National Mediation Board: Progress Made on Some GAO Recommendations to Strengthen Operations, but Key Controls Continue to Be Needed
Released: 2016-02-12T00:00:00

Letter

Background

NMB’s Organization and Mission

NMB is headed by a three-member board, with each member appointed by the President and confirmed by the Senate for a term of 3 years. Day-to-day administration of the agency is provided by NMB’s General Counsel within the Office of Legal Affairs and the Chief of Staff (see fig. 1). NMB does not have an office of inspector general to provide independent audit and investigative oversight.

According to NMB, its overall mission is to provide for the independence of air and rail carriers and employees in matters of self-organization, avoid interruption to commerce conducted through the operation of those carriers, and administer statutory adjustment boards as well as develop complementary strategies to resolve disputes. To fulfill its mission, NMB has three program areas:

Representation: Unions are selected for the purposes of collective bargaining through secret-ballot elections conducted by NMB. If there is a question concerning representation of a specific craft or class,NMB is charged with resolving the representation dispute through its Office of Legal Affairs, and has the sole jurisdiction to decide these disputes.

Mediation and Alternative Dispute Resolution: The RLA provides mediation to help resolve disputes that can occur between management and labor during collective bargaining negotiations.When rail or air carriers and unions cannot reach agreement on the terms of a new or revised collective bargaining agreement—such as working conditions or rates of pay—either party can apply for NMB’s mediation services to resolve their differences or NMB may impose mediation if it finds that resolving the dispute is in the public’s interest. NMB also offers grievance mediation to parties as an alternative way to resolve disputes filed for grievance arbitration.

Arbitration: The RLA also offers grievance arbitration to help resolve disagreements between carriers and unions over how to interpret and apply provisions of existing collective bargaining agreements. For example, employees may file grievances if they believe they were wrongfully fired or disciplined in violation of the agreement. If the carrier and the employee cannot resolve the grievance, the RLA permits either of these parties to refer the dispute to arbitration before an adjustment board. The adjustment board consists of a carrier representative, a union representative, and a neutral arbitrator provided by NMB. In this capacity, the arbitrator is called upon to break a tie. NMB does not directly provide arbitration services, but rather maintains a list of registered arbitrators from which the parties can select someone to review and decide their case. In the airline industry, the parties pay the costs of arbitration. In the railroad industry, however, consistent with the requirements of the RLA, NMB pays the fee and travel expenses of the arbitrator.

NMB Has Made Progress, but Has Not Yet Fully Implemented GAO’s 2013 Recommendations

NMB has made some progress in implementing each of the seven recommendations we made in December 2013.

Developing a Strategic Planning Process

In our December 2013 report, we found that NMB lacked a formal strategic planning process and officials confirmed that they did not have a systematic mechanism for involving congressional and other stakeholders in this process. We concluded that without a robust process, NMB lacked assurance that its limited resources were effectively targeted toward its highest priorities.

In this review, we found that NMB has implemented a strategic planning process but has not formalized it through written policies and procedures. In fiscal year 2014, NMB developed and published a strategic plan covering fiscal years 2014 through 2019, which we determined was largely consistent with OMB guidance on implementing the GPRA Modernization Act of 2010 (GPRAMA). NMB officials told us they used a strategic planning process soliciting input from staff in NMB program areas as well as from external stakeholders and Congress. Five of the seven external stakeholder groups that we interviewed said they commented on a draft of the strategic plan or discussed aspects of it during regular meetings with the agency, and all reported being satisfied with their overall communication with NMB.

However, the agency has not developed a written policy or set of procedures outlining its strategic planning process. Federal internal control standards call for agencies to document the policies and procedures necessary to achieve their objectives, including strategic planning. Specifically, agencies should (1) establish policies and procedures to ensure that management directives are carried out and (2) appropriately document transactions and other significant events, and ensure that those records are properly managed, maintained, and available for examination. Further, through these policies and procedures, agency management can define responsibilities, assign key roles, and delegate authority.

Meeting these requirements may be particularly important for NMB. NMB officials said there was little need for preparing written documentation of the strategic planning process, such as a standard operating procedure, because it was simple and would be easy to replicate in the future. Officials also said, because the agency is small, with 51 full-time positions, its staff frequently communicate informally, limiting the need for written procedures. However, three of NMB’s five senior managers, including the Chief of Staff and General Counsel, are eligible to retire, as are many other employees, increasing the risk of the agency losing institutional knowledge should they do so. Moreover, because the agency is small, some staff members have multiple responsibilities, increasing the magnitude of knowledge loss when an individual staff member leaves the agency.

Establishing Performance Goals and Measures

In our December 2013 report, we found that NMB was not meeting OMB guidance to implement GPRAMA requirements for annual performance planning and reporting. Specifically, the agency’s performance goals were not objective, quantifiable, and measurable—as required by GPRAMA— and did not have targets and a time period over which to measure performance—as recommended by OMB guidance implementing GPRAMA. Without meeting this federal guidance, we concluded that the agency was not positioned to track and publicly report progress or results in its program areas.

In this review, we found that NMB has developed new performance goals. However, of the 19 goals in its fiscal year 2016 performance plan, one goal specified a target, another specified a timeframe; but none followed all elements of OMB guidance for implementing GPRAMA. Several NMB officials told us that it is difficult for the agency to design performance goals because some outcomes are out of its control, such as how long it takes parties to reach agreement through mediation. Many federal agencies also set measurable performance goals for outcomes that include external factors outside of their direct control. Our prior work has shown that there are a number of strategies that federal agencies can use to reduce the influence of external factors on agencies’ measures. OMB officials told us NMB could seek assistance from them to refine its performance goals or could partner with another agency that has a strong performance management department.

Resolving Auditor Findings and Recommendations

GAO 2013 Recommendation: NMB should develop and implement a formal mechanism to ensure the prompt resolution of findings and recommendations by independent auditors, including clearly assigning responsibility for this follow-up to agency management.

In our December 2013 report, we found that NMB was following most key practices for financial accountability and control, but had an outstanding significant deficiency from its fiscal year 2012 financial statement audit and did not have a mechanism for ensuring prompt resolution of audit findings. As a result, we concluded that some recommendations made by auditors to improve the agency’s internal controls or operations may not have been addressed.

In this review, we found that while NMB in fiscal year 2015 resolved the significant deficiency identified in its 2012 financial statement audit, it does not have a formal mechanism to promptly resolve all audit findings consistent with federal internal control standards. Specifically, while NMB drafted a financial audit standard operating procedure in 2014, it does not cover the agency’s response to findings from non-financial audits. The agency has also not addressed two recommendations made in previous auditors’ management letters that accompanied NMB’s financial audit reports. One of those recommendations was made as a result of the fiscal year 2014 audit and the other recommendation was related to a discrepancy that has been unresolved since 1995. In its fiscal year 2015 response, NMB indicated that the only management official with knowledge of the long-term discrepancy had retired and the agency would work to resolve the discrepancy through its financial management system.

Ensuring Information Security and Privacy

In our December 2013 report, we found that NMB had not fully implemented key practices for information security and privacy. Without implementation of these key practices, we concluded that NMB had increased risks that the confidentiality, integrity, and availability of its information would be compromised and it had limited assurance that the personal information it collected and used was adequately protected.

In this review, we found that NMB has fully transitioned its network infrastructure and records management system into a cloud computing environment as a result of federal initiatives aimed at improving, among other things, the federal government’s operational efficiencies and overall IT security posture. NMB also fully transitioned its financial systems to third-party service providers. Specifically, NMB relies on other agencies’ systems, such as the Department of the Interior, for payroll, personnel, and human resources services, and the Department of the Treasury’s Bureau of the Fiscal Service for a full range of accounting services, including hosting its financial management system.

In addition, NMB has begun to take steps to improve its information security program. Specifically, NMB developed a policy for managing agency information, documents, and records. The agency has also drafted procedures for its new enterprise network that include provisions for access and identity control, configuration management, planning, contingency monitoring, and audits. Further, it has developed a procedure for handling cyber incidents. Finally, it has an agreement in place with the Bureau of the Fiscal Service to, among other things, conduct a security assessment of its enterprise network.

However, NMB has not fully implemented most key information security and privacy practices. (For additional details, see appendix II.) For example, the agency does not have policies and procedures in place for its information security program, including those for the oversight of third- party providers—entities that provide or manage information systems that support NMB operations. In addition, NMB has not conducted the required assessments of its third-party providers to ensure their systems are in compliance with the Federal Information Security Modernization Act (FISMA) of 2014. FISMA requires federal agencies to develop, document, and implement an agency-wide information security program to protect the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

Moreover, NMB has not assessed whether its third-party providers’ systems were in compliance with the Privacy Act of 1974 and E- Government Act of 2002, which describe, among other things, agency responsibilities with regard to protecting personally identifiable information.

NMB officials said the agency is taking steps to address its remaining information security and privacy issues. For example, because the agency’s new enterprise network is now a cloud-based system, NMB plans to use the Federal Risk and Authorization Management Program (FedRAMP), to the extent possible, to guide the development of its agency-wide policies and procedures, including how it will oversee its third-party providers and ensure they are in compliance with FISMA. In addition, NMB reached out to OMB in September 2015, and NMB officials said they have tried reaching out to the Department of Homeland Security (DHS) to ensure NMB is doing what is required to meet annual FISMA reporting requirements. NMB officials said they have been receiving information on FISMA from OMB, but not from DHS.

Further, NMB officials said they are working on drafting information security program and privacy policies and procedures. They said that finalizing the information security policies and procedures will assist the agency in completing all of its required reviews in the future.

Developing a Strategic Workforce Plan

In our December 2013 report, we found that NMB’s human capital program was not guided by a strategic workforce plan. Without workforce planning, a key internal control, we concluded that agency management could not ensure that skill needs would be continually assessed and that the agency would be able to obtain and maintain a workforce with the skills necessary to achieve organizational goals. Without a plan, the agency could not monitor and evaluate the results of its workforce planning efforts, including whether those efforts contributed to the agency accomplishing its strategic goals.

In this review, we found NMB in October 2014 completed a strategic workforce plan that at least partially addressed four of the five practices from our December 2013 recommendation (see table 2).

While members of one of NMB’s advisory groups said they provided input on some of the agency’s workforce decisions, our prior work suggests that formally including stakeholders in the workforce planning process can help the agency develop ways to streamline processes and improve human capital strategies. In addition, NMB’s performance goals, including those related to human capital, do not meet federal guidance. Without performance goals that meet guidance or the inclusion of other monitoring and evaluation efforts in its workforce and succession plan, the agency is not positioned to measure the outcomes of its human capital strategies or evaluate whether these strategies helped it accomplish its goals.

Managing Rail Grievance Arbitration

In our December 2013 report, we found that NMB was struggling to efficiently manage grievance cases in the rail industry and it lacked data on the types of grievances filed to more efficiently manage the process. As a result, we concluded that if NMB did not address this demand on its limited resources, it could face a growing backlog of arbitration cases.

In this review, we found that NMB is collecting data on the type of grievances filed for arbitration in some, but not all cases. An NMB official said part of the reason the agency is not collecting complete data on grievance types is because it does not have access to all cases. NMB reviews all grievances filed for arbitration by either a railroad or union and then forwards them to one of three types of adjustment boards—the National Railroad Adjustment Board (NRAB), a Public Law Board, or a Special Board of Adjustment. NMB is able to track information on the type of grievances filed for arbitration by the Public Law Boards and Special Boards of Adjustment because NMB requires parties to code their grievance type when they file their request for these boards. Parties filing grievances with NRAB, however, are not required by NMB to code their grievance type, an NMB official said, because NRAB is an independent organization that sets its own procedures and NMB cannot require that grievance codes be included in requests for arbitration filed with NRAB. However, NMB may be able to obtain that information because NRAB officials told us they track information on grievance type and are willing to share this information with NMB.

Even with data on types of grievances filed for all cases, it is not clear the extent to which NMB would analyze them to address the arbitration backlog. One program official said that NMB does not have a systematic way to identify cases that may be good candidates for some type of alternative to arbitration, such as grievance mediation, because staff cannot easily access case information in a way that makes it readily available for analysis. Analysis of these cases continues to be largely a manual process that takes significant staff resources, he said. According to an NMB information technologist, in the past, the agency has primarily relied on staff to sort and analyze these data. However, the agency’s new arbitration case management system, which it upgraded in November 2015, should be able to produce by spring 2016 standard electronic data reports that would facilitate this analysis. Until those reports are available, it appears NMB will have limited ability to analyze data that might help it reduce its arbitration backlog, which, according to NMB, continues to grow.

NMB Has Not Established Procurement Policies and Processes That Reflect Its New Procurement Environment

NMB is following key procurement practices in 2 of 3 areas that our prior work on assessing the acquisition function at federal agencies identified as promoting agencies’ efficient, effective, and accountable procurement functions—organizational alignment and leadership; and knowledge and information management. NMB, however, has not developed policies and processes—a third area our prior work identified—that reflect its new procurement interagency agreement. After the retirement of its only contracting officer in January 2014, NMB entered into an interagency agreement with the Department of the Treasury’s Bureau of the Fiscal Service (Fiscal Service) for provision of certain procurement functions that NMB had previously handled in-house.

In this new environment, NMB is continuing to align its procurement function with its mission and ensure adequate resources to meet its procurement needs, a key practice to facilitate efficient and effective management of acquisition activities. Its Office of Administration is at an organizational level comparable to other key mission offices, such as the Office of Mediation and Alternative Dispute Resolution and the Office of Arbitration. An NMB official told us that the agency also involves internal stakeholders in acquisition decisions, including determining procurement needs, reviewing existing contracts before automatically renewing them, and justifying purchase requests. In addition, the agency entered into the interagency agreement with the Fiscal Service in response to changes in its workforce (i.e., the retirement of its contracting officer). Further, to ensure NMB has a procurement workforce adequate to support the organization’s needs, two staff are being trained as contracting officers because not having a contracting officer is a risk to the agency, the NMB official said. In addition, six NMB staff were trained and certified as contracting officer representatives, who assist the contracting officer in providing administration of contract actions under the interagency agreement and evaluating performance.

NMB is also following a second key practice by establishing knowledge and information tools to help it make well-informed procurement decisions. NMB now has access to electronic data on purchase requests from the procurement and financial management systems administered by Fiscal Service. Fiscal Service also provides NMB with monthly billing reconciliations and weekly updates on the status of its contracts. A NMB official said that the information received from Fiscal Service has helped the agency analyze and adjust its spending and, as a result, NMB has eliminated contracts for items it no longer needs, such as storage space, copiers, and periodical subscriptions.

However, NMB is not following an element of a third key practice—to have policies and processes in place consistent with internal control standards and best practice. NMB has not developed written internal policies and processes that reflect its new interagency agreement procurement environment. The NMB procurement official said the agency does not have current policies and processes because some of the previous policies and procedures were lost in the transition which occurred when the previous contracting officer retired. As a result, the agency has had to recreate them, the official said. The agency’s fiscal year 2014 to 2019 strategic plan (as amended in fiscal year 2015) called for procurement processes to be updated by the end of fiscal year 2014 in light of the new procurement environment. Developing and implementing written procurement policies and processes that reflect NMB’s current procurement environment could help ensure its staff use consistent processes under this new environment.

Conclusions

Since we made our recommendations in December 2013, NMB has taken several positive steps in response, such as developing strategic and workforce plans and closing a long-standing deficiency in a financial statement audit. However, additional actions are needed to fully respond to those recommendations. For example, NMB’s performance goals do not yet meet all federal guidance. As a result, the agency is not positioned to track and publicly report progress or results in its program areas. In the areas of strategic planning and information security and privacy, officials were not able to provide the written policies and procedures that guide their actions, consistent with standards for internal control. Without fully implementing these recommendations, NMB cannot ensure that its limited resources are effectively targeted toward its highest priorities. Moreover, it may be missing opportunities to improve performance and mitigate risks in its program and management areas. In addition, NMB has not developed written policies and procedures that reflect its new procurement environment under its interagency agreement. Without written policies and processes—as called for by internal control standards and best practice—NMB cannot ensure the use of consistent procurement processes.

We continue to believe, as suggested in our December 2013 report, that Congress should consider authorizing an appropriate federal agency’s Office of Inspector General to provide independent audit and investigative oversight of NMB.

Recommendations for Executive Action

We recommend that the Chairman of the National Mediation Board develop and implement written policies and processes to reflect the agency’s current procurement environment.

Agency Comments and Our Evaluation

We provided a draft of this report to the National Mediation Board (NMB) for comment. The agency provided written comments, which are reproduced in their entirety in appendix III. We also shared a draft with the Office of Management and Budget (OMB) and Office of Personnel Management (OPM). Neither agency provided comments.

NMB commented that many of the areas we had concerns about are not under its direct control considering that NMB has entered into interagency agreements for certain services with the Department of the Interior and the Department of the Treasury’s Bureau of the Fiscal Service (Fiscal Service). We continue to believe, however, that NMB must retain ultimate control and responsibility for all its programs and data, regardless of which agencies are to perform the services. For example, with regard to our findings related to information security, NMB commented that it will develop standard operating procedures for reviewing audits conducted by its third-party providers, but that it does not have the resources to conduct its own audits of those contracted agencies. Under FISMA, however, NMB is responsible for developing, documenting, and implementing a security program to protect its information systems and data, including those managed by another agency, contractor, or other source. We believe that developing procedures for reviewing audits conducted by third-party providers will be a positive step toward ensuring that NMB is conducting this required oversight.

NMB agreed with our recommendation to develop and implement policies and processes to reflect the agency’s current procurement environment and indicated it is taking steps to do so. NMB also commented that because it does not manage all of its own procurements, its policies and processes would be largely subordinate to those of the Fiscal Service. However, because NMB’s interagency agreement with the Fiscal Service for performance of certain procurement functions does not absolve NMB of its responsibility to develop policies and processes as called for by internal control standards and best practice, NMB must develop its own set of complementary policies and processes to ensure the agency meets its needs through efficient, effective, and accountable procurement functions.

In terms of its response to audits, NMB commented that all program audit findings have been addressed and that there are no outstanding issues related to any audits. While we recognized in the report that NMB resolved a long-standing, significant deficiency in its fiscal year 2015 financial statement audit, we disagree that all audit issues have been resolved. NMB needs to develop policies and procedures to address findings from all audits, not solely those reported in the financial statement audit report.

NMB also commented that some of our concerns appeared to be related to the agency’s failure to sufficiently document its processes and that this was not necessarily an indication of noncompliance with any particular requirement. We agree that NMB has made strides in certain areas, such as developing strategic and workforce plans, but its actions are not in accordance with federal guidance or federal internal control standards in some areas. For example, in the areas of strategic planning, information security and privacy, and procurement, officials were not able to provide the written policies and procedures that guide their actions. We continue to believe it is important for NMB to create this documentation to ensure future consistency and success in its management and program areas.

Finally, NMB commented it had concerns that we continued to assert the agency did not adequately consult with its stakeholders even though we noted several times in the report that stakeholders told us they had input and were satisfied with their overall communication with the agency. Stakeholder groups did tell us they had good communication with NMB, particularly with regard to the agency’s strategic planning. However, in the development of its workforce plan, NMB officials said that they did not specifically solicit stakeholder input, and the agency’s workforce and succession plan does not address collecting and incorporating feedback from stakeholders. As our prior work suggests, it will be important for NMB to formally include stakeholders in this process in the future because involving stakeholders can help the agency develop ways to streamline processes and improve human capital strategies.

We are sending copies of this report to the Chairman of NMB and appropriate congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-7215 or brownbarnesc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

The FAA Modernization and Reform Act of 2012 included a provision for us to evaluate and audit the programs, operations, and activities of the National Mediation Board (NMB) every 2 years. Our first report was issued in December 2013. This is the second review of NMB and this report examines the extent to which NMB: 1. has implemented each of our December 2013 recommendations, and 2. has incorporated key procurement practices.

To address our research objectives, we reviewed key NMB documents and compared those documents with relevant federal laws, regulations, guidance, and related leading practices identified in our previous work (see table 3).

We interviewed NMB officials and current board members. In addition, we interviewed key stakeholders who were interviewed for the December 2013 report, among others. Specifically, we interviewed representatives from key rail and air management and labor groups including Airlines for America, National Railway Labor Conference, AFL-CIO Transportation Trades Department and affiliated rail and air unions, and the International Brotherhood of Teamsters. Further, we interviewed representatives from the National Association of Railroad Referees, an association representing railroad arbitrators; the Dunlop II Committee, an informal NMB advisory group; and the National Railroad Adjustment Board, which hears rail grievance arbitration cases. The results of these interviews are not generalizable to all NMB stakeholders. Finally, we interviewed officials at the Office of Management and Budget and the Office of Personnel Management to determine how these agencies provide oversight and guidance to NMB.

In addition, we reviewed NMB procurement data. Specifically, we reviewed data provided by the Department of the Treasury’s Bureau of the Fiscal Service on NMB’s fiscal year 2014 and 2015 contract actions. We assessed the reliability of data from the Bureau of the Fiscal Service and NMB’s fiscal year 2013 through 2015 financial statement audit reports by interviewing knowledgeable officials and reviewing relevant documents. We determined that these data were sufficiently reliable for our purposes.

We conducted this performance audit from April 2015 to February 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Extent to Which the National Mediation Board (NMB) Is Following Key Practices for Information Security and Privacy

Practice Information Security Practices Periodic risk assessments

Example of NMB’s status NMB has not conducted risk assessments of its new enterprise network and financial management systems.

Partially following NMB developed a policy for managing agency information, documents, and records in May 2013. In addition, it drafted procedures for its new enterprise network that include provisions for access and identity control, configuration management, planning, contingency monitoring, and audits. However, NMB has not developed agency-wide policies and procedures that govern its information security program, including policies and procedures for the oversight of third-party providers.

Partially following NMB has drafted a security plan for its new enterprise network dated May 2014. However, NMB has not developed a security plan for its new financial management systems.

NMB stated its staff was provided security awareness training during 2015. However, NMB did not provide evidence to support that all employees and contractors had received the training.

Partially following NMB conducted an initial review of its new enterprise network in May 2014. NMB stated its new financial management systems were reviewed in September 2014. However, NMB was unable to provide evidence to support the review.

Partially following NMB has not established and documented a remedial action process for its information security control weaknesses. NMB has not formally documented and tracked its preliminary plan of actions for its new enterprise network and has not included required attributes, such as milestones and scheduled completion dates. In addition, NMB has not yet begun formally documenting and tracking any information security control weaknesses which have been identified through other reviews (e.g., GAO).

Partially following NMB has developed a procedure for handling cyber incidents.

However, there are no indicators of date, review and approval. In addition, the procedure does not include required actions, such as mitigating risks associated with incidents before substantial damage is done, and notifying and consulting with the federal information security incident center.

NMB has not established and maintained up-to-date continuity of operations plans and procedures for its information systems. Specifically, its continuity of operations plan has not been updated since June 2011 and does not reflect the current information technology environment.

NMB has designated its Assistant Chief of Staff as its senior agency official for privacy.

Example of NMB’s status NMB does not have policies and procedures for privacy protections.

NMB has not conducted a privacy impact assessment for its financial management systems, which contain personally identifiable information.

NMB did not issue system of records notice for its financial management systems.

Appendix III: Comments from the National Mediation Board

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Cindy Brown Barnes, (202) 512-7215, brownbarnesc@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Clarita Mrena (Assistant Director), Amy Anderson (analyst in charge), Benjamin L. Sponholtz, Shirley Abel, Marie Ahearn, James Rebbe, Shaunyce Wallace, and Candice Wright made significant contributions to this report. In addition, key support was provided by James Bennett, Rachael Chamberlin, Susan Chin, David Chrisinger, Larry Crosland, Karin Fangman, Maria Gaona, Gretta Goodwin, Christopher Jones, Julia Kennon, Jason Kirwan, Kathy Leslie, Benjamin Licht, Steven Lozano, Monica Perez-Nelson, and Walter Vance.