumeration. To assist federal government  leaders in managing such complex and inherently risky missions across  their organizations, in prior work we developed an ERM framework that,  among other things, identifies essential elements for federal ERM and  good practices that illustrate those essential elements. Notably, these  elements and practices apply at all levels of an organization and across  all functions—such as those related to managing risks to the 2020  Census. Furthermore, Office of Management and Budget (OMB) Circulars  No. A-11 and A-123 require federal agencies to implement ERM to  ensure their managers are effectively managing risks that could affect the  achievement of agency strategic objectives. As discussed in our ERM  Framework, ERM is a decision-making tool that allows leadership to view  risks as an interrelated portfolio rather than addressing risks only within  silos.

Fundamental to ERM is the development of risk mitigation and  contingency plans. Mitigation plans detail how an agency will reduce the  likelihood of a risk event and its impacts, should it occur. Contingency  plans identify how an agency will reduce or recover from the impact of a  risk after it has been realized. Among other things, these plans provide  the roadmap for implementing the agency’s selected risk response and  the vehicle for monitoring, communicating, and reporting on the success  of that response. In developing these plans, it is important that agencies  keep in mind the interaction of risks and risk responses, as the response  to one risk may affect the response to another or create a new risk  entirely.

We also developed a Fraud Risk Framework to provide a comprehensive  set of leading practices that serves as a guide for agency managers  developing and enhancing efforts to combat fraud in a strategic, risk- based manner. The framework is designed to focus on preventive  activities, which generally offer the most cost-efficient use of resources  since they enable managers to avoid a costly and inefficient pay-and- chase model of recovering funds from fraudulent transactions after  payments have been made.

section_title: The Bureau Identified 360 Active Risks to the 2020 Census
paragraphs: Consistent with our ERM framework, the Bureau developed a decennial  risk management plan which, among other things, requires that it identify  risks to the 2020 Census at the portfolio and program levels. Portfolio  risks are those that could jeopardize the success of the 2020 Census as a  whole, and they typically span several years with many potential risk  events over the period. Program risks are narrower—they could  jeopardize the success of an individual program, including the 35  operations that support the 2020 Census as well as the 2018 End-to-End  Test.

As of December 2018, the Bureau had identified 360 active risks to the  2020 Census—meaning the risk event could still occur and adversely  impact the census. Of these, 30 were at the portfolio level and 330 were  at the program level. As shown in figure 1, the greatest number of active  program risks was to the Systems Engineering and Integration operation  which manages the Bureau’s delivery of an IT “System of Systems” to  meet 2020 Census business and capability requirements. For example,  the Bureau’s description of one of the risks to this operation indicated that  if certain key system test plans and schedules are not clearly  communicated among and collaborated on by relevant Bureau teams,  then the 2020 Census systems are at risk of not meeting performance,  cost, and schedule goals and objectives.
subsections: section_title: The Bureau Classified 21 Percent of Active Risks as High Priority
paragraphs: The Bureau’s decennial risk management plan requires that it classify  risks by priority level. These classifications are intended to highlight the  most critical risks and identify where to allocate additional resources.  Figure 2 shows how the Bureau had classified the 360 active risks as of  December 2018.

To determine risk priority, the Bureau’s decennial risk management plan  requires that it assign each risk numerical ratings for likelihood of  occurrence and potential impact. When multiplied, the result is a  numerical priority rating, which the Bureau divides into three  classifications for high priority, medium priority, and low priority (see  figure 3).

section_title: The Bureau Determined That It Should Mitigate 67 Percent of Active Risks
paragraphs: According to the Bureau’s decennial risk management plan, all portfolio- level risks must be mitigated to reduce the likelihood of the risk event and  its impacts, should it occur. In contrast, when a program-level risk is  identified, risk owners—the individuals assigned to manage each risk— are to select from the following risk responses.

Mitigate. This may be an appropriate response where there are  actions or techniques that will reduce the likelihood of the risk event  and its impact, should it occur.

Watch. This may be an appropriate response where a trigger event  can be identified far enough in advance so that mitigation activities  can be delayed until then.

Accept. This may be an appropriate response where the probability  and potential impact of the risk is so low that mitigation actions do not  appear necessary or the impact can be absorbed if the risk occurs.

As of December 2018, the Bureau planned to mitigate 67 percent of the  active risks it had identified (see table 1). Notably, this signifies that the  Bureau determined there were actions it could take or techniques it could  employ to reduce the likelihood of the majority of risks to the enumeration  or their impact, should they occur.

section_title: The Bureau Had Mitigation and Contingency Plans for Most Risks, but Not Clear Time Frames for Plan Development and Approval or a Clear Status for Mitigation Plans The Bureau Had Mitigation and Contingency Plans for Most Risks That Required Them
paragraphs: The Bureau’s decennial risk management plan sets out the following  requirements for developing mitigation and contingency plans:

Mitigation plans are required for all active portfolio risks and for all  active program risks with a mitigate risk response.

Contingency plans are required for all active portfolio risks with a high-  or medium-priority rating, and a moderate or higher likelihood of  occurrence.

Contingency plans are also required for active program risks with a  high- or medium-priority rating, a moderate or higher likelihood of  occurrence, and a risk response of mitigate or accept.

Of the 360 active risks to the census as of December 2018, 242 (67  percent) met the Bureau’s criteria for requiring a mitigation plan (see table  2). According to the Bureau’s risk registers, 232 of these risks (96  percent) had a mitigation plan. In addition, 146 of the active risks (41  percent) met the Bureau’s criteria for requiring a contingency plan.  According to the Bureau’s risk registers, 102 of these risks (70 percent)  had a contingency plan.

Our prior reporting similarly found that earlier in the decennial cycle, the  Bureau did not have mitigation and contingency plans for all risks that  required them. In November 2012, we found that the Bureau had  mitigation and contingency plans for each of the portfolio risks it had  identified at the time, but none for the program risks. We reported that  such plans were needed to help the Bureau fully manage associated  risks, and we recommended that the Bureau develop risk mitigation and  contingency plans for all program risks. In April 2014, the Bureau  provided us with program-level risk registers that contained both risk  mitigation and contingency plans where appropriate, and we closed the  recommendation as implemented. However, as of December 2018, the  Bureau is missing required mitigation and contingency plan for both  portfolio and program risks.
subsections: section_title: The Bureau Has Not Set a Clear Time Frame for Developing Mitigation and Contingency Plans
paragraphs: Example of 2020 Census Risk Without  Required Contingency Plan  In July 2016, the Bureau added a risk titled,  Major Disasters, to its portfolio risk register.  The Bureau’s description of the risk stated  that if a major disaster—such as an  earthquake—occurs during final preparations  for or implementation of the 2020 Census,  then census operations may not be executed  as planned, leading to increased costs,  schedule delays, or lower quality data.   Leading up to the 2010 Census, Hurricane  Katrina devastated the coastal communities  of Louisiana, Mississippi, and Alabama; a few  weeks later, Hurricane Rita cut across Texas  and Louisiana. Damage was widespread.  Among other things, in the aftermath of  Katrina, the Red Cross estimated that nearly  525,000 people were displaced and their  homes were declared uninhabitable.   If a major disaster, such as a hurricane,  occurs leading up to or during the 2020  Census, having a contingency plan would  help ensure that housing units and their  residents are accurately counted, particularly  when hundreds of thousands of people— temporarily or permanently—may migrate to  other areas of the country. As of December  2018, however, the Bureau had neither a  draft nor approved contingency plan for this  risk, although it required one since first added  to the risk register nearly 2.5 years earlier.  According to the Bureau, though not  documented in a contingency plan, it is taking  actions to respond if this risk is realized.  However, if such actions are reflected in  disparate documents or no documents at all,  then decision makers are left without a  comprehensive picture of how the Bureau is  managing this risk to the 2020 Census.

Some of the risks that were missing required plans had been added to the  risk registers in recent months, but others had been added more than 3  years earlier. Specifically, the 10 risks without mitigation plans were  added from June to December 2018, and the 44 risks without contingency  plans were added from June 2015 to December 2018. The one portfolio  risk without a required mitigation plan was added in December 2018, and  the five portfolio risks without required contingency plans were added in  July 2015, July 2016, October 2017, August 2018, and December 2018,  respectively. In some instances, a risk may not meet the Bureau’s criteria  for requiring a mitigation or contingency plan when first added to the risk  register. However, we found that all 10 risks without required mitigation  plans and 37 of the 44 risks without required contingency plans met the  Bureau’s criteria for requiring such plans within a month of being added to  the register (of the 37 risks without a required contingency plan, five were  at the portfolio level and 32 were at the program level).

The Bureau’s decennial risk management plan states that mitigation and  contingency plans should be developed as soon as possible after risks  requiring such plans are added to the risk registers, but it does not  include a clear time frame for doing so. According to the Bureau’s 2020  Census Portfolio Risk and Issue Process Manager—responsible for  developing, maintaining, and administering the risk management process  for both portfolio and program risks to the 2020 Census—no time frame is  included because risk owners are aware of their responsibility and a  specific time frame would not speed up the process given competing  demands on their time.

However, the official said the Bureau would consider adding a specific  time frame when it updates the decennial risk management plan in 2019.  Standards for Internal Control in the Federal Government (Standards for  Internal Control) states that management should define objectives in  specific terms—including the time frames for achievement—so that they  are understood at all levels of the entity. In addition, OMB Circular No.  A-123 states that effective risk management is systematic, structured,  and timely. Without setting a clear time frame for developing mitigation  and contingency plans, some risks may go without them for extended  periods, potentially leaving the 2020 Census open to the impact of  unmanaged risks.

section_title: The Bureau’s Risk Registers Clearly Indicated the Status of Contingency but Not Mitigation Plans
paragraphs: The Bureau’s decennial risk management plan requires that both portfolio  and program risk registers include the word “draft” or “approved”  alongside each contingency plan. As of December 2018, this status  showed that 41 percent of contingency plans in the Bureau’s risk registers  were still in draft form and had not been approved by management (29  percent at the portfolio level and 42 percent at the program level).  Specifically, management had approved 60 of the 102 contingency plans  (five at the portfolio level and 55 at the program level) but not the  remaining 42 (two at the portfolio level and 40 at the program level).

On the other hand, the Bureau’s decennial risk management plan  includes no requirements for indicating the status of either portfolio or  program risk mitigation plans in the risk registers. Our review of the risk  registers found that some of the portfolio risk mitigation plans included the  word “draft” alongside the plan, but none included any indication of  whether the plan had been approved by management. In addition, none  of the program risk mitigation plans indicated whether the plan was in  draft or had been approved by management, but we found that at least  some appeared to be in draft. For example, one program risk mitigation  plan stated that the Risk Review Board had recommended contacting  three individuals for next steps; however, the plan did not appear finalized  because it did not discuss any next steps and it is not clear that further  action had been taken.

Although the Bureau had mitigation plans in place for 96 percent of risks  that required them, without a clear indication of the status of these plans  in the risk registers, we were unable to determine how many had been  approved by management. According to Bureau officials, the risk  registers are Bureau management’s primary source of information  regarding risks to the census. Standards for Internal Control states that  management should use quality information from reliable sources and  clearly document internal controls to achieve the entity’s objectives and  respond to risks. Including a clear indication of the status of both  mitigation and contingency plans in the risk registers would help to  support Bureau officials’ management of risks to the census; in addition, it  would help to ensure that those plans are finalized and that the census is  not left open to unmanaged risks.

section_title: The Bureau Does Not Have a Clear Time Frame for Obtaining Management Approval of Mitigation and Contingency Plans
paragraphs: Of the 42 contingency plans awaiting approval, many had been added to  the risk registers in recent months, but others had been added more than  4 years earlier. Specifically, the two portfolio risks were added in  September 2014 and August 2017, and the 40 program risks were added  from October 2015 to December 2018. Moreover, we found that both of  the portfolio risks and 34 of the 40 program risks without finalized  contingency plans met the Bureau’s criteria for requiring such a plan  within a month of being added to the register.

The Bureau’s decennial risk management plan requires risk owners to  present mitigation and contingency plans to management for approval as  soon as possible after risks requiring such plans are added to the risk  registers. However, as with development of the mitigation and  contingency plans, the Bureau’s decennial risk management plan does  not include a clear time frame for doing so because, according to the  Bureau’s 2020 Census Portfolio Risk and Issue Process Manager, a  specific time frame would not speed up the process given competing  demands on risk owners’ time. As previously noted, Standards for Internal  Control states that management should define objectives in specific  terms—including the time frames for achievement—so that they are  understood at all levels of the entity. In addition, OMB Circular No. A- 123 states that effective risk management is systematic, structured, and  timely. Without setting a clear time frame for approving draft mitigation  and contingency plans, some risks may not be finalized.

section_title: The Bureau Did Not Consistently Include Key Information for Managing Risks in the Mitigation and Contingency Plans We Reviewed
paragraphs: Mitigation and contingency plans assist agencies in managing and  communicating to agency stakeholders the status of risks. We reviewed  the mitigation and contingency plans for six portfolio-level risks to the  2020 Census which the Bureau identified as among the “major concerns  that could affect the design or successful implementation of the 2020  Census” (see table 3). We found that the Bureau’s mitigation and  contingency plans for these risks did not consistently include key  information needed to manage them. These six risks, if not properly  managed, could adversely affect the cost and quality of the 2020 Census.

According to the Bureau’s decennial risk management plan, for each  portfolio-level risk the risk owner must develop mitigation and contingency  plans using the Bureau’s mitigation and contingency plan templates (see  appendixes III and IV for the Bureau’s templates). Those templates  require, among other things, that the Bureau specify key activities for  reducing the likelihood of the risk and its impacts. We found that the  Bureau’s decennial risk management plan generally aligns with our ERM  framework which is designed to help agencies, among other actions,  identify, assess, monitor, and communicate risks. However, we also  found some instances where the Bureau’s risk management plan did not  require mitigation and contingency plans to include certain key attributes  we identified, which we discuss below. See figure 4 for a list of key  attributes that we used when reviewing mitigation and contingency plans.  As indicated in the attribute descriptions, six of the seven attributes are  applicable to mitigation plans. Clearly defined trigger events do not apply  to mitigation plans because they signal when a risk has been realized and  contingency activities must begin. Each of the seven attributes are  applicable to contingency plans, although two attributes—activity start  and completion dates and activity implementation status—are only  applicable if the risk has been realized.

As of December 2018, the results of our review of the Bureau’s mitigation  and contingency plans for the six portfolio-level risks we selected were in  most cases mixed: some mitigation and contingency plans aligned with a  particular key attribute, while others did not (see table 4). For two  attributes—activity start and completion dates and activity implementation  status—we found the Bureau generally included the relevant information  across the six selected mitigation plans, which should help ensure that  activities are carried out in a timely manner and that agency officials and  stakeholders are informed and assured that the risks are being effectively  managed. On the other hand, none of the mitigation or contingency  plans included a monitoring plan, which would help the Bureau to track  whether plans are working as intended.

We found that where attributes are required but not consistently  implemented, the gap stems from the Bureau not always holding risk  owners accountable for fulfilling all of their risk management  responsibilities, such as keeping plans up to date. Bureau officials  responsible for overseeing risk management for the 2020 Census stated  that they encourage risk owners to complete all of their risk management  responsibilities; however, risk owners do not always do so because they  have competing demands on their time. Therefore, the officials said they  are generally satisfied if the risk owners have completed at least some of  their risk management responsibilities. However, they also agreed that  risk management should be among the Bureau’s top priorities and that  risk owners should fulfill all of their risk management responsibilities.

Bureau officials also stated that the Bureau is managing risks to the  census, even if not always reflected in the mitigation and contingency  plans. We acknowledge that the Bureau is taking actions to manage risks  to the 2020 Census beyond those reflected in its mitigation and  contingency plans. However, if these actions are reflected in disparate  documents or are not documented at all, then Bureau officials, program  managers, and other decision makers are left without an integrated and  comprehensive picture of how the Bureau is managing risks to the 2020  Census. Consequently, the Bureau’s risk management efforts are neither  clear nor transparent, which may create challenges for decision makers’  ability to quickly and accurately identify essential information to set  priorities, allocate resources, and restructure their efforts, as needed, to  ensure an accurate and cost-effective enumeration. In addition, where  mitigation and contingency plans are not clearly documented and only  certain individuals know about them, there is potential for the loss of  organizational knowledge, particularly as key personnel change roles or  leave the agency altogether. Below we provide examples of gaps, by  attribute, in the Bureau’s mitigation and contingency plans for the six risks  we reviewed.
subsections: section_title: Risk-Register Entries Were Missing Key Information
paragraphs: For each portfolio and program risk mitigation and contingency plan, the  Bureau’s decennial risk management plan requires risk owners to enter a  description of the plan in the relevant risk register. However, our review of  risk register entries for both mitigation and contingency plans across all  active risks as of December 2018 found they were missing some key  attributes, including monitoring plans, activity start and completion dates  for most activities, the implementation status for some activities,  individuals responsible for activity completion, and clearly defined trigger  events. In some instances, the missing attributes were a result of the  Bureau not requiring them in the risk register descriptions.

In other instances, where the Bureau’s decennial risk management plan  does require the attribute in the risk register descriptions, the gap was  due to the Bureau not holding risk owners accountable for them. Some of  the attributes missing from the registers were included in the separate  mitigation and contingency plans. However, at the program level there  are no separate mitigation plans, making the risk registers the only source  of information for program-level mitigation activities. According to Bureau  officials, after the 2020 Census they plan to require separate mitigation  plans for program risks as well. At the same time, Bureau officials noted  that they primarily rely on the risk registers to monitor risks to the census  and usually do not refer to the separate mitigation and contingency plans.

Standards for Internal Control states that management should use quality  information from reliable sources that is appropriate, current, complete,  accurate, accessible, and provided on a timely basis to achieve the  entity’s objectives. Similarly, OMB Circular No. A-123 states that  effective risk management is based on the best available information.  Because the risk registers are Bureau management’s primary source of  information regarding risks to the census—and currently their only source  of information on program-level risk mitigation—including this information  in the risk registers would help to support Bureau officials’ ability to  manage risks to the 2020 Census.

section_title: The Bureau’s Approach to Managing Fraud Risk for the 2020 Census Generally Aligns with Selected Components of the Fraud Risk Framework but Does Not Yet Include a Fraud Risk Tolerance or Fraud Referral Plan
paragraphs: The Bureau has designed an approach for managing fraud risk for  responses to the 2020 Census. We found that the approach generally  aligns with leading practices in the commit, assess, and design and  implement components of the Fraud Risk Framework. Specifically, the  Bureau demonstrated commitment to combating fraud by creating a  dedicated entity to lead antifraud efforts for the 2020 Census, conducted  a fraud risk assessment, and developed a risk response plan, among  other actions, consistent with leading practices from the selected  components. However, the Bureau has not yet determined the  program’s fraud risk tolerance or outlined plans for referring potential  fraud to the Department of Commerce Office of Inspector General (OIG)  to investigate. Bureau officials described plans and milestones to address  these steps but not for updating the antifraud strategy to include them.  Standards for Internal Control states that management should clearly  document internal controls to achieve the entity’s objectives and respond  to risks. In addition, management should use quality information that is  current and complete. Updating the antifraud strategy to include the  Bureau’s fraud risk tolerance and plan for OIG referral will help to ensure  that the strategy is current, complete, and conforms to leading practices.  Appendix IV presents additional details of our review of applicable leading  practices.

Managers of federal programs maintain the primary responsibility for  enhancing program integrity and managing fraud risks. Those who are  effective at managing their fraud risks collect and analyze data, identify  fraud trends, and use the information to improve fraud risk management  activities. Implementing effective fraud risk management processes is  important to help ensure that federal programs fulfill their intended  purpose, funds are spent effectively, and assets are safeguarded. The  Fraud Risk Framework provides a comprehensive set of leading practices  that serve as a guide for agency managers developing and enhancing  efforts to combat fraud in a strategic, risk-based manner. The Fraud Risk  Framework is also aligned with Principle 8 (“Assess Fraud Risk”) of  Standards for Internal Control. It is designed to focus on preventive  activities, which generally offer the most cost-efficient use of resources.  The leading practices in the Fraud Risk Framework are organized into  four components—commit, assess, design and implement, and evaluate  and adapt—as depicted in figure 5.
subsections: section_title: The Bureau Designated an Entity to Manage Fraud Risk and Took Steps to Develop an Organizational Culture Conducive to Fraud Risk Management
paragraphs: The commit component of the Fraud Risk Framework calls for an agency  to commit to combating fraud by creating an organizational culture and  structure conducive to fraud risk management. This component includes  demonstrating a senior-level commitment to integrity and combating  fraud, and establishing a dedicated entity to lead fraud risk management  activities.

The Bureau has taken steps that align with all applicable leading  practices in this component, according to our review. Specifically, senior- level commitment to combating fraud helps create an organizational  culture to combat fraud. The Bureau showed this commitment by creating  an antifraud group, made up of multiple operational divisions within the  Bureau—the Decennial Census Management Division, Decennial  Information Technology Division, and Decennial Contracts Execution  Office—and staff from the Bureau’s technical integration contractor.  Staff from these divisions make up the Self-Response Quality Assurance  (SRQA) group with the primary purpose of identifying and responding to  potentially fraudulent responses received in the 2020 Census. SRQA  members were assigned roles and responsibilities to combat fraud in the  2020 Census.

According to the framework, antifraud entities should understand the  program and its operations; have defined responsibilities and the  necessary authority across the program; and have a direct reporting line  to senior-level managers within the agency. We found that SRQA met  these leading practices through our interviews with knowledgeable officials who discussed the Bureau’s strategy for managing fraud risk for  the 2020 Census, and our review of documentation such as the fraud risk  assessment, which listed roles and responsibilities for staff from the  divisions in the antifraud group and the technical integration contractor.  The group also directly reports to senior-level managers within the  agency through weekly status reports that include milestones, activities,  and challenges.

According to the Fraud Risk Framework, the antifraud entity, among other  things, serves as the repository of knowledge on fraud risks and controls;  manages the fraud risk-assessment process; leads or assists with  trainings and other fraud-awareness activities; and coordinates antifraud  initiatives across the program. The Bureau staffed the antifraud entity with  members knowledgeable of the program and tasked them with managing  the fraud risk assessment process. Also, the members facilitated  communication with management and among stakeholders on fraud- related issues through weekly status reports. According to SRQA officials,  issues and concerns are escalated to senior-level managers on an as- needed basis so they can be coordinated across the program.

section_title: The Bureau Assessed Fraud Risks and Developed a Risk Profile but Has Not Yet Determined Fraud Risk Tolerances
paragraphs: The assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and to assess risks to  determine a fraud risk profile. This includes assessing the likelihood and  effect of fraud risks and determining a risk tolerance. Risk tolerance is the  acceptable level of variation in performance relative to the achievement of  objectives. In the context of fraud risk management, if the objective is to  mitigate fraud risks—in general, to have a low level of fraud—the risk  tolerance reflects managers’ willingness to accept a higher level of fraud  risks. Risk tolerance can be either qualitative or quantitative, but  regardless of the approach, Standards for Internal Control states that  managers should consider defining risk tolerances that are specific and  measurable.

The first part of the fraud risk assessment process includes leading  practices on tailoring the assessment to the program; planning to conduct  assessments both at regular intervals and when there are changes to the  program or operating environment; identifying specific tools, methods,  and sources for gathering information about fraud risks; and involving  relevant stakeholders in the assessment process. The Bureau has met all  the leading practices in the first part of the assess component, according  to our review. Specifically, the Bureau tailored the fraud risk assessment  to the 2020 Census as this is the first time an internet-response option will  be available for a decennial census in the United States. To identify  specific tools, methods, and sources for gathering information about fraud  risks, the Bureau met with relevant stakeholders, along with subject- matter experts, and conducted focus groups to develop various fraud  scenarios that became a key part of the assessment. The Bureau also  involved relevant stakeholders in the assessment process by outlining  their roles and responsibilities for the 2020 Census. For example, the  Decennial Census Management Division serves as the fraud lead and  oversees managing risks such as operational implementation,  methodology, and workload demands with support from the other  operational divisions in the antifraud group.

According to the Fraud Risk Framework while the timing can vary,  effective antifraud entities plan to conduct fraud risk assessments at  regular intervals and when there are changes to the program or operating  environment, as fraud risk assessments are iterative and not meant to be  onetime exercises. The Bureau’s assessment takes this into account by  acknowledging that risk assessment is an ongoing process. The  assessment also states that the SRQA team will continue to evaluate and  develop modeling techniques to train against existing fraud scenarios,  and SRQA welcomes input from all stakeholders to ensure the Bureau  identifies fraud risks, and works to implement controls and mitigation  plans throughout the 2020 Census.

The second part of the fraud risk assessment process includes identifying  inherent fraud risks affecting the program; assessing the likelihood and  effect of inherent fraud risks; determining a fraud risk tolerance;  examining the suitability of existing fraud controls and prioritizing residual  fraud risks; and documenting the program’s fraud risk profile (see figure  6).

The Bureau met three out of these five leading practices, including  identifying inherent fraud risk; assigning numeric rankings for likelihood  and impact of various fraud scenarios; and documenting the 2020 Census  fraud risk profile, which outlines the strengths and weaknesses of the  program. We concluded that one leading practice, examining the  suitability of existing fraud controls and prioritizing residual fraud risks,  was not applicable since the fraud detection system is new to the 2020  Census and changes the way the Bureau will detect different fraud  scenarios. As a result, all fraud risks for the 2020 Census are residual  risks. In reviewing the remaining leading practice in the fraud assessment  processes, we found that after identifying inherent fraud risk and  assigning numeric rankings for likelihood and impact of various fraud  scenarios, the Bureau did not take the next step to determine a fraud risk  tolerance.

Some of the steps the Bureau took to develop a risk response plan are  similar to steps for developing a fraud risk tolerance. Specifically, the  Bureau developed a process that classifies self-responses into risk  categories of low, medium, or high. Bureau officials stated that they plan  to use the classification to determine appropriate follow-up steps based  on risk scores generated by its Fraud Detection Analytics Model that was  develop by SRQA for the 2020 Census. However, the Bureau did not  define thresholds for the low-, medium-, and high-risk categories. These  thresholds, if defined, would meet the intent of a fraud risk tolerance by  indicating the acceptable level of variation in self-responses.

SRQA officials stated that they are developing these thresholds, and  therefore its fraud risk tolerance, and plan to have them completed in  August 2019. This includes reviewing available information collected  through the 2018 End-to-End Test, running simulations, defining  thresholds, and then evaluating the results to make adjustments.  Responses will receive a score, but until the Bureau defines fraud risk  tolerance thresholds for the low-, medium-, and high-risk categories, it  cannot effectively implement its antifraud strategy to allocate responses  for follow-up or inclusion. This may also affect the Bureau’s ability to  evaluate and adapt its antifraud strategy if initial benchmarks are not in  place to use for monitoring, with subsequent adjustments potentially  requiring additional time and resources. While officials described steps and time frames to develop a fraud risk tolerance, they did not do so for  updating the antifraud strategy to include the tolerance. Updating the  antifraud strategy to include the Bureau’s fraud risk tolerance will help to  ensure that the strategy is current, complete, and conforms to leading  practices.

section_title: The Bureau Designed a Response Plan and Collaborated Internally to Mitigate Fraud Risks but Did Not Include Plans to Refer Potential Fraud to the Office of Inspector General
paragraphs: The design and implement component of the Fraud Risk Framework calls  for federal managers to design and implement a strategy with specific  control activities to mitigate assessed fraud risks and collaborate to help  ensure effective implementation. This includes determining risk  responses and documenting an antifraud strategy; designing and  implementing specific control activities; developing a plan outlining how  the program will respond to identified instances of fraud; and establishing  collaborative relationships and creating incentives to help ensure effective  implementation of the antifraud strategy.

For determining risk responses and documenting an antifraud strategy,  the framework states that managers should (a) use the fraud risk profile  to help decide how to allocate resources to respond to residual fraud  risks; (b) develop, document, and communicate an antifraud strategy to  employees and stakeholders that describes the program’s activities for  preventing, detecting, and responding to fraud, as well as monitoring and  evaluation; (c) establish roles and responsibilities of those involved in  fraud risk management activities, such as the antifraud entity and external  parties responsible for fraud controls, and communicate the role of the  Office of Inspector General (OIG) to investigate potential fraud; (d) create  timelines for implementing fraud risk management activities, as  appropriate, including monitoring and evaluations; (e) demonstrate links  to the highest internal and external residual fraud risks outlined in the  fraud risk profile; and (f) link antifraud efforts to other risk management  activities, if any.

The Bureau developed and documented an antifraud strategy (the fraud  risk assessment and the risk response plan) and communicated it to  applicable employees. Bureau officials provided final versions of the  antifraud strategy in October 2018 and stated that all stakeholders were  provided with excerpts applicable to their area. The antifraud strategy  outlines the beginning and end dates for fraud detection operations, and  links to the highest residual fraud risks. The risk response includes links  to other risk management activities such as a security layer that is  designed, created, and maintained by the technical integration contractor  security group in coordination with the Office of Information Security and  Decennial Information Technology Division. According to the risk  response plan, this group protects the fraud detection system and its  associated systems from outside attacks such as hacks and distributed  denial of service attacks.

However, we found that the Bureau’s approach to managing fraud risk did  not fully align with two leading practices in this component. First, until the  Bureau defines its fraud risk tolerances, such as defining low-, medium-,  or high-risk thresholds, it will not be able to effectively allocate resources  to respond to residual fraud risks consistent with the Fraud Risk  Framework’s leading practices. Second, the Bureau did not initially  coordinate with the Department of Commerce (Commerce) OIG about its  antifraud strategy, which is not consistent with the leading practices. Such  lack of coordination could have precluded the OIG from determining if  potentially fraudulent activities should be investigated. After discussing  the results of our review with the Bureau, the Bureau contacted and met  with the Commerce OIG in February 2019. Based on the Bureau’s notes  from this meeting, the Bureau is on track to addressing the leading  practice regarding coordination.

The framework states that to design and implement specific control  activities to prevent and detect fraud, managers should (a) focus on fraud  prevention over detection; (b) consider the benefits and costs of control  activities to address identified residual risks; and (c) design and  implement the control activities such as data-analytics to prevent and  detect fraud. The 2020 Census antifraud control activities focus on  detecting potentially fraudulent responses. The Bureaus plans to use a  combination of data analytics and follow up to review response data  before they are added to the Bureau’s overall Census counts. The  Bureau’s efforts for the 2020 Census also focus on minimizing costs.  Specifically, if the Bureau’s fraud detection can minimize the amount of  cases that require manual investigation or work by field operations staff to  collect the information again, it can reduce the cost and workload to the  Bureau.

The framework states the antifraud strategy should also ensure that  responses to identified instances of fraud are prompt and consistent. In  addition, effective managers of fraud risks are to refer instances of  potential fraud to the OIG or other appropriate parties, such as law- enforcement entities or the Department of Justice, for further  investigation. The Bureau’s plan describes its process for scoring  responses using its Fraud Detection Analytics Model and then sorting  responses into a low-, medium-, or high-risk category. The plan also  outlines risk responses that depend on the risk category. For example,  medium-risk responses are reviewed internally and could be incorporated  into the census count or sent for additional follow up.

However, the Bureau’s antifraud strategy does not call for instances of  potential fraud to be referred to the Commerce OIG. Specifically, the  Bureau’s fraud risk assessment and risk response plan do not mention  the Commerce OIG. Bureau officials stated that the Commerce OIG did  not participate in the development of these documents. In February 2019,  after we discussed the results of our review with the Bureau, the Bureau  met with the Commerce OIG to discuss potential referrals. As a result, the  Bureau agreed to develop and share with the Commerce OIG a plan that  outlines a potential referral process by summer 2019.

Managers who effectively manage fraud risks collaborate and  communicate with stakeholders to share information on fraud schemes  and the lessons learned from fraud control activities. The framework  describes collaborative relationships as including other offices within the  agency; federal, state, and local agencies; private-sector partners; law- enforcement entities; and entities responsible for control activities. In  addition, managers should collaborate and communicate with the OIG to  improve their understanding of fraud risks and align their efforts to  address fraud. The Bureau collaborated internally with groups such as the  Security Operations Center that maintain the security layer that protects  Bureau systems and the nonresponse follow-up groups that visit  households to collect information again. The Bureau also provided  contractors with guidance by finalizing the antifraud strategy and  incentives by entering into an agreement with the technical integrator  contractor, which allows the Bureau to exercise an option to continue the  contract for another year. However, the Bureau did not begin to  collaborate and communicate with the Commerce OIG to improve its  understanding of fraud risks and align efforts to address fraud until after  we discussed the results of our review with the Bureau.

Bureau officials viewed the primary purpose of the fraud detection system  as a way to improve data reliability, according to interviews. As a result, in  2018, the Bureau changed the name of the operation from Fraud  Detection to SRQA. According to Bureau officials, the change better  reflects the operation’s focus on detecting potential falsification in  decennial census response data and referring suspected responses to a  field resolution operation to collect the data again. Bureau officials initially  stated that SRQA would not conduct investigations that lead to the kind of  law enforcement activities traditionally associated with fraud detection. As  mentioned above, the Bureau met with the Commerce OIG in February  2019 to discuss the potential for referrals and, according to the Bureau,  initiate a process for doing so. However, officials did not discuss steps  and a time frame for updating the antifraud strategy to include this  process. Doing so will help to ensure that the strategy is current,  complete, and conforms to leading practices.

section_title: Conclusions
paragraphs: Adequately addressing risks to the census is critical for ensuring a cost- effective and high-quality enumeration. The Bureau has taken important  steps to address risks to the 2020 Census, but with less than a year until  Census Day, the Bureau has not developed mitigation and contingency  plans for all risks that require them. In addition, the Bureau does not have  clear time frames for developing and obtaining management approval of  mitigation and contingency plans, and some risks have gone without  required plans for months and years. Moreover, the status of some plans  is unclear and not all plans have received management approval. Some  of the plans the Bureau has developed are missing key attributes we  identified for helping to ensure the plans contain the information needed  to manage risks. For example, none of the Bureau’s plans described how  the Bureau will monitor the risk response, so the Bureau may not be able  to track whether the plans are working as intended. These issues have  arisen in some instances because the Bureau’s decennial risk  management plan does not require mitigation and contingency plans to  have each of the seven key attributes we identified; in other instances,  the issues have arisen because Bureau officials do not always hold risk  owners accountable for fulfilling all their risk management responsibilities.  Consistently documenting risk management activities would support  management’s ability to more quickly make informed decisions in  response to risks confronting the 2020 Census. It would also help protect  the Bureau from losing institutional knowledge in the event risk owners  change roles or leave the agency.

The Bureau’s fraud risk strategy generally aligned with our Fraud Risk  Framework, including developing response plans and collaborating  internally to address risks. However, the Bureau has not yet determined  the program’s fraud risk tolerance or outlined a plan for referring potential  fraud to the Commerce OIG to investigate, but plans to do so later this  year. Setting a tolerance would help the Bureau monitor risks, and  referring potential fraud to the Commerce OIG would allow it to determine  if further investigation is appropriate. In addition to taking these actions,  updating the antifraud strategy to include the Bureau’s fraud risk  tolerance and plan for OIG referral will help to ensure that the strategy is  current, complete, and conforms to leading practices.

section_title: Recommendations for Executive Action
paragraphs: We are making the following seven recommendations to the Department  of Commerce and the Census Bureau:  The Secretary of Commerce should ensure that the Director of the  Census Bureau develops and obtains management approval of mitigation  and contingency plans for all risks that require them. (Recommendation  1)

The Secretary of Commerce should ensure that the Director of the  Census Bureau updates the Bureau’s decennial risk management plan to  include clear time frames for developing and obtaining management  approval of mitigation and contingency plans. (Recommendation 2)

The Secretary of Commerce should ensure that the Director of the  Census Bureau updates the Bureau’s decennial risk management plan to  require that portfolio and program risk registers include a clear indication  of the status of mitigation plans. (Recommendation 3)

The Secretary of Commerce should ensure that the Director of the  Census Bureau updates the Bureau’s decennial risk management plan to  require that risk mitigation and contingency plans, including the risk  register descriptions and separate plans, have the seven key attributes  for helping to ensure they contain the information needed to manage risk.  (Recommendation 4)

The Secretary of Commerce should ensure that the Director of the  Census Bureau holds risk owners accountable for carrying out their risk  management responsibilities. (Recommendation 5)

The Secretary of Commerce should ensure that the Director of the  Census Bureau updates the Bureau’s antifraud strategy to include a fraud  risk tolerance prior to beginning the 2020 Census and adjust as needed.  (Recommendation 6)

The Secretary of Commerce should ensure that the Director of the  Census Bureau updates the Bureau’s antifraud strategy to include the  Bureau’s plans for referring instances of potential fraud to the Department  of Commerce Office of Inspector General for further investigation.  (Recommendation 7)

section_title: Agency Comments
paragraphs: We provided a draft of this report to the Secretary of Commerce. In its  written comments, reproduced in appendix V, the Department of  Commerce agreed with our findings and recommendations and said it  would develop an action plan to address them. The Census Bureau also  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the Secretary of Commerce, the  Director of the U.S. Census Bureau, and the appropriate congressional  committees. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov.

If you or your staff have any questions about this report please contact  Robert Goldenkoff at (202) 512-2757 or goldenkoffr@gao.gov or Rebecca  Shea at (202) 512-6722 or shear@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix VI.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this study were to examine (1) what risks to the 2020  Census the Census Bureau (Bureau) has identified, (2) the risks for which  the Bureau has mitigation and contingency plans, (3) the extent to which  the Bureau’s mitigation and contingency plans included information  needed to manage risk, and (4) the extent to which the Bureau’s  approach to managing fraud risks to the 2020 Census aligns with leading  practices outlined in our Fraud Risk Framework.

To answer the first three objectives, we reviewed Bureau documentation  regarding its approach to managing risks facing the 2020 Census,  including its decennial risk management plan, operational plan,  governance management plan, Risk Review Board meeting minutes and  agendas, and guidance and training documents. In addition, we  interviewed Bureau officials responsible for overseeing risk management  for the 2020 Census.

To describe what risks to the 2020 Census the Bureau has identified and  the risks for which the Bureau has mitigation and contingency plans, we  also reviewed the Bureau’s portfolio- and program-level decennial risk  registers.

To assess the extent to which the Bureau’s mitigation and contingency  plans included information needed to manage risk, we selected a  nongeneralizable sample of six risks from the Bureau’s risk registers  based on factors such as likelihood of occurrence and potential impact  (see table 3).

To select these risks, we began with the 12 risks identified by the Bureau  in its 2020 Census Operational Plan as the “major concerns that could  affect the design or successful implementation of the 2020 Census.”  Next, we sorted the risks by numerical priority rating as of June 2018, a  Bureau-assigned figure calculated by multiplying numerical scores for  likelihood of occurrence and potential impact (see figure 3). We then  selected the six risks with the highest priority ratings. For each selected  risk, we reviewed relevant Bureau documentation—including risk  mitigation and contingency plans—and we conducted semistructured  interviews with the Bureau officials responsible for managing the risk.

In addition, drawing principally from our Enterprise Risk Management  (ERM) framework as well as secondary sources, we identified seven key  attributes for risk mitigation and contingency plans to help ensure they  contain the information needed to manage risks (see figure 4).  Specifically, we reviewed our ERM framework and other relevant prior  work on risk management, as well as commonly used risk management  publications from sources including the Office of Management and  Budget, the Project Management Institute, and the Chief Financial  Officers Council and Performance Improvement Council. We analyzed  these publications to identify portions relevant to risk mitigation and  contingency planning. Next, we synthesized the information and derived  attributes that appeared most important for effective risk mitigation and  contingency plans. We assessed the attributes against the essential  elements laid out in our ERM framework and found that each attribute  aligned with one or more of the elements. Six of the seven attributes—all  but clearly defined trigger events—are applicable to mitigation plans.  Each of the seven attributes are applicable to contingency plans, although  two attributes—activity start and completion dates and activity  implementation status—are only applicable if the risk has been realized.  We assessed the risk mitigation and contingency plans entered in the  Bureau’s risk registers as of December 2018, as well as the separate  mitigation and contingency plans for the six selected risks, against the  seven key attributes.

To evaluate the extent to which the Bureau’s approach to managing fraud  risks to the 2020 Census aligns with leading practices outlined in our  Fraud Risk Framework, we reviewed Bureau documentation related to the  2020 Census antifraud strategy. This strategy includes a fraud risk  assessment that identifies and evaluates scenarios in which fraudulent  activity could impact the 2020 Census results. It also includes a concept  of operations that uses the fraud risk assessment to develop risk  responses and its fraud detection systems. In addition, we interviewed  Bureau officials responsible for antifraud efforts for the 2020 Census. We  evaluated the information gathered based on the commit, assess, and  design and implement components of our Fraud Risk Framework.

Our assessment was limited to a review of the presence or absence of  leading practices from the framework, not whether they were sufficient.  We also did not review the leading practices for the “evaluate and adapt”  component of the framework. This component focuses on evaluating  outcomes using a risk-based approach and then adapting activities  established in the other components to improve fraud risk management.

Because the census is not scheduled to start until 2020, the Bureau will  not be able to implement leading practices such as: monitoring and evaluating the effectiveness of preventive activities; measuring outcomes, in addition to outputs, of fraud risk management or using the results of monitoring and evaluations to improve the  design and implementation of fraud risk management activities.

We conducted this performance audit from May 2018 to May 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: U.S. Census Bureau Operations Supporting the 2020 Census
paragraphs: Appendix II: U.S. Census Bureau Operations  Supporting the 2020 Census Purpose   Define and implement program management policies, processes, and the control  functions for planning and implementing the 2020 Census to ensure an efficient and well- managed program.

Manage the delivery of an Information Technology (IT) “System of Systems” to meet  2020 Census business and capability requirements.

Ensure all 2020 Census operations and systems adhere to laws, policies, and  regulations that ensure appropriate systems and data security, and protect respondent  and employee privacy and confidentiality.

Identify and finalize content and design of questionnaires and other associated  nonquestionnaire materials. Ensure consistency across data collection modes and  operations. Provide optimal design and content of the questionnaires to encourage high  response rates.

Assess and support language needs of non-English speaking populations. Determine the  number of non-English languages and level of support for the 2020 Census. Optimize the  non-English content of questionnaires and associated nonquestionnaire materials across  data collection modes and operations. Ensure cultural relevancy and meaningful  translation of 2020 Census questionnaires and associated nonquestionnaire materials.

Provide the geographic foundation to support 2020 Census data collection and tabulation  activities within the Master Address File/Topologically Integrated Geographic Encoding  and Referencing System. This system serves as the national repository for all spatial,  geographic, and residential address data needed for census and survey data collection,  data tabulation, data dissemination, geocoding services, and map production.

Provide an opportunity for tribal, federal, state, and local governments to review and  improve the address lists and maps used to conduct the 2020 Census as required by  Public Law 103-430.

Deliver a complete and accurate address list and spatial database for enumeration and  determining the type and address characteristics for each living quarter.

Print and distribute internet invitation letters, reminder cards or letters or both,  questionnaire mailing packages, and materials for other special operations, as required.  Other materials required to support field operations are handled in the Decennial  Logistics Management operation.

Capture and convert data from the 2020 Census paper questionnaires, including mail  receipt, document preparation, scanning, optical character and mark recognition, data  delivery, checkout, and form destruction.

Communicate the importance of participating in the 2020 Census to the entire population  of the 50 states, the District of Columbia, and Puerto Rico to support field recruitment  efforts, engage and motivate people to self-respond (preferably via the internet), raise  and keep awareness high throughout the entire 2020 Census to encourage response,  and effectively support dissemination of Census data to stakeholders and the public.

Internet Self-Response  Maximize online response to the 2020 Census via contact strategies and improved  access for respondents. Collect response data via the internet to reduce paper and  nonresponse follow-up.

Purpose   Make it easy for people to respond anytime and anywhere to increase self-response  rates by providing response options that do not require a unique Census ID. Maximize  real-time matching of non-ID respondent addresses to the census living quarters address  inventory, assigning nonmatching addresses to census blocks.

Update the address and feature data and enumerate respondents in person. Designated  to occur in areas where the initial visit requires enumerating while updating the address  frame, particularly in remote geographic areas that have unique challenges associated  with accessibility.

Update the address and feature data and leave a choice questionnaire package at every  housing unit identified to allow the household to self-respond. Designed to occur in areas  where the majority of housing units do not have a city-style address to receive mail.

Enumerate people living or staying in group quarters and provide an opportunity for  people experiencing homelessness and receiving service at service-based locations,  such as soup kitchens, to be counted in the census.

Enumerate individuals in occupied units at transitory locations who do not have a usual  home elsewhere, such as recreational vehicle parks, campgrounds, racetracks, circuses,  carnivals, marinas, hotels, and motels.

Provide questionnaire assistance for respondents by answering questions about specific  items on the census form or other frequently asked questions about the 2020 Census,  and provide an option for respondents to complete a census interview over the  telephone. Also provide outbound calling support of nonresponse follow-up reinterview  and coverage improvement.

Determine housing unit status for nonresponding addresses that do not self-respond to  the 2020 Census and enumerate households that are determined to have a housing unit  status of occupied.

Create and distribute the initial 2020 Census enumeration universe, assign the specific  enumeration strategy for each living quarter based on case status and associated  paradata, create and distribute workload files required for enumeration operations, track  case enumeration status, run postdata collection processing actions in preparation for  producing the final 2020 Census results, and check for fraudulent returns.

Obtain counts by home state of U.S. military and federal civilian employees stationed or  deployed overseas and their dependents living with them.

Prepare and deliver the 2020 Census population counts to the President of the United  States for congressional apportionment, tabulate and disseminate 2020 Census data  products for use by the states for redistricting, and tabulate and disseminate 2020  Census data for use by the public.

Provide to each state the legally required Public Law 94-171 redistricting data tabulations  by the mandated deadline of 1 year from Census Day (April 1, 2021).

Enhance the accuracy of the 2020 Census through remediating potential gaps in  coverage by implementing an efficient and equitable process to identify and correct  missing or geographically misallocated large group quarters and their population, and  positioning remaining count issues for a smooth transition to the Count Question  Resolution Operation.

Provide a mechanism for governmental units to challenge their official 2020 Census  results.
subsections: section_title: Area
paragraphs: Purpose   Coordinate storage of the materials and data and provide 2020 Census records deemed  permanent, including files containing individual responses, to the National Archives and  Records Administration and to the National Processing Center to use as source materials  to conduct the Age Search Service. Also store data to cover in-house needs.

Island Areas Censuses  Enumerate all residents of American Samoa, the Commonwealth of the Northern  Mariana Islands, Guam, and the U.S. Virgin Islands; process and tabulate the collected  data; and disseminate data products to the public.

Develop the survey design and sample for the Post-Enumeration Survey of the 2020  Census and produce estimates of census coverage based on the Post-Enumeration  Survey.

Identify matches, nonmatches, and discrepancies between the 2020 Census and the  Post-Enumeration Survey for both housing units and people in the same areas. Both  computer and clerical components of matching are conducted.

Collect person and housing unit information (independent from the 2020 Census  operations) for the sample of housing units in the Post-Enumeration Survey to help  understand census coverage and to detect erroneous enumerations.

Document how well the 2020 Census was conducted, and analyze, interpret, and  synthesize the effectiveness of census components and their impact on data quality or  coverage or both. Measure the success of critical 2020 Census operations. Formulate  and execute an experimentation program to support early planning and inform the  transition and design of the 2030 Census and produce an independent assessment of  population and housing unit coverage.

Support 2020 Census field operations for decennial staff (i.e., headquarters, PDC,  Regional Census Center, Area Census Office, Island Areas Censuses, remote workers,  and listers/enumerators.)

Provide the administrative infrastructure for data collection operations covering the 50  states, the District of Columbia, and Puerto Rico.

Coordinate space acquisition and lease management for the regional census centers,  area census offices, and the Puerto Rico area office; and provide logistics management  support services (e.g., kit assembly, supplies to field staff).

Provide the IT-related Infrastructure support to the 2020 Census, including enterprise  systems and applications, 2020 Census-specific applications, Field IT infrastructure,  mobile computing, and cloud computing.

section_title: Appendix III: 2020 Census Portfolio Risk Mitigation and Contingency Plan Templates

section_title: Appendix IV: Leading Practices from GAO’s Fraud Risk Framework
paragraphs: For the 2020 Census, the Census Bureau (Bureau) is trying to increase  participation and reduce costs by offering more self-response options to  households. This includes self-responses received via internet, phone, or  mail. In 2018, the Self-Response Quality Assurance group finalized its  antifraud strategy that includes a fraud risk assessment and risk response  plan that focuses specifically on these responses. We developed a data  collection instrument to structure our review of the antifraud strategy as it  related to the commit, assess, and design and implement components of  our Fraud Risk Framework.

Our assessment was limited to a review of the presence or absence of  leading practices from the framework, not whether they were sufficient.  We also did not assess the Bureau’s approach against leading practices  in the “evaluate and adapt” component of the framework because the  Bureau will not be able to implement practices in this component until the  2020 Census begins. The following table summarizes our comparison of  the Bureau’s antifraud strategy to leading practices in the fraud risk  framework.

section_title: Appendix V: Comments from the Department of Commerce

section_title: Appendix VI: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts

section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Lisa Pearson and Philip Reiff  (Assistant Directors), Emmy Rhine Paule and Ariel Vega (Analysts-in- Charge), Carole Cimitile, Ann Czapiewski, Robert Gebhart, Maria  McMullen, Ty Mitchell, James Murphy, Carl Ramirez, Kayla Robinson,  Kate Sharkey, Andrea Starosciak, Michael Steinberg, Umesh Thakkar,  and Jon Ticehurst made significant contributions to this report.

Fast facts: The Constitutionally-mandated U.S. Census provides vital information, including data for congressional redistricting. But we've found that the 2020 Census involves some risks.

The Census Bureau has identified hundreds of risks to the 2020 Census. For example, the Bureau's information systems face potential cyberattacks. The Bureau has mitigation and contingency plans for most of those risks.

We reviewed the Bureau's plans for 6 key risks and found they didn't consistently include key information needed to manage the risk. We made 7 recommendations including that the Bureau require these plans to include all necessary information.

Question-summary annotations: questions: question: What potential issues is the 2020 Census facing?
answer: As of December 2018, the Census Bureau (Bureau) had identified 360 active risks to the 2020 Census.
child_questions: question: To what extent have plans been made for these issues?
answer: Of these, 242 required a mitigation plan and 232 had one; 146 required a contingency plan and 102 had one (see table).
child_questions: question: What do mitigation plans consist of?
answer: Mitigation plans detail how an agency will reduce the likelihood of a risk event and its impacts, if it occurs.

question: What do contingency plans consist of?
answer: Contingency plans identify how an agency will reduce or recover from the impact of a risk after it has been realized.

question: According to Bureau guidance, how should these plans be developed?
answer: Bureau guidance states that these plans should be developed as soon as possible after a risk is added to the risk register, but it does not establish clear time frames for doing so. Consequently, some risks may go without required plans for extended periods.

questions: question: What plans did GAO review?
answer: GAO reviewed the mitigation and contingency plans in detail for six risks which the Bureau identified as among the major concerns that could affect the 2020 Census.
child_questions: question: What were the Bureau's major concerns for the 2020 Census?
answer: These included cybersecurity incidents and integration of the 52 systems and 35 operations supporting the census.

question: To what extent did the plans include key information needed for risk management?
answer: GAO found that the plans did not consistently include key information needed to manage the risk. For example, three of the mitigation plans and five of the contingency plans did not include all key activities.

question: What strategies for mitigating cybersecurity risks has the Bureau discussed?
answer: During an August 2018 public meeting, the Bureau's Chief Information Officer discussed key strategies for mitigating cybersecurity risks to the census—such as reliance on other federal agencies to help resolve threats—not all of which were included in the mitigation plan.

questions: question: What are the causes of risk management gaps in the Bureau plans?
answer: GAO found that gaps stemmed from either requirements missing from the Bureau's decennial risk management plan, or that risk owners were not fulfilling all of their risk management responsibilities.
child_questions: question: To what extent are risk owners aware of their responsibilities?
answer: Bureau officials said that risk owners are aware of these responsibilities but do not always fulfill them given competing demands.

question: To what extent does the Bureau manage risks to the census?
answer: Bureau officials also said that they are managing risks to the census, even if not always reflected in their mitigation and contingency plans.
child_questions: question: Why should these actions be included in plans?
answer: However, if such actions are reflected in disparate documents or are not documented at all, then decision makers are left without an integrated and comprehensive picture of how the Bureau is managing risks to the census.

questions: question: How does the Bureau's approach for fraud management compare to GAO's Fraud Risk Framework?
answer: The Bureau has designed an approach for managing fraud risk to the 2020 Census that generally aligns with leading practices in the commit, assess, and design and implement components of GAO's Fraud Risk Framework.

question: What aspects of the Bureau's approach remain unfinished?
answer: However, the Bureau has not yet determined the program's fraud risk tolerance or outlined plans for referring potential fraud to the Department of Commerce Office of Inspector General (OIG) to investigate.
child_questions: question: How does the Bureau plan to take these actions?
answer: Bureau officials described plans to take these actions later this year, but not for updating the antifraud strategy.

question: Why is updating the antifraud strategy important?
answer: Updating this strategy to include the Bureau's fraud risk tolerance and OIG referral plan will help ensure the strategy is current, complete, and conforms to leading practices.

questions: question: To what extent has the Bureau addressed census risks?
answer: With less than 1 year until Census Day, many risks remain.
child_questions: question: How has the Bureau responded to technology risks?
answer: For example, the Bureau has had challenges developing critical information technology systems, and new innovations—such as the ability to respond via the internet—have raised questions about potential security and fraud risks.

question: To what extent are risk plans important?
answer: Fundamental to risk management is the development of risk mitigation and contingency plans to reduce the likelihood of risks and their impacts, should they occur.

questions: question: What was GAO asked to review?
answer: GAO was asked to review the Bureau's management of risks to the 2020 Census.

question: What does this report examine?
answer: This report examines (1) what risks the Bureau has identified, (2) the risks for which the Bureau has mitigation and contingency plans, (3) the extent to which the plans included information needed to manage risk, and (4) the extent to which the Bureau's fraud risk approach aligns with leading practices in GAO's Fraud Risk Framework.
child_questions: question: How did GAO collect data for this report?
answer: GAO interviewed officials, assessed selected mitigation and contingency plans against key attributes, and assessed the Bureau's approach to managing fraud risk against GAO's Fraud Risk Framework.

questions: question: What potential issues is the 2020 Census facing?
answer: As of December 2018, the Census Bureau (Bureau) had identified 360 active risks to the 2020 Census.
child_questions: question: To what extent have plans been made for these issues?
answer: Of these, 242 required a mitigation plan and 232 had one; 146 required a contingency plan and 102 had one (see table).
child_questions: question: What do mitigation plans consist of?
answer: Mitigation plans detail how an agency will reduce the likelihood of a risk event and its impacts, if it occurs.

question: What do contingency plans consist of?
answer: Contingency plans identify how an agency will reduce or recover from the impact of a risk after it has been realized.

question: According to Bureau guidance, how should these plans be developed?
answer: Bureau guidance states that these plans should be developed as soon as possible after a risk is added to the risk register, but it does not establish clear time frames for doing so. Consequently, some risks may go without required plans for extended periods.

questions: question: What plans did GAO review?
answer: GAO reviewed the mitigation and contingency plans in detail for six risks which the Bureau identified as among the major concerns that could affect the 2020 Census.
child_questions: question: What were the Bureau's major concerns for the 2020 Census?
answer: These included cybersecurity incidents and integration of the 52 systems and 35 operations supporting the census.

question: To what extent did the plans include key information needed for risk management?
answer: GAO found that the plans did not consistently include key information needed to manage the risk. For example, three of the mitigation plans and five of the contingency plans did not include all key activities.

question: What strategies for mitigating cybersecurity risks has the Bureau discussed?
answer: During an August 2018 public meeting, the Bureau's Chief Information Officer discussed key strategies for mitigating cybersecurity risks to the census—such as reliance on other federal agencies to help resolve threats—not all of which were included in the mitigation plan.

questions: question: What are the causes of risk management gaps in the Bureau plans?
answer: GAO found that gaps stemmed from either requirements missing from the Bureau's decennial risk management plan, or that risk owners were not fulfilling all of their risk management responsibilities.
child_questions: question: To what extent are risk owners aware of their responsibilities?
answer: Bureau officials said that risk owners are aware of these responsibilities but do not always fulfill them given competing demands.

question: To what extent does the Bureau manage risks to the census?
answer: Bureau officials also said that they are managing risks to the census, even if not always reflected in their mitigation and contingency plans.
child_questions: question: Why should these actions be included in plans?
answer: However, if such actions are reflected in disparate documents or are not documented at all, then decision makers are left without an integrated and comprehensive picture of how the Bureau is managing risks to the census.

questions: question: How does the Bureau's approach for fraud management compare to GAO's Fraud Risk Framework?
answer: The Bureau has designed an approach for managing fraud risk to the 2020 Census that generally aligns with leading practices in the commit, assess, and design and implement components of GAO's Fraud Risk Framework.

question: What aspects of the Bureau's approach remain unfinished?
answer: However, the Bureau has not yet determined the program's fraud risk tolerance or outlined plans for referring potential fraud to the Department of Commerce Office of Inspector General (OIG) to investigate.
child_questions: question: How does the Bureau plan to take these actions?
answer: Bureau officials described plans to take these actions later this year, but not for updating the antifraud strategy.

question: Why is updating the antifraud strategy important?
answer: Updating this strategy to include the Bureau's fraud risk tolerance and OIG referral plan will help ensure the strategy is current, complete, and conforms to leading practices.

questions: question: To what extent has the Bureau addressed census risks?
answer: With less than 1 year until Census Day, many risks remain.
child_questions: question: How has the Bureau responded to technology risks?
answer: For example, the Bureau has had challenges developing critical information technology systems, and new innovations—such as the ability to respond via the internet—have raised questions about potential security and fraud risks.

question: To what extent are risk plans important?
answer: Fundamental to risk management is the development of risk mitigation and contingency plans to reduce the likelihood of risks and their impacts, should they occur.

questions: question: What was GAO asked to review?
answer: GAO was asked to review the Bureau's management of risks to the 2020 Census.

question: What does this report examine?
answer: This report examines (1) what risks the Bureau has identified, (2) the risks for which the Bureau has mitigation and contingency plans, (3) the extent to which the plans included information needed to manage risk, and (4) the extent to which the Bureau's fraud risk approach aligns with leading practices in GAO's Fraud Risk Framework.
child_questions: question: How did GAO collect data for this report?
answer: GAO interviewed officials, assessed selected mitigation and contingency plans against key attributes, and assessed the Bureau's approach to managing fraud risk against GAO's Fraud Risk Framework.