Whistleblower Protection: DOD Has Improved Oversight for Reprisal Investigations but Can Take Additional Actions to Standardize Process and Reporting
Released: 2016-09-07T00:00:00

Letter

DOD Has Taken Actions to Track the Timeliness of Military Whistleblower Reprisal Investigations but Continues to Not Regularly Report on Timeliness to Congress

DODIG has taken a number of actions to improve its tracking of the timeliness of military whistleblower reprisal investigations, including developing an automated tool to address statutory notification requirements. However, DODIG does not regularly report to Congress on the timeliness of military whistleblower reprisal investigations.

DOD Has Made Progress in Tracking the Timeliness of Investigations

In both 2012 and 2015, we found that DOD was not meeting its internal timeliness requirements for completing military whistleblower reprisal investigations within 180 days. Specifically, in 2012 we found that despite undertaking efforts to improve timeliness—such as changing its process for taking in complaints—DOD took a mean of 451 days to process cases, and that its efforts to improve case processing times were hindered by unreliable and incomplete data on timeliness. Further, in 2015 we found that DOD’s average investigation time for cases closed in fiscal years 2013 and 2014 was 526 days, almost three times DOD’s internal completion requirement of 180 days. DOD Directive 7050.06, which implements 10 U.S.C. § 1034 and establishes DOD policy, states that DODIG shall issue a whistleblower reprisal investigation report within 180 days of the receipt of the allegation of reprisal.

To improve the timeliness of military whistleblower reprisal investigations, we recommended in February 2012 that DOD (1) implement procedures to track and report data on its case processing timeliness and (2) track and analyze timeliness data to identify reforms that could aid in processing cases within 180-day time frame. DOD concurred and subsequently took several actions to implement these recommendations. For example, in December 2012 DODIG began implementing a case management system to collect key dates to track the timeliness of DODIG’s investigative phases and in March 2016 issued a case management system guide that established procedures to help ensure accurate and complete recording and consistent tracking of case processing time. Further, DODIG took steps to track and analyze timeliness data that could aid in processing cases within the 180-day timeframe by compiling quarterly timeliness metrics starting in fiscal year 2014, and by updating its case management system in April 2016 to include additional investigation milestones. Because some of these actions were not taken until 2016, it is too early to determine whether timeliness has improved since we last reported on the status.

DOD Recently Developed an Automated Tool to Address Statutory Notification Requirements

In both our 2012 and 2015 reports, we found that DOD generally did not meet statutory requirements for notifying servicemembers within 180 days about delays in investigations. According to 10 U.S.C. § 1034 if, during the course of an investigation, an IG determines that it is not possible to submit the report of investigation to the Secretary of Defense and the service Secretary within 180 days after the receipt of the allegation, the IG shall provide to the Secretary of Defense, the service Secretary concerned, and the servicemember making the allegation a notice of that determination including the reasons why the report may not be submitted within that time and an estimate of the date when the report will be submitted. In 2012, we found that neither the DODIG nor military service IGs had been making the required notifications. During that review, DODIG changed its practice and started reporting this information in October 2011 and identified steps in an action plan to help ensure that it and the military service IGs followed the statutory reporting requirements.

During our 2015 review, DODIG officials stated that they had taken additional steps to help ensure they met the statutory notification requirement. For example, DODIG assigned an oversight investigator to remind the service IGs to send the required letters and developed a mechanism in DODIG’s case management system to indicate which cases were older than 180 days. However, during our 2015 review, we again found that DOD had not sent the required letters to notify servicemembers about delays in their investigations in about half of reprisal investigations closed in fiscal year 2013; that the median notification time for servicemembers receiving the required letter was about 353 days after the servicemember filed the complaint; and that the letters that DOD had sent, on average, had significantly underestimated the date by which the investigation would be competed.

Consequently, we recommended in our 2015 report that DOD develop an automated tool to help ensure compliance with the statutory 180-day notification requirement by providing servicemembers with accurate information regarding the status of their reprisal investigations within 180 days of receipt of an allegation of reprisal. DOD concurred with this recommendation and in April 2016, launched an automated tool within its case management system to help ensure compliance with the statutory 180-day notification requirement, instead of relying on its manual reconciliation process. Specifically, the case management system now has an alert that provides the age of the case and the date by which the notification letter must be transmitted to the required parties. This tool is to help provide assurance that servicemembers are being notified of the status of their reprisal investigations.

Timeliness Information Is Still Not Regularly Reported to Congress

In 2012, we found that although DODIG is required to keep Congress fully and currently informed through, among other things, its semiannual reports to Congress, DODIG was not including in these reports information on military whistleblower case processing time, including (1) statutorily required notifications of delays in the investigations or (2) those exceeding DODIG’s internal 180-day completion requirement. The semiannual report to Congress is required to include information on fraud, abuses, and deficiencies related to the administration of programs and operations managed or financed by DOD, but DOD interpreted this requirement as not applying to the military whistleblower reprisal program. Because Congress is the primary oversight body for DODIG, we recommended that DOD regularly report to Congress on the timeliness of military whistleblower reprisal investigations, including those exceeding the 180-day timeframe. DOD concurred with our recommendation. On August 31, 2016, the DOD Principal Deputy Inspector General performing the duties of the DOD Inspector General stated that the office will implement this recommendation by regularly reporting timeliness information to Congress on a biannual basis. We believe that if this action is taken, it will fully implement our recommendation, provide Congress with enhanced visibility over the status of military whistleblower reprisal investigations, and thereby improve decisionmakers’ ability to effectively oversee the military whistleblower reprisal program.

DOD Strengthened Its Oversight of Military Whistleblower Reprisal Investigations, but Additional Actions Are Needed

DOD Established Processes and Developed Guidance to Strengthen Its Oversight of Military Whistleblower Reprisal Investigations

In 2012 and 2015, we found that DODIG’s oversight of military whistleblower reprisal investigations conducted by the military services was hampered by insufficient processes, including performance metrics; guidance; and plans. DOD subsequently took steps to strengthen its oversight of military whistleblower reprisal investigations conducted by the military services by establishing processes and developing guidance for overseeing these investigations—along with a plan to expand its case management system to the services.

Processes

In 2012, we found that DODIG lacked reliable data on the corrective actions taken in response to substantiated whistleblower reprisal cases, thus limiting the visibility and oversight DOD and Congress have of the final portion of the military whistleblower reprisal process. DOD Directive 7050.06 directs the Secretaries of the military departments and the heads of the other DOD components to take corrective action based on IG reports of investigations of military whistleblower reprisal allegations and to notify DODIG of the actions taken within 10 working days. Further, DODIG requires that the service IGs report back to DODIG on command actions taken against the individual alleged to have reprised against a whistleblower, according to officials from these organizations. However, in 2012 we found that DODIG had not been maintaining reliable information on command actions needed to oversee this process. Specifically, for 40 percent of all substantiated cases that DODIG closed from October 1, 2005, through March 31, 2011, the database that DODIG used during that period did not contain information on the command actions taken.

As a result, we recommended in our 2012 report that DOD (1) establish standardized corrective action reporting requirements, and (2) consistently track and regularly reconcile data regarding corrective actions. DOD addressed these recommendations by issuing an update to its military whistleblower directive in April 2015 that required standardized corrective action reporting requirements by the services. DODIG also issued additional guidance in its March 2016 investigations manual requiring that investigators populate data fields for corrective actions and remedies. Finally, DODIG provided us with a report in April 2016 detailing its tracking of corrective actions taken in response to substantiated reprisal cases between October 2011 and January 2016.

In 2012, we also found that DODIG had not yet fully established performance metrics for ensuring the timeliness and quality of whistleblower reprisal investigations but was taking steps to establish timeliness metrics that focused on investigation processing time. Federal internal control standards state that metrics are important for identifying and setting appropriate incentives for achieving goals while complying with law, regulations, and ethical standards. Further, we found in our previous work that metrics on both timeliness and quality—such as completeness of investigative reports and the adequacy of internal controls—can enhance the ability of organizations to provide assurance that they are exercising all of the appropriate safeguards for federal programs. During our 2012 review, DODIG officials stated that they recognized the importance of both timeliness and quality metrics and that they planned to develop quality metrics as part of their effort to improve case management and outcomes. They further noted that quality metrics could include measuring whether interviews are completed and documented and whether conclusions made about the case are fully supported by evidence. To assist DOD in improving oversight of the whistleblower reprisal program, we recommended in our 2012 report that DOD develop and implement performance metrics to ensure the quality and effectiveness of the investigative process, such as ensuring that the casefiles contain evidence sufficient to support the conclusions.

DOD concurred with our recommendation and in 2014 fully developed timeliness metrics, along with some performance metrics to assess the completeness of a sample of (1) DODIG-conducted whistleblower reprisal investigations and (2) DODIG oversight reviews of the military services whistleblower reprisal investigations. For example, now DODIG is to complete internal control checklists for investigations it conducts and oversight worksheets for investigations conducted by the military services to determine whether casefiles are compliant with internal policy and best practices. On a quarterly basis, DODIG is to draw a sample of the checklists and oversight worksheets for cases closed by DODIG and the military service IGs and compare these checklists to the quality metrics that it developed. According to DODIG officials, these metrics were briefed to the DOD Inspector General in fiscal year 2014. DODIG officials stated in July 2016 that they continued to conduct quality assurance reviews and collect associated metrics in fiscal year 2015, but that they have not briefed these metrics to the DOD Inspector General since fiscal year 2014 and that changes to the metrics briefings are forthcoming per direction from the DOD Inspector General and Principal Deputy Inspector General. DODIG did not provide information on the nature of these changes. While we believe that DODIG’s actions should help oversee the quality of investigations, we will continue to work with the DODIG and monitor its progress in implementing and communicating these performance metrics during our ongoing review assessing whistleblower reprisal investigation processes for DOD civilian employees and contractors. Further, we also believe that until the military services follow standardized investigation stages, as discussed later in this statement, it will be difficult for the DODIG to consistently measure the quality of the services’ military whistleblower reprisal investigations.

Separately, in 2015, we found that DODIG and the service IGs had processes for investigators to recuse themselves from investigations, but there was no process for investigators to document whether the investigation they conducted was independent and outside the chain of command. Council of the Inspectors General on Integrity and Efficiency standards state that in all matters relating to investigative work, the investigative organization must be free, both in fact and appearance, from impairments to independence. Further, guidance for documenting independence is included in generally accepted government auditing standards, which can provide guidance to service IGs as a best practice on how to document decisions regarding independence when conducting reprisal investigations.

At the time of our 2015 review, DODIG officials stated that their recusal policies for investigators, their decentralized investigation structure, and their removal of the investigator from the chain of command adequately addressed independence issues and that no further documentation of independence was needed. However, during the case file review we conducted for our 2015 report, we identified oversight worksheets on which DODIG oversight investigators had noted potential impairments to investigator objectivity in the report of investigation. For example, one oversight worksheet stated that the report gave the appearance of service investigator bias, and another oversight worksheet stated that the investigator was not outside the chain of command, as is statutorily required. DODIG approved these cases without documenting how it had reconciled these case deficiencies. As a result, in our 2015 report we recommended that DOD develop and implement a process for military service investigators to document whether the investigation was independent and outside the chain of command and direct the service IGs to provide such documentation for review during the oversight process. DOD concurred with this recommendation and issued a memorandum in June 2015 that informed service IGs that DODIG would look for certification of an investigator’s independence during its oversight reviews. Concurrently, DODIG also directed the service IGs to provide such documentation.

Guidance

In 2012, we found that DODIG was updating its guidance related to the whistleblower program but that the updates had not yet been formalized and that the guidance that existed at that time was inconsistently followed. According to the Council of the Inspectors General on Integrity and Efficiency’s quality standards for investigations, organizations should establish appropriate written investigative policies and procedures through handbooks, manuals, directives, or similar mechanisms to facilitate due professional care in meeting program requirements. Further, guidance should be regularly evaluated to help ensure that it is still appropriate and working as intended. However, in 2012 we found, among other things, that DODIG’s primary investigative guide distributed to investigators conducting whistleblower reprisal investigations had not been updated since 1996 and did not reflect some investigative processes that were current in 2012. Additionally, because guidance related to key provisions of the investigative process was unclear, it was being interpreted and implemented differently by the service IGs. As a result, we recommended in our 2012 report that DODIG update its whistleblower reprisal investigative guidance and ensure that it is consistently followed, including clarifying reporting requirements, responsibilities, and terminology. DOD concurred with this recommendation and in October 2014 released a guide of best practices for conducting military reprisal investigations and in April 2015 updated Directive 7050.06 on military whistleblower protection, which established policies and assigned responsibilities for military whistleblower protection and defined key terminology.

Separately, in 2015 we found that DODIG had provided limited guidance to users of its case management system on how to populate case information into the system. The case management system, in use since December 2012, was to serve as a real-time complaint tracking and investigative management tool for investigators. DOD’s fiscal year 2014 performance plan for oversight investigators notes that investigators should ensure that the case management system reflects current, real- time information on case activity. This intent aligns with Council of the Inspectors General on Integrity and Efficiency’s quality standards for investigations, which state that accurate processing of information is essential to the mission of an investigative organization and that this begins with the orderly, systematic, accurate, and secure maintenance of a management information system. However, based on our file review of a sample of 124 cases closed in fiscal year 2013, we found that DODIG investigators were not using the case management system for real-time case management. Specifically, we estimated that DODIG personnel uploaded key case documents to the system after DODIG had closed the case in 77 percent of cases in fiscal year 2013. Among other things, these documents included reports of investigation, oversight worksheets, and 180-day notification letters regarding delays in completing investigations. Additionally, we estimated that for 83 percent of cases closed in fiscal year 2013, DODIG staff had made changes to case variables in the case management system at least 3 months after case closure.

DODIG officials stated in 2015 that they planned to further develop a manual for the case management system that was in draft form along with internal desk aides, but that they did not plan to issue additional internal guidance for DODIG staff on the case management system because they believed that the existing guidance was sufficient. However, DODIG’s draft manual did not instruct users on how to access the system, troubleshoot errors, or monitor caseloads. As a result, in our 2015 report we recommended that DOD issue additional guidance to investigators on how to use the case management system as a real-time management tool. DOD concurred with this recommendation and in March 2016 issued a case management system user guide and in July 2016, a data entry guide. Collectively, these guides provide users with key information on how to work with and maintain data in the case management system.

Case Management System Plan

In 2015, we found that each military service IG conducted and monitored the status of military whistleblower reprisal investigations in a different case management system and that DODIG did not have complete visibility over service investigations from complaint receipt to investigation determination. Further, we found that DODIG did not have knowledge of the real-time status of service-conducted investigations and was unable to anticipate when service IGs would send completed reports of investigation for DODIG review. DODIG is required to review all service IG determinations in military reprisal investigations in addition to its responsibility for conducting investigations of some military reprisal complaints, and DOD Directive 7050.06 requires that service IGs notify DODIG of reprisal complaints within 10 days of the receipt of a complaint. However, our analysis indicated that DODIG’s case management system did not have records of at least 22 percent of service investigations both open as of September 30, 2014, and closed in fiscal years 2013 and 2014. Further, based on our file review, we estimated that there was no evidence of the required service notification in 30 percent of the cases closed in fiscal year 2013. We concluded that without a common system to share data, DODIG’s oversight of the timeliness of service investigations and visibility of its own future workload was limited.

At the time of our 2015 review, DOD was taking steps to improve its visibility into service investigations, including by expanding its case management system to the military services. DODIG officials stated that they had created a working group comprising representatives from each of the service IGs to facilitate the expansion and that they planned a complete rollout to the service IGs by the end of fiscal year 2016. However, DODIG did not have an implementation plan for the expansion and had not yet taken steps to develop one. Project management plans should include a scope—to describe major deliverables, assumptions, and project constraints—project requirements, schedules, costs, and stakeholder roles and responsibilities and communication techniques, among other things. Given DOD’s stated plans to expand the case management system to the service IGs by the end of fiscal year 2016, we recommended in our 2015 report that DOD develop an implementation plan that addresses the needs of DODIG and the service IGs and defines project goals, schedules, costs, stakeholder roles and responsibilities, and stakeholder communication techniques. DOD concurred with this recommendation and subsequently developed a plan in April 2016, in coordination with the military services, which included the elements we recommended for a plan to expand its case management system into an enterprise system. This plan states that the enterprise case management system will launch between February 2018 and May 2018 and notes that the project budget between fiscal years 2017 and 2021 is approximately $25.3 million.

Additional Actions Are Needed to Further Strengthen Oversight of Military Whistleblower Reprisal Investigations

Although DODIG has taken several important actions, additional actions are still needed to further strengthen the capacity of DODIG and the Congress to oversee military whistleblower reprisal investigations. These actions include standardizing the investigation process and reporting corrective action information to Congress.

Standardized Investigation Stages

In 2015, we found that the DODIG and the military service IGs use different terms in their guidance to refer to their investigations, thus hindering DODIG’s ability to consistently classify and assess the completeness of cases during its oversight reviews. For example, we found that in the absence of standardized investigation stages, DODIG investigators had miscoded approximately 43 percent of the cases that DODIG had closed in fiscal year 2013 as full investigations, based on our estimate, when these investigations were instead preliminary inquiries as indicated in the services’ reports of investigation. The Council of the Inspectors General on Integrity and Efficiency’s quality standards for investigations state that to facilitate due professional care, organizations should establish written investigative policies and procedures that are revised regularly according to evolving laws, regulations, and executive orders. DODIG took an important step to improve its guidance by issuing an updated reprisal investigation guide for military reprisal investigations for both DODIG and service IG investigators in October 2014. However, the guide states that it describes best practices for conducting military reprisal intakes and investigations and DODIG officials told us that the guide does not explicitly direct the services to follow DODIG’s preferred investigation process and stages. These officials further stated that they have no role in the development of service IG regulations.

To improve the military whistleblower reprisal investigation process and oversight of such investigations, in our 2015 report we recommended that the Secretary of Defense in coordination with the DODIG, direct the military services to follow standardized investigation stages and issue guidance clarifying how the stages are defined. DOD concurred with this recommendation and subsequently updated its guide in June 2015. However, this guide is still characterized as describing best practices and does not direct the services to follow standardized investigation stages. We note that 10 U.S.C. § 1034 provides the authority for the Secretary of Defense to prescribe regulations to carry out the section. Also, DOD Directive 7050.06 assigns DODIG the responsibility to provide oversight of the military whistleblower reprisal program for the department. DODIG officials noted in August 2016 that they are currently working with the military services through an established working group to standardize the investigation stages as an interim measure. The DOD Principal Deputy Inspector General performing the duties of the DOD Inspector General also indicated in August 2016 that the office is willing to coordinate with the Secretary of Defense to issue authoritative direction to the services to standardize the investigation stages, but that this will take time.

Reporting on Corrective Actions

As previously mentioned, we found in 2012 that DOD lacked reliable data on the corrective actions taken in response to substantiated whistleblower reprisal cases, thus limiting the visibility and oversight that DOD and Congress have of the final portion of the military whistleblower reprisal process. We also noted in 2012 that a 2009 Department of Justice review recommended that the results of investigations that substantiate allegations of reprisal be publicized as a way to heighten awareness within the services of the Military Whistleblower Protection Act, to potentially deter future incidents of reprisal, and to possibly encourage other reprisal victims to come forward. While the DODIG cannot directly take corrective action in response to a substantiated case per DOD Directive 7050.06, it is the focal point for DOD’s military whistleblower reprisal program and is well positioned to collect and monitor data regarding program outcomes. Further, DODIG officials stated in 2012 that because DODIG is the focal point, it is important for it to have visibility and information of all military whistleblower reprisal activities, not only to provide oversight but also to provide a central place within the department where internal and external stakeholders can obtain information.

In addition to the recommendations we made regarding establishing corrective action reporting requirements and regularly tracking these data, we also recommended in our 2012 report that DOD regularly report to Congress on the frequency and type of corrective actions taken in response to substantiated reprisal claims. We noted that DOD could do so, for example, through its semiannual reports to Congress. DOD concurred with that recommendation and has since included examples in its semiannual reports to Congress of corrective actions taken by the military services for substantiated cases but not a comprehensive list of all corrective actions taken. However, in following up on actions that DODIG has taken regarding this recommendation in August 2016, DODIG officials stated that the corrective actions listed in its semiannual reports to Congress included all corrective actions taken during the 6 month reporting period, but that the reports incorrectly identified these actions as examples. DODIG provided us corrective action information to compare with the corrective actions reported in DODIG’s December 2015 and March 2016 semiannual reports to Congress for those reporting periods. We identified some key differences. Specifically, we identified corrective actions in the information provided to us by DODIG that were not published in the December and March reports to Congress and identified discrepancies in the types of corrective action contained in the reports and in the information that DODIG provided. As a result, we believe that DODIG’s two most recent semiannual reports to Congress did not include the frequency and type of all corrective actions reported during those reporting periods.

Relatedly, we also noted in August 2016 that DODIG’s semiannual reports did not include other information needed to convey the frequency and type of corrective actions. Specifically, DODIG officials stated in August 2016 that their case management system would require additional capability in order to produce a list of substantiated allegations that do not have associated corrective actions, which would indicate which corrective action recommendations are outstanding. Further, these officials stated that publishing information showing the status of all DODIG corrective action recommendations—not just actions that were taken during a particular reporting period—could be misleading because the military services sometimes take actions that are different than those recommended by DODIG and that may not result from reprisal investigations. However, as noted in the 2009 Department of Justice review, publicizing the results of investigations that substantiate allegations of reprisal may help to deter future incidents of reprisal and encourage other whistleblowers to come forward. Without including information on (1) all corrective actions taken during a reporting period, (2) outstanding corrective action recommendations, and (3) actions taken by the services that are different than those recommended by DODIG, we believe that DODIG’s current method of reporting does not fully address our recommendation to report to Congress on the frequency and type of corrective action taken in response to substantiated claims. Moreover, it does not meet the requirement to keep Congress fully and currently informed on the progress of implementing corrective actions through, among other things, its semiannual reports to Congress. We therefore continue to believe that without such information, Congress will be hindered in its ability to provide oversight of the corrective action portion of the military whistleblower reprisal program.

In summary, DOD has taken actions to implement 15 of the 18 recommendations that we made to address the military whistleblower reprisal timeliness and oversight challenges we identified in our 2012 and 2015 reports. These efforts constitute progress toward improving the DODIG’s ability to accurately track the timeliness of military whistleblower reprisal investigations and increase the DODIG’s ability to effectively oversee the department’s military whistleblower reprisal program. Fully implementing the remaining 3 recommendations would further strengthen DODIG’s capacity to assess the quality of military whistleblower reprisal investigations and enhance Congress’ visibility into the timeliness of investigations as well as into the corrective actions taken for substantiated allegations. We have ongoing work that will help to both monitor the actions taken by DODIG to improve its oversight of military reprisal investigations and provide additional insight on the DODIG’s ability to conduct timely and quality reprisal investigations for DOD’s civilian and contractor employees.

Chairman DeSantis, Ranking Member Lynch, and Members of the Subcommittee, this concludes my prepared statement. I look forward to answering any questions that you might have.

GAO Contact and Staff Acknowledgments

If you or your staff have any questions about this statement, please contact Brenda S. Farrell, Director, Defense Capabilities and Management at (202) 512-3604 or FarrellB@gao.gov, or Lori Atkinson, Assistant Director, Defense Capabilities and Management at (404) 679- 1852 or AtkinsonL@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Tracy Barnes, Sara Cradic, Ryan D’Amore, Taylor Hadfield, and Mike Silver.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.