High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others
Released: 2017-02-15T00:00:00

Letter

High-Risk Areas Making Progress

Since our last high-risk update, while progress has varied, many of the 32 high-risk areas on our 2015 list have shown solid progress. One area related to sharing and managing terrorism-related information is now being removed from the list.

Agencies can show progress by addressing our five criteria for removal from the list: leadership commitment, capacity, action plan, monitoring, and demonstrated progress. As shown in table 1, 23 high-risk areas, or two-thirds of all the areas, have met or partially met all five criteria for removal from our High-Risk List; 15 of these areas fully met at least one criterion. Compared with our last assessment, 11 high-risk areas showed progress in one or more of the five criteria. Two areas declined since 2015. These changes are indicated by the up and down arrows in table 1.

High-Risk Areas Showing Progress

Of the 11 high-risk areas showing progress between 2015 and 2017, sufficient progress was made in 1 area—Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland—to be removed from the list. In two other areas, enough progress was made that we removed a segment of the high-risk area—Mitigating Gaps in Weather Satellite Data and Department of Defense (DOD) Supply Chain Management. The other eight areas improved in at least one criterion rating by either moving from “not met” to “partially met” or from “partially met” to “met.”

One High-Risk Designation Removed

We removed the area of Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland from the High-Risk List because the Program Manager for the Information Sharing Environment (ISE) and key departments and agencies have made significant progress to strengthen how intelligence on terrorism, homeland security, and law enforcement, as well as other information (collectively referred to in this section as terrorism-related information), is shared among federal, state, local, tribal, international, and private-sector partners. As a result, the Program Manager and key stakeholders have met all five criteria for addressing our high-risk designation, and we are removing this issue from our High-Risk List. While this progress is commendable, it does not mean the government has eliminated all risk associated with sharing terrorism-related information. It remains imperative that the Program Manager and key departments and agencies continue their efforts to advance and sustain ISE. Continued oversight and attention is also warranted given the issue’s direct relevance to homeland security as well as the constant evolution of terrorist threats and changing technology.

The Program Manager, the individual responsible for planning, overseeing, and managing ISE, along with the key departments and agencies—the Departments of Homeland Security (DHS), Justice (DOJ), State (State), and Defense (DOD), and the Office of the Director of National Intelligence (ODNI)—are critical to implementing and sustaining ISE. Following the terrorist attacks of 2001, Congress and the executive branch took numerous actions aimed explicitly at establishing a range of new measures to strengthen the nation’s ability to identify, detect, and deter terrorism-related activities. For example, ISE was established in accordance with the Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act) to facilitate the sharing of terrorism-related information. Figure 1 depicts the relationship between the various stakeholders and disciplines involved with the sharing and safeguarding of terrorism-related information through ISE.

The Program Manager and key departments and agencies met the leadership commitment and capacity criteria in 2015, and have subsequently sustained efforts in both these areas. For example, the Program Manager clearly articulated a vision for ISE that reflects the government’s terrorism-related information sharing priorities. Key departments and agencies also continued to allocate resources to operations that improve information sharing, including developing better technical capabilities.

The Program Manager and key departments and agencies also developed, generally agreed upon, and executed the 2013 Strategic Implementation Plan (Implementation Plan), which includes the overall strategy and more specific planning steps to achieve ISE. Further, they have demonstrated that various information-sharing initiatives are being used across multiple agencies as well as state, local, and private sector stakeholders. For example, the project manager has developed a comprehensive framework for managing enterprise architecture to help share and integrate terrorism-related information among multiple stakeholders in ISE. Specifically, the Project Interoperability initiative includes technical resources and other guidance that promote greater information system compatibility and performance. Furthermore, the key departments and agencies have applied the concepts of the Project Interoperability Initiative to improve mission operations by better linking different law enforcement databases, and facilitating better geospatial analysis, among other things.

In addition, the Program Manager and key departments and agencies have continued to devise and implement ways to measure the effect of ISE on information sharing to address terrorist and other threats to the homeland. They developed performance metrics for specific information- sharing initiatives (e.g., fusion centers) used by various stakeholders to receive and share information. The Program Manager and key departments and agencies have also documented mission-specific accomplishments (e.g., related to maritime domain awareness) where the Program Manager helped connect previously incompatible information systems. The Program Manager has also partnered with DHS to create an Information Sharing Measure Development Pilot that intends to better measure the effectiveness of information sharing across all levels of ISE.

Further, the Program Manager and key departments and agencies have used the Implementation Plan to track progress, address challenges, and substantially achieve the objectives in the National Strategy for Information Sharing and Safeguarding. The Implementation Plan contains 16 priority objectives, and by the end of fiscal year 2016, 13 of the 16 priority objectives were completed. The Program Manager transferred the remaining three objectives, which were all underway, to other entities with the appropriate technical expertise to continue implementation through fiscal year 2019.

In our 2013 high-risk update, we listed nine action items that were critical for moving ISE forward. In that report, we determined that two of those action items—demonstrating that the leadership structure has the needed authority to leverage participating departments, and updating the vision for ISE—had been completed. In our 2015 update, we determined that the Program Manager and key departments had achieved four of the seven remaining action items—demonstrating that departments are defining incremental costs and funding; continuing to identify technological capabilities and services that can be shared collaboratively; demonstrating that initiatives within individual departments are, or will be, leveraged to benefit all stakeholders; and demonstrating that stakeholders generally agree with the strategy, plans, time frames, responsibilities, and activities for substantially achieving ISE.

For the 2017 update, we determined that the remaining three action items have been completed: establishing an enterprise architecture management capability; demonstrating that the federal government can show, or is more fully developing a set of metrics to measure, the extent to which sharing has improved under ISE; and demonstrating that established milestones and time frames are being used as baselines to track and monitor progress. Achieving all nine action items has, in effect, addressed our high-risk criteria.

While this demonstrates significant and important progress, sharing terrorism-related information remains a constantly evolving work in progress that requires continued effort and attention from the Program Manager, departments, and agencies. Although no longer a high-risk issue, sharing terrorism-related information remains an area with some risk, and continues to be vitally important to homeland security, requiring ongoing oversight as well as continuous improvement to identify and respond to changing threats and technology. Table 2 summarizes the Program Manager’s and key departments’ and agencies’ progress in achieving the action items.

As we have with areas previously removed from the High-Risk List, we will continue to monitor this area, as appropriate, to ensure that the improvements we have noted are sustained. If significant problems again arise, we will consider reapplying the high-risk designation.

Additional Information on Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland is provided on page 653 of this report.

Two High-Risk Areas Narrowed

In the 2 years since our last high-risk update, sufficient progress has been made in two areas—DOD Supply Chain Management and Mitigating Gaps in Weather Satellite Data—that we are narrowing their scope.

DOD manages about 4.9 million secondary inventory items, such as spare parts, with a reported value of approximately $91 billion as of September 2015. Since 1990, DOD’s inventory management has been included on our High-Risk List due to the accumulation of excess inventory and weaknesses in demand forecasting for spare parts. In addition to DOD’s inventory management, the supply chain management high-risk area focuses on materiel distribution and asset visibility within DOD. Based on DOD’s leadership commitment and demonstrated progress to address weaknesses since 2010, we are removing the inventory management component from the supply chain management high-risk area. Specifically, DOD has taken the following actions: Implemented a congressionally-mandated inventory management corrective action plan and institutionalized a performance management framework, including regular performance reviews and standardized metrics. DOD has also developed and begun implementing a follow-on improvement plan.

Reduced the percentage and value of its “on-order excess inventory” (i.e., items already purchased that may be excess due to subsequent changes in requirements) and “on-hand excess inventory” (i.e., items categorized for potential reuse or disposal). DOD’s data show that the proportion of on-order excess inventory to the total amount of on- order inventory decreased from 9.5 percent at the end of fiscal year 2009 to 7 percent at the end of fiscal year 2015, the most recent fiscal year for which data are available. During these years, the value of on- order excess inventory also decreased from $1.3 billion to $701 million. DOD’s data show that the proportion of on-hand excess inventory to the total amount of on-hand inventory dropped from 9.4 percent at the end of fiscal year 2009 to 7.3 percent at the end of fiscal year 2015. The value of on-hand excess inventory also decreased during these years from $8.8 billion to $6.8 billion.

Implemented numerous actions to improve demand forecasting and began tracking department-wide forecasting accuracy metrics in 2013, resulting in forecast accuracy improving from 46.7 percent in fiscal year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for which complete data are available.

Implemented 42 of our recommendations since 2006 and is taking actions to implement an additional 13 recommendations, which are focused generally on reassessing inventory goals, improving collaborative forecasting, and making changes to information technology (IT) systems used to manage inventory.

Additional information on DOD Supply Chain Management is provided on page 248 of this report.

Mitigating Gaps in Weather Satellite Data The United States relies on two complementary types of satellite systems for weather observations and forecasts: (1) polar-orbiting satellites that provide a global perspective every morning and afternoon, and (2) geostationary satellites that maintain a fixed view of the United States. Both types of systems are critical to weather forecasters, climatologists, and the military, who map and monitor changes in weather, climate, the oceans, and the environment. Federal agencies are planning or executing major satellite acquisition programs to replace existing polar and geostationary satellite systems that are nearing or beyond the end of their expected life spans. The Department of Commerce’s National Oceanic and Atmospheric Administration (NOAA) is responsible for the polar satellite program that crosses the equator in the afternoon and for the nation’s geostationary weather satellite program; DOD is responsible for the polar satellite program that crosses the equator in the early morning orbit.

Over the last several years, we have reported on the potential for a gap in satellite data between the time that the current satellites are expected to reach the end of their lifespans, and the time when the next satellites are expected to be in orbit and operational. We added this area to our High- Risk List in 2013. According to NOAA program officials, a satellite data gap would result in less accurate and timely weather forecasts and warnings of extreme events—such as hurricanes, storm surges, and floods. Such degraded forecasts and warnings would endanger lives, property, and our nation’s critical infrastructures. Similarly, according to DOD officials, a gap in space-based weather monitoring capabilities could affect the planning, execution, and sustainment of U.S. military operations around the world. In our prior high-risk updates, we reported on NOAA’s efforts to mitigate the risk of a gap in its polar and geostationary satellite programs.

With strong congressional support and oversight, NOAA has made significant progress in its efforts to mitigate the potential for gaps in weather satellite data on its geostationary weather satellite program. Specifically, the agency demonstrated strong leadership commitment to mitigating potential gaps in geostationary satellite data by revising and improving its gap mitigation/contingency plans. Previously, in December 2014, we reported on shortfalls in the satellite program’s gap mitigation/contingency plans and made recommendations to NOAA to address these shortfalls. For example, we noted that the plan did not sufficiently address strategies for preventing a launch delay, timelines and triggers to prevent a launch delay, and whether any of its mitigation strategies would meet minimum performance levels.

NOAA agreed with these recommendations and released a new version of its geostationary satellite contingency plan in February 2015 that addressed the recommendations, thereby meeting the criterion for having an action plan.

We rated capacity as partially met in our 2015 report due to concerns about NOAA’s ability to complete critical testing activities because it was already conducting testing on a round-the-clock, accelerated schedule. Since then, NOAA adjusted its launch schedule to allow time to complete critical integration and testing activities. In doing so, the agency demonstrated that it met the capacity criterion.

NOAA has also met the criterion for demonstrating progress by mitigating schedule risks and successfully launching the satellite. In September 2013, we reported that the agency had weaknesses in its schedule- management practices on its core ground system and spacecraft. We made recommendations to address those weaknesses, which included sequencing all activities, ensuring there are adequate resources for the activities, and analyzing schedule risks. NOAA agreed with the recommendations and the Geostationary Operational Environmental Satellite-R series (GOES-R) program improved its schedule management practices. By early 2016, the program had improved the links between remaining activities on the spacecraft schedule, included needed schedule logic for a greater number of activities on the ground schedule, and included indications on the ground schedule that the results of a schedule risk analysis were used in calculating its durations. In addition, the program successfully launched the GOES-R satellite in November 2016.

Oversight by Congress has been instrumental in reducing the risk of geostationary weather satellite gaps. For example, Subcommittees of the House Science, Space, and Technology committee held multiple hearings to provide oversight of the satellite acquisition and the risk of gaps in satellite coverage.

As a result, the agency now has a robust constellation of operational and backup satellites in orbit and has made significant progress in addressing the risk of a gap in geostationary data coverage. Accordingly, there is sufficient progress to remove this segment from the high-risk area.

Additional information on Mitigating Gaps in Weather Satellite Data is provided on pages 19 and 430 of this report.

Progress in Other Areas

Below are selected examples of areas where progress has been made.

Strengthening Department of Homeland Security Management Functions. The Department of Homeland Security (DHS) continues to strengthen and integrate its management functions and progressed from partially met to met for the monitoring criterion. Since our 2015 high-risk update, DHS has strengthened its monitoring efforts for financial system modernization programs by entering into a contract for independent verification and validation services to help ensure that the modernization projects meet key requirements. These programs are key to effectively supporting the department’s financial management operations.

Additionally, DHS continued to meet the criteria for leadership commitment and a corrective action plan. DHS’s top leadership has demonstrated exemplary support and a continued focus on addressing the department’s management challenges by, among other things, issuing 10 updated versions of DHS’s initial January 2011 Integrated Strategy for High Risk Management.

The National Defense Authorization Act for Fiscal Year 2017 reinforces this focus with the inclusion of a mandate that the DHS Under Secretary for Management report to us every 6 months to demonstrate measurable, sustainable progress made in implementing DHS’s corrective action plans to address the high-risk area, until we submit written notification of the area’s removal from the High-Risk List to the appropriate congressional committees. Similar provisions were included in the DHS Headquarters Reform and Improvement Act of 2015, the DHS Accountability Act of 2016, and the DHS Reform and Improvement Act. Additional information on this high-risk area is provided on page 354 of this report.

Strategic Human Capital Management. This area progressed from partially met to met on leadership commitment. The Office of Personnel Management (OPM), agencies, and Congress have taken actions to improve efforts to address mission critical skills gaps. Specifically, OPM has demonstrated leadership commitment by publishing revisions to its human capital regulations in December 2016 that require agencies to, among other things, implement human capital policies and programs that address and monitor government- wide and agency-specific skills gaps. This initiative has increased the likelihood that skills gaps with the greatest operational effect will be addressed in future efforts.

At the same time, Congress has provided agencies with authorities and flexibilities to manage the federal workforce and make the federal government a more accountable employer. For example, Congress included a provision in the National Defense Authorization Act for Fiscal Year 2016 to extend the probationary period for newly-hired civilian DOD employees from 1 to 2 years. This action is consistent with our 2015 reporting that better use of probationary periods gives agencies the ability to ensure an employee’s skills are a good fit for all critical areas of a particular job. Additional information on this high-risk area is provided on page 61 of this report.

Transforming the Environmental Protection Agency’s Process for Assessing and Controlling Toxic Chemicals. Overall, this high- risk area progressed from not met to partially met on two criteria— capacity and demonstrated progress—and continued to partially meet the criterion for monitoring due to progress in one program area. The Environmental Protection Agency’s (EPA) ability to effectively implement its mission of protecting public health and the environment is critically dependent on assessing the risks posed by chemicals in a credible and timely manner. EPA assesses these risks under a variety of actions, including the Integrated Risk Information System (IRIS) program and EPA’s Toxic Substances Control Act (TSCA) program. The IRIS program has made some progress on the capacity, monitoring, and demonstrated progress criteria. In terms of IRIS capacity, EPA has partially met this criterion by finalizing a Multi-Year Agenda to better assess how many people and resources should be dedicated to the IRIS program. In terms of IRIS monitoring, EPA has met this criterion in part by using a Chemical Assessment Advisory Committee to review IRIS assessments, among other actions. In terms of IRIS demonstrated progress, EPA has partially met this criterion as of January 2017 by issuing five assessments since fiscal year 2015.

The Frank R. Lautenberg Chemical Safety for the 21st Century Act amended TSCA and was enacted on June 22, 2016. Passing TSCA reform may facilitate EPA’s effort to improve its processes for assessing and controlling toxic chemicals in the years ahead. The new law provides EPA with greater authority and the ability to take actions that could help EPA implement its mission of protecting human health and the environment. EPA officials stated that the agency is better positioned to take action to require chemical companies to report chemical toxicity and exposure data. Officials also stated that the new law gives the agency additional authorities, including the authority to require companies to develop new information relating to a chemical as necessary for prioritization and risk evaluation.

Using both new and previously existing TSCA authorities should enhance the agency’s ability to gather new information as necessary to evaluate hazard and exposure risks. Continued leadership commitment from EPA officials and Congress will be needed to fully implement reforms. Additional work will also be needed to issue a workload analysis to demonstrate capacity, complete a corrective action plan, and demonstrate progress implementing the new legislation. Additional information on this high-risk area is provided on page 417 of this report.

Managing Federal Real Property. The federal government continued to meet the criteria for leadership commitment, now partially meets the criterion for demonstrated progress, and made some progress in each of the other high-risk criteria. The Office of Management and Budget (OMB) issued the National Strategy for the Efficient Use of Real Property (National Strategy) on March 25, 2015, which directs Chief Financial Officer (CFO) Act agencies to take actions to reduce the size of the federal real property portfolio, as we recommended in 2012. In addition, in December 2016, two real property reform bills were enacted that could address the long-standing problem of federal excess and underutilized property. The Federal Assets Sale and Transfer Act of 2016 may help address stakeholder influence by establishing an independent board to identify and recommend five high-value civilian federal buildings for disposal within 180 days after the board members are appointed, as well as develop recommendations to dispose and redevelop federal civilian real properties.

Additionally, the Federal Property Management Reform Act of 2016 codified the Federal Real Property Council (FRPC) for the purpose of ensuring efficient and effective real property management while reducing costs to the federal government. FRPC is required to establish a real property management plan template, which must include performance measures, and strategies and government-wide goals to reduce surplus property or to achieve better utilization of underutilized property. In addition, federal agencies are required to annually provide FRPC a report on all excess and underutilized property, and identify leased space that is not fully used or occupied.

In addressing our 2016 recommendation to improve the reliability of real property data, GSA conducted an in-depth survey that focused on key real property data elements maintained in the Federal Real Property Profile, formed a working group of CFO Act agencies to analyze the survey results and reach consensus on reforms, and issued a memorandum to CFO Act agencies designed to improve the consistency and quality of real property data. The Federal Protective Service, which protects about 9,500 federal facilities, implemented our recommendation aimed at improving physical security by issuing a plan that identifies goals and describes resources that support its risk management approach. In addition, the Interagency Security Committee, a DHS-chaired organization, issued new guidance intended to make the most effective use of physical security resources. Additional information on this high-risk area is provided on page 77 of this report.

Enforcement of Tax Laws. The Internal Revenue Service’s (IRS) continued efforts to enforce tax laws and address identity theft refund fraud (IDT) have resulted in the agency meeting one criterion for removal from the High-Risk List (leadership commitment) and partially meeting the remaining four criteria (capacity, action plan, monitoring, and demonstrating progress). IDT is a persistent and evolving threat that burdens legitimate taxpayers who are victims of the crime. It cost the U.S. Treasury an estimated minimum of $2.2 billion during the 2015 tax year.

Congress and IRS have taken steps to address this challenge. IRS has deployed new tools and increased resources dedicated to identifying and combating IDT refund fraud. In addition, the Consolidated Appropriations Act, 2016, amended the tax code to accelerate Wage and Tax Statement (W-2) filing deadlines to January 31. We had previously reported that the wage information that employers report on Form W-2 was not available to IRS until after it issues most refunds. With earlier access to W-2 wage data, IRS could match such information to taxpayers’ returns and identify discrepancies before issuing billions of dollars of fraudulent IDT refunds. Such matching could also provide potential benefits for other IRS enforcement programs, such as preventing improper payments via the Earned Income Tax Credit. Additional information on this high- risk area is provided on page 500 of this report.

Congressional Action Aided Progress on Government-wide High- Risk Issues

In addition to being instrumental in supporting progress in individual high- risk areas, Congress also has taken actions to enact various statutes that, if implemented effectively, will help foster progress on high-risk issues government-wide. These include the:

Program Management Improvement Accountability Act: Enacted in December 2016, the act seeks to improve program and project management in federal agencies. Among other things, the act requires the Deputy Director of the Office of Management and Budget (OMB) to adopt and oversee implementation of government-wide standards, policies, and guidelines for program and project management in executive agencies. The act also requires the Deputy Director to conduct portfolio reviews to address programs on our High-Risk List. It further creates a Program Management Policy Council to act as an interagency forum for improving practices related to program and project management. The Council is to review programs on the High-Risk List and make recommendations to the Deputy Director or designee. We are to review the effectiveness of key efforts under the act to improve federal program management.

Fraud Reduction and Data Analytics Act of 2015 (FRDA): FRDA, enacted in June 2016, is intended to strengthen federal anti-fraud controls, while also addressing improper payments. FRDA requires OMB to use our Fraud Risk Framework to create guidelines for federal agencies to identify and assess fraud risks, and then design and implement control activities to prevent, detect, and respond to fraud. Agencies, as part of their annual financial reports beginning in fiscal year 2017, are further required to report on their fraud risks and their implementation of fraud reduction strategies, which should help Congress monitor agencies’ progress in addressing and reducing fraud risks. To aid federal agencies in better analyzing fraud risks, FRDA requires OMB to establish a working group tasked with developing a plan for the creation of an interagency library of data analytics and data sets to facilitate the detection of fraud and the recovery of improper payments. This working group and the library should help agencies to coordinate their fraud detection efforts and improve their ability to use data analytics to monitor databases for potential improper payments. The billions of dollars of improper payments are a central part of the Medicare Program, Medicaid Program, and Enforcement of Tax Laws (Earned Income Tax Credit) high-risk areas.

IT Acquisition Reform, Legislation known as the Federal Information Technology Acquisition Reform Act (FITARA): FITARA, enacted in December 2014, was intended to improve how agencies acquire IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. FITARA includes specific requirements related to seven areas: the federal data center consolidation initiative, enhanced transparency and improved risk management, agency Chief Information Officer authority enhancements, portfolio review, expansion of training and use of IT acquisition cadres, government- wide software purchasing, and maximizing the benefit of the federal strategic sourcing initiative. Effective implementation of FITARA is central to making progress in the Improving the Management of IT Acquisitions and Operations government-wide area we added to the High-Risk List in 2015.

High-Risk Areas Highlighted for Significant Attention

In the 2 years since the last high-risk update, two areas—Mitigating Gaps in Weather Satellite Data and Management of Federal Oil and Gas Resources—have expanded in scope because of emerging challenges related to these overall high-risk areas. In addition, while progress is needed across all high-risk areas, particular areas need significant attention.

Expanding High-Risk Area: Mitigating Gaps in DOD Weather Satellite Data

DOD’s Polar-Orbiting Weather Satellites

While NOAA has made significant progress, as described earlier, in its geostationary weather satellite program, DOD has made limited progress in meeting its requirements for the polar satellite program. In 2010, when the Executive Office of the President decided to disband a tri-agency polar weather satellite program, DOD was given responsibility for providing polar-orbiting weather satellite capabilities in the early morning orbit. This information is used to provide updated information for weather observations and models. However, the department was slow to develop plans to replace the existing satellites that provide this coverage. Because DOD delayed establishing plans for its next generation of weather satellites, there is a risk of a satellite data gap in the early morning orbit.

The last satellite that the department launched in 2014 called Defense Meteorological Satellite Program (DMSP)-19, stopped providing recorded data used in weather models in February 2016. A prior satellite, called DMSP-17, is now the primary satellite operating in the early morning orbit. However, this satellite, which was launched in 2006, is operating with limitations due to the age of its instruments. DOD had developed another satellite, called DMSP-20, but plans to launch that satellite were canceled after the department did not certify that it would launch the satellite by the end of calendar year 2016.

The department conducted a requirements review and analysis of alternatives from February 2012 through September 2014 to determine the best way forward for providing needed polar-orbiting satellite environmental capabilities in the early morning orbit. In October 2016, DOD approved plans for its next generation of weather satellites, called the Weather System Follow-on—Microwave program, which will meet the department’s needs for satellite information on oceanic wind speed and direction to protect ships on the ocean’s surface. The department plans to launch a demonstration satellite in 2017 and to launch its first operational satellite developed under this program in 2022. However, DOD’s plans for the early morning orbit are not comprehensive.

The department did not thoroughly assess options for providing its two highest-priority capabilities, cloud descriptions and area-specific weather imagery. These capabilities were not addressed due to an incorrect assumption about the capabilities that would be provided by international partners. The Weather System Follow-on—Microwave program does not address these two highest-priority capabilities and the department has not yet determined its long-term plans for providing these capabilities. As a result, the department will need to continue to rely on the older DMSP-17 satellite until its new satellite becomes operational in 2022, and it establishes and implements plans to address the high-priority capabilities that the new satellite will not address. Given the age of the DMSP-17 satellite and uncertainty on how much longer it will last, the department could face a gap in critical satellite data.

In August 2016, DOD reported to Congress its near-term plans to address potential satellite data gaps. These plans include a greater reliance on international partner capabilities, exploring options to move a geostationary satellite over an affected region, and plans to explore options for acquiring and fielding new equipment, such as satellites and satellite components to provide the capabilities. In addition, the department anticipates that the demonstration satellite to be developed as a precursor to the Weather System Follow-on—Microwave program could help mitigate a potential gap by providing some useable data. However, these proposed solutions may not be available in time or be comprehensive enough to avoid near-term coverage gaps. Such a gap could negatively affect military operations that depend on weather data, such as long-range strike capabilities and aerial refueling.

DOD needs to demonstrate progress on its new Weather Satellite Follow- on—Microwave program, and to establish and implement plans to address the high-priority capabilities that are not included in the program. Additional information on Mitigating Gaps in Weather Satellite Data is provided on page 430 of this report.

Expanding High-Risk Area: Management of Federal Oil and Gas Resources

Restructuring of Offshore Oil and Gas Oversight

On April 20, 2010, the Deepwater Horizon drilling rig exploded in the Gulf of Mexico, resulting in 11 deaths, serious injuries, and the largest marine oil spill in U.S. history. In response, in May 2010, the Department of the Interior (Interior) first reorganized its offshore oil and gas management activities into separate offices for revenue collection, under the Office of Natural Resources Revenue, and energy development and regulatory oversight, under the Bureau of Ocean Energy Management, Regulation and Enforcement. Later, in October 2011, Interior further reorganized its energy development and regulatory oversight activities when it established two new bureaus to oversee offshore resources and operational compliance with environmental and safety requirements. The new Bureau of Ocean Energy Management (BOEM) is responsible for leasing and approving offshore development plans while the new Bureau of Safety and Environmental Enforcement (BSEE) is responsible for lease operations, safety, and enforcement.

In 2011, we added Interior’s management of federal oil and gas resources to the High-Risk List based on three concerns: (1) Interior did not have reasonable assurance that it was collecting its share of billions of dollars of revenue from federal oil and gas resources; (2) Interior continued to experience problems hiring, training, and retaining sufficient staff to oversee and manage federal oil and gas resources; and (3) Interior was engaged in restructuring its oil and gas program, which is inherently challenging, and there were questions about whether Interior had the capacity to reorganize while carrying out its range of responsibilities, especially in a constrained resource environment.

Immediately after reorganizing, Interior developed memorandums and standard operating procedures to define roles and responsibilities, and facilitate and formalize coordination between BOEM and BSEE. Interior also revised polices intended to improve its oversight of offshore oil and gas activities, such as new requirements designed to mitigate the risk of a subsea well blowout or spill. In 2013, we determined that progress had been made, because Interior had fundamentally completed reorganizing its oversight of offshore oil and gas activities. As a result, in 2013, we removed the reorganization segment from this high-risk area.

However, in February 2016, we reported that BSEE had undertaken various reform efforts since its creation in 2011, but had not fully addressed deficiencies in its investigative, environmental compliance, and enforcement capabilities identified by investigations after the Deepwater Horizon incident.

BSEE’s ongoing restructuring has made limited progress enhancing the bureau’s investigative capabilities. BSEE continues to use pre– Deepwater Horizon incident policies and procedures. Specifically, BSEE has not completed a policy outlining investigative responsibilities or updated procedures for investigating incidents—among the goals of BSEE’s restructuring, according to restructuring planning documents, and consistent with federal standards for internal control. The use of outdated investigative policies and procedures is a long-standing deficiency. Post– Deepwater Horizon incident investigations found that Interior’s policies and procedures did not require it to plan investigations, gather and document evidence, and ensure quality control, and determined that continuing to use them posed a risk to the effectiveness of bureau investigations. Without completing and updating its investigative policies and procedures, BSEE continues to face this risk.

BSEE’s ongoing restructuring of its environmental compliance program reverses actions taken to address post–Deepwater Horizon incident concerns, and risks weakening the bureau’s environmental compliance oversight capabilities. In 2011, in response to two post–Deepwater Horizon incident investigations that found that BSEE’s predecessor’s focus on oil and gas development might have been at the expense of protecting the environment, BSEE created an environmental oversight division with region-based staff reporting directly to the headquarters- based division chief instead of regional management. This reporting structure was to help ensure that environmental issues received appropriate weight and consideration within the bureau.

Under the restructuring, since February 2015, field-based environmental compliance staff again report to their regional directors. BSEE’s rationale for this action is unclear, as it was not documented or analyzed as part of the bureau’s restructuring planning. Under federal standards for internal control, management is to assess the risks posed by external and internal sources and decide what actions to take to mitigate them. Without assessing the risk of reversing its reporting structure, Interior cannot be sure that BSEE will have reasonable assurance that environmental issues are receiving the appropriate weight and consideration, as called for by post–Deepwater Horizon incident investigations.

When we reviewed BSEE’s environmental compliance program, we found that the interagency agreements between Interior and EPA designed to coordinate water quality monitoring under the National Pollutant Discharge Elimination System were decades old. According to BSEE annual environmental compliance activity reports, the agreements may not reflect the agency’s current resources and needs. For example, a 1989 agreement stipulates that Interior shall inspect no more than 50 facilities on behalf of EPA per year, and shall not conduct water sampling on behalf of EPA. Almost 30 years later, after numerous changes in drilling practices and technologies, it is unclear whether inspecting no more than 50 facilities per year is sufficient to monitor water quality.

Nevertheless, senior BSEE officials told us that the bureau has no plans to update its agreements with EPA, and some officials said that a previous headquarters-led effort to update the agreements was not completed because it did not sufficiently describe the bureau’s offshore oil and gas responsibilities. According to Standards for Internal Control in the Federal Government, as programs change and agencies strive to improve operational processes and adopt new technologies, management officials must continually assess and evaluate internal controls to ensure that control activities are effective and updated when necessary.

BSEE’s ongoing restructuring has made limited progress in enhancing its enforcement capabilities. In particular, BSEE has not developed procedures with criteria to guide how it uses enforcement tools—such as warnings and fines—which are among the goals of BSEE’s restructuring, according to planning documents, and consistent with federal standards for internal control. BSEE restructuring plans state that the current lack of criteria causes BSEE to act inconsistently, which makes oil and gas industry operators uncertain about BSEE’s oversight approach and expectations. The absence of enforcement climate criteria is a long- standing deficiency. For example, post–Deepwater Horizon incident investigations recommended BSEE assess its enforcement tools and how to employ them to deter safety and environmental violations. Without developing procedures with defined criteria for taking enforcement actions, BSEE continues to face risks to the effectiveness of its enforcement capabilities.

To enhance Interior’s oversight of oil and gas development, we recommended in February 2016 that the Secretary of the Interior direct the Director of BSEE to take the following nine actions as it continues to restructure.

To address risks to the effectiveness of BSEE’s investigations, environmental compliance, and enforcement capabilities, we recommended that BSEE complete policies outlining the responsibilities of investigations, environmental compliance, and enforcement programs, and update and develop procedures to guide them.

To enhance its investigative capabilities, we recommended that establish a capability to review investigation policy and collect and analyze incidents to identify trends in safety and environmental hazards; develop a plan with milestones for implementing the case management system for investigations; clearly communicate the purpose of BSEE’s investigations program to industry operators; and clarify policies and procedures for assigning panel investigation membership and referring cases of suspected criminal wrongdoing to the Inspector General.

To enhance its environmental compliance capabilities, we recommend conduct and document a risk analysis of the regional-based reporting structure of its Environmental Compliance Division, including actions to mitigate any identified risks; coordinate with the Administrator of the Environmental Protection Agency to consider the relevance of existing interagency agreements for monitoring operator compliance with National Pollutant Discharge Elimination System permits on the Outer Continental Shelf and, if necessary, update agreements to reflect current oversight needs; and develop a plan to address documented environmental oversight staffing needs.

To enhance its enforcement capabilities, we recommended that BSEE develop a mechanism to ensure that it reviews the maximum daily civil penalty and adjusts it to reflect changes in the Consumer Price Index within the time frames established by statute.

In its written comments, Interior agreed that additional reforms—such as documented policies and procedures—are needed to address offshore oil and gas oversight deficiencies, but Interior neither agreed nor disagreed with our specific recommendations. Additional information on Management of Federal Oil and Gas Resources is provided on page 136 of this report.

Additional High-Risk Areas Needing Significant Attention

Managing Risks and Improving VA Health Care. Since we added Department of Veterans Affairs (VA) health care to our High-Risk List in 2015, VA has acknowledged the significant scope of the work that lies ahead in each of the five areas of concern we identified: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) information technology (IT) challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities. It is imperative that VA maintain strong leadership support, and as the new administration sets its priorities, VA will need to integrate those priorities with its high-risk related actions.

VA developed an action plan for addressing its high-risk designation, but the plan describes many planned outcomes with overly ambitious deadlines for completion. We are concerned about the lack of root cause analyses for most areas of concern, and the lack of clear metrics and needed resources for achieving stated outcomes. In addition, with the increased use of community care programs, it is imperative that VA’s action plan discuss the role of community care in decisions related to policies, oversight, IT, training, and resource needs.

Finally, to help address its high-risk designation, VA should continue to implement our recommendations, as well as recommendations from others. While VA’s leadership has increased its focus on implementing our recommendations in the last 2 years, additional work is needed. We made 66 VA health care-related recommendations in products issued since the VA health care high- risk designation in February 2015, for a total of 244 recommendations from January 1, 2010, through December 31, 2016. VA has implemented 122 (about 50 percent) of the 244 recommendations, but over 100 recommendations remain open as of December 31, 2016 (with about 25 percent being open for 3 or more years). It is critical that VA implement our recommendations in a timely manner.

Additional information on Managing Risks and Improving VA Health Care is provided on page 627 of this report.

DOD Financial Management. The effects of DOD’s financial management problems extend beyond financial reporting and negatively affect DOD’s ability to manage the department and make sound decisions on mission and operations. In addition, DOD remains one of the few federal entities that cannot demonstrate its ability to accurately account for and reliably report its spending or assets. DOD’s financial management problems continue as one of three major impediments preventing us from expressing an opinion on the consolidated financial statements of the federal government.

Sustained leadership commitment will be critical to DOD’s success in achieving financial accountability, and in providing reliable information for day-to-day management decision making as well as financial audit readiness. DOD needs to assure the sustained involvement of leadership at all levels of the department in addressing financial management reform and business transformation. In addition, further action is needed in the areas of capacity and action planning. Specifically, DOD needs to continue building a workforce with the level of training and experience needed to support and sustain sound financial management; continue to develop and deploy enterprise resource planning systems as a critical component of DOD’s financial improvement and audit readiness strategy, as well as strengthen automated controls or design manual workarounds for the remaining legacy systems to satisfy audit requirements and improve data used for day-to-day decision making; and effectively implement its Financial Improvement and Audit Readiness Plan and related guidance to focus on strengthening processes, controls, and systems to improve the accuracy, reliability, and reporting for its priority areas, including budgetary information and mission-critical assets.

Further, DOD needs to monitor and assess the progress the department is making to remediate its internal control deficiencies. DOD should (1) require the military services to improve their policies and procedures for monitoring their corrective action plans for financial management-related findings and recommendations, and (2) improve its process for monitoring the military services’ audit remediation efforts by preparing a consolidated management summary that provides a comprehensive picture of the status of corrective actions throughout the department. DOD is continuing to work toward undergoing a full financial statement audit by fiscal year 2018; however, it expects to receive disclaimers of opinion on its financial statements for a number of years.

A lack of comprehensive information on the corrective action plans limits the ability of DOD and Congress to evaluate DOD’s progress toward achieving audit readiness, especially given the short amount of time remaining before DOD is required to undergo an audit of the department-wide financial statements for fiscal year 2018. Being able to demonstrate progress in remediating its financial management deficiencies will be useful as the department works toward implementing lasting financial management reform to ensure that it can generate reliable, useful, and timely information for financial reporting as well as for decision making and effective operations. Moreover, stronger financial management would show DOD’s accountability for funds and would help it operate more efficiently.

Additional information on DOD Financial Management is provided on page 280 of this report.

Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Finance. Resolving the role of the federal government in housing finance will require leadership commitment and action by Congress and the administration. The federal government has directly or indirectly supported more than two-thirds of the value of new mortgage originations in the single-family housing market since the beginning of the 2007-2009 financial crisis. Mortgages with federal support include those backed by Fannie Mae and Freddie Mac, two large government-sponsored enterprises (the enterprises). Out of concern that their deteriorating financial condition threatened the stability of financial markets, the Federal Housing Finance Agency (FHFA) placed the enterprises into federal conservatorship in 2008, creating an explicit fiscal exposure for the federal government. As of September 2016, the Department of the Treasury (Treasury) had provided about $187.5 billion in funds as capital support to the enterprises, with an additional $258.1 billion available to the enterprises should they need further assistance. In accordance with the terms of agreements with Treasury, the enterprises had paid dividends to Treasury totaling about $250.5 billion through September 2016.

More than 8 years after entering conservatorship, the enterprises’ futures remain uncertain and billions of federal dollars remain at risk. The enterprises have a reduced capacity to absorb future losses due to a capital reserve amount that falls to $0 by 2018. Without a capital reserve, any quarterly losses—including those due to market fluctuations and not necessarily to economic conditions—would require the enterprises to draw additional funds from Treasury. Additionally, prolonged conservatorships and a change in leadership at FHFA could shift priorities for the conservatorships, which in turn could send mixed messages and create uncertainties for market participants and hinder the development of the broader secondary mortgage market. For this reason, we said in November 2016 that Congress should consider legislation establishing objectives for the future federal role in housing finance, including the structure of the enterprises, and a transition plan to a reformed housing finance system that enables the enterprises to exit conservatorship.

The federal government also supports mortgages through insurance or guarantee programs, the largest of which is administered by the Department of Housing and Urban Development’s Federal Housing Administration (FHA). During the financial crisis, FHA served its traditional role of helping to stabilize the housing market, but also experienced financial difficulties from which it only recently recovered. Maintaining FHA’s long-term financial health and defining its future role also will be critical to any effort to overhaul the housing finance system.

We previously recommended that Congress or FHA specify the economic conditions that FHA’s Mutual Mortgage Insurance Fund would be expected to withstand without requiring supplemental funds. As evidenced by the $1.68 billion FHA received in 2013, the current 2 percent capital requirement for FHA’s fund may not always be adequate to avoid the need for supplemental funds under severe stress scenarios. Implementing our recommendation would be an important step not only in addressing FHA’s long-term financial viability, but also in clarifying FHA’s role.

Additional information on Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Finance is provided on page 107 of this report.

Pension Benefit Guaranty Corporation Insurance Programs. The Pension Benefit Guaranty Corporation (PBGC) is responsible for insuring the defined benefit pension plans of nearly 40 million American workers and retirees who participate in nearly 24,000 private sector plans. PBGC faces an uncertain financial future due, in part, to a long-term decline in the number of traditional defined benefit plans and the collective financial risk of the many underfunded pension plans that PBGC insures. PBGC’s financial portfolio is one of the largest of all federal government corporations and, at the end of fiscal year 2016, PBGC’s net accumulated financial deficit was over $79 billion—having more than doubled since fiscal year 2013. PBGC has estimated that, without additional funding, its multiemployer insurance program will likely be exhausted by 2025 as a result of current and projected pension plan insolvencies. The agency’s single- employer insurance program is also at risk due to the continuing decline of traditional defined benefit pension plans, increased financial risk and reduced premium payments.

While Congress and PBGC have taken significant and positive steps to strengthen the agency over recent years, challenges related to PBGC’s funding and governance structure remain. Addressing the significant financial risk and governance challenges that PBGC faces requires additional congressional action. To improve the long-term financial stability of PBGC’s insurance programs, Congress should consider: (1) authorizing a redesign of PBGC’s single employer program premium structure to better align rates with sponsor risk; (2) adopting additional changes to PBGC’s governance structure—in particular, expanding the composition of its board of directors; (3) strengthening funding requirements for plan sponsors as appropriate given national economic conditions; (4) working with PBGC to develop a strategy for funding PBGC claims over the long term, as the defined benefit pension system continues to decline; and (5) enacting additional structural reforms to reinforce and stabilize the multiemployer system that balance the needs and potential sacrifices of contributing employers, participants and the federal government. Absent additional steps to improve PBGC’s finances, the long-term financial stability of the agency remains uncertain and the retirement benefits of millions of American workers and retirees could be at risk of dramatic reductions.

Additional information on Pension Benefit Guaranty Corporation Insurance Programs is provided on page 609 of this report.

Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally Identifiable Information. Federal agencies and our nation’s critical infrastructures—such as energy, transportation systems, communications, and financial services—are dependent on computerized (cyber) information systems and electronic data to carry out operations and to process, maintain, and report essential information. The security of these systems and data is vital to public confidence and the nation’s safety, prosperity, and well-being. However, safeguarding computer systems and data supporting the federal government and the nation’s critical infrastructure is a concern. We first designated information security as a government- wide high-risk area in 1997.

This high-risk area was expanded to include the protection of critical cyber infrastructure in 2003 and protecting the privacy of personally identifiable information (PII) in 2015. Ineffectively protecting cyber assets can facilitate security incidents and cyberattacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety. In addition, the increasing sophistication of hackers and others with malicious intent, and the extent to which both federal agencies and private companies collect sensitive information about individuals, have increased the risk of PII being exposed and compromised.

Over the past several years, we have made about 2,500 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations would help agencies strengthen technical security controls over their computer networks and systems, fully implement aspects of their information security programs, and protect the privacy of PII held on their systems. As of October 2016, about 1,000 of our information security– related recommendations had not been implemented. In addition, the federal government needs, among other things, to improve its abilities to detect, respond to, and mitigate cyber incidents; expand efforts to protect cyber critical infrastructure; and oversee the protection of PII, among other things.

Additional information on Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally Identifiable Information is provided on page 338 of this report.

New High-Risk Areas

For 2017, we are adding three new areas to the High-Risk List.

Improving Federal Management of Programs That Serve Tribes and Their Members

We, along with inspectors general, special commissions, and others, have reported that federal agencies have ineffectively administered Indian education and health care programs, and inefficiently fulfilled their responsibilities for managing the development of Indian energy resources. In particular, we have found numerous challenges facing Interior’s Bureau of Indian Education (BIE) and Bureau of Indian Affairs (BIA) and the Department of Health and Human Services’ (HHS) Indian Health Service (IHS) in administering education and health care services, which put the health and safety of American Indians served by these programs at risk. These challenges included poor conditions at BIE school facilities that endangered students, and inadequate oversight of health care that hindered IHS’s ability to ensure quality care to Indian communities. In addition, we have reported that BIA mismanages Indian energy resources held in trust and thereby limits opportunities for tribes and their members to use those resources to create economic benefits and improve the well-being of their communities.

Congress recently noted, “through treaties, statutes, and historical relations with Indian tribes, the United States has undertaken a unique trust responsibility to protect and support Indian tribes and Indians.” In light of this unique trust responsibility and concerns about the federal government ineffectively administering Indian education and health care programs and mismanaging Indian energy resources, we are adding these programs as a high-risk issue because they uniquely affect tribal nations and their members.

Federal agencies have performed poorly in the following broad areas: (1) oversight of federal activities; (2) collaboration and communication; (3) federal workforce planning; (4) equipment, technology, and infrastructure; and (5) federal agencies’ data. While federal agencies have taken some actions to address the 41 recommendations we made related to Indian programs, there are currently 39 that have yet to be fully resolved.

We plan to continue monitoring federal efforts in these areas. To this end, we have ongoing work focusing on accountability for safe schools and school construction, and tribal control of energy delivery, management, and resource development.

What Needs to Be Done

Education: We have identified weaknesses in how Indian Affairs oversees school safety and construction and in how it monitors the way schools use Interior funds. We have also found limited workforce planning in several key areas related to BIE schools. Moreover, aging BIE school facilities and equipment contribute to degraded and unsafe conditions for students and staff. Finally, a lack of internal controls and other weaknesses hinder Indian Affairs’ ability to collect complete and accurate information on the physical conditions of BIE schools.

In the past 3 years, we issued three reports on challenges with Indian Affairs’ management of BIE schools in which we made 13 recommendations. Eleven recommendations below remain open.

To help ensure that BIE schools provide safe and healthy facilities for students and staff, we made four recommendations which remain open, including that Indian Affairs ensure the inspection information it collects on BIE schools is complete and accurate; develop a plan to build schools’ capacity to promptly address safety and health deficiencies; and consistently monitor whether BIE schools have established required safety committees.

To help ensure that BIE conducts more effective oversight of school spending, we made four recommendations which remain open, including that Indian Affairs develop a workforce plan to ensure that BIE has the staff to effectively oversee school spending; put in place written procedures and a risk-based approach to guide BIE in overseeing school spending; and improve information sharing to support the oversight of BIE school spending.

To help ensure that Indian Affairs improves how it manages Indian education, we made five recommendations. Three recommendations remain open, including that Indian Affairs develop a strategic plan for BIE that includes goals and performance measures for how its offices are fulfilling their responsibilities to provide BIE with support; revise Indian Affairs’ strategic workforce plan to ensure that BIA regional offices have an appropriate number of staff with the right skills to support BIE schools in their regions; and develop and implement decision-making procedures for BIE to improve accountability for BIE schools.

Health Care: IHS provides inadequate oversight of health care, both of its federally operated facilities and through the Purchase Referred Care program (PRC). Other issues include ineffective collaboration— specifically, IHS does not require its area offices to inform IHS headquarters if they distribute funds to local PRC programs using different criteria than the PRC allocation formula suggested by headquarters. As a result, IHS may be unaware of additional funding variation across areas. We have also reported that IHS officials told us that an insufficient workforce was the biggest impediment to ensuring patients could access timely primary care.

In the past 6 years, we have made 12 recommendations related to Indian health care that remain open. Although IHS has taken several actions in response to our recommendations, such as improving the data collected for the PRC program and adopting Medicare-like rates for nonhospital services, much more needs to be done.

To help ensure that Indian people receive quality health care, the Secretary of HHS should direct the Director of IHS to take the following two actions: (1) as part of implementing IHS’s quality framework, ensure that agency-wide standards for the quality of care provided in its federally operated facilities are developed, and systematically monitor facility performance in meeting these standards over time; and (2) develop contingency and succession plans for replacing key personnel, including area directors.

To help ensure that timely primary care is available and accessible to Indians, IHS should: (1) develop and communicate specific agency- wide standards for wait times in federally-operated facilities, and (2) monitor patient wait times in federally-operated facilities and ensure that corrective actions are taken when standards are not met.

To help ensure that IHS has meaningful information on the timeliness with which it issues purchase orders authorizing payment under the PRC program, and to improve the timeliness of payments to providers, we recommended that IHS: (1) modify IHS’s claims payment system to separately track IHS referrals and self-referrals, revise Government Performance and Results Act measures for the PRC program so that it distinguishes between these two types of referrals, and establish separate time frame targets for these referral types; and (2) better align PRC staffing levels and workloads by revising its current practices, where available, used to pay for PRC program staff. In addition, as HHS and IHS monitor the effect that new coverage options available to IHS beneficiaries through PPACA have on PRC funds, we recommend that IHS concurrently develop potential options to streamline requirements for program eligibility.

To help ensure successful outreach efforts regarding PPACA coverage expansions, we recommended that IHS realign current resources and personnel to increase capacity to deal with enrollment in Medicaid and the exchanges, and prepare for increased billing to these payers.

If payments for physician and other nonhospital services are capped, we recommended that IHS monitor patient access to these services.

To help ensure a more equitable allocation of funds per capita across areas, we recommended that Congress consider requiring IHS to develop and use a new method for allocating PRC funds.

To develop more accurate data for estimating the funds needed for the PRC program and improve IHS oversight, we recommended that IHS develop a written policy documenting how it evaluates the need for the PRC program, and disseminate it to area offices so they understand how unfunded services data are used to estimate overall program needs. We also recommended that IHS develop written guidance for PRC programs outlining a process to use when funds are depleted but recipients continue to need services.

Energy: We have reported on issues with BIA oversight of federal activities, such as the length of time it takes to review energy-related documents. We also reported on challenges with collaboration—in particular, while working to form an Indian Energy Service Center, BIA did not coordinate with key regulatory agencies, including the Department of the Interior’s Fish and Wildlife Service, the U.S. Army Corps of Engineers, and the Environmental Protection Agency. In addition, we found workforce planning issues at BIA contribute to management shortcomings that have hindered Indian energy development. Lastly, we found issues with outdated and deteriorating equipment, technology, and infrastructure, as well as incomplete and inaccurate data.

In the past 2 years, we issued three reports on developing Indian energy resources in which we made 14 recommendations to BIA. All recommendations remain open.

To help ensure BIA can verify ownership in a timely manner and identify resources available for development, we made two recommendations, including that Interior take steps to improve its geographic information system mapping capabilities.

To help ensure BIA’s review process is efficient and transparent, we made two recommendations, including that Interior take steps to develop a documented process to track review and response times for energy-related documents that must be approved before tribes can develop energy resources.

To help improve clarity of tribal energy resource agreement regulations, we recommended BIA provide additional guidance to tribes on provisions that tribes have identified to Interior as unclear.

To help ensure that BIA streamlines the review and approval process for revenue-sharing agreements, we made three recommendations, including that Interior establish time frames for the review and approval of Indian revenue-sharing agreements for oil and gas, and establish a system for tracking and monitoring the review and approval process to determine whether time frames are met.

To help improve efficiencies in the federal regulatory process, we made four recommendations, including that BIA take steps to coordinate with other regulatory agencies so the Service Center can serve as a single point of contact or lead agency to navigate the regulatory process.

To help ensure that BIA has a workforce with the right skills, appropriately aligned to meet the agency’s goals and tribal priorities, we made two recommendations, including that BIA establish a documented process for assessing BIA’s workforce composition at agency offices.

Congressional Actions Needed: It is critical that Congress maintain its focus on improving the effectiveness with which federal agencies meet their responsibilities to serve tribes and their members. Since 2013, we testified at six hearings to address significant weaknesses we found in the federal management of programs that serve tribes and their members. Sustained congressional attention to these issues will highlight the challenges discussed here and could facilitate federal actions to improve Indian education and health care programs, and the development of Indian energy resources.

See pages 200-219 for additional details on what we found.

U.S. Government’s Environmental Liability

The federal government’s environmental liability has been growing for the past 20 years and is likely to continue to increase. For fiscal year 2016, the federal government’s estimated environmental liability was $447 billion—up from $212 billion for fiscal year 1997. However, this estimate does not reflect all of the future cleanup responsibilities facing federal agencies. Because of the lack of complete information and the often inconsistent approach to making cleanup decisions, federal agencies cannot always address their environmental liabilities in ways that maximize the reduction of health and safety risks to the public and the environment in a cost-effective manner.

The federal government is financially liable for cleaning up areas where federal activities have contaminated the environment. Various federal laws, agreements with states, and court decisions require the federal government to clean up environmental hazards at federal sites and facilities—such as nuclear weapons production facilities and military installations. Such sites are contaminated by many types of waste, much of which is highly hazardous.

Federal accounting standards require agencies responsible for cleaning up contamination to estimate future cleanup and waste disposal costs, and to report such costs in their annual financial statements as environmental liabilities. Per federal accounting standards, federal agencies’ environmental liability estimates are to include probable and reasonably estimable costs of cleanup work. Federal agencies’ environmental liability estimates do not include cost estimates for work for which reasonable estimates cannot currently be generated. Consequently, the ultimate cost of addressing the U.S. government’s environmental cleanup is likely greater than $447 billion. Federal agencies’ approaches to addressing their environmental liabilities and cleaning up the contamination from past activities are often influenced by numerous site-specific factors, stakeholder agreements, and legal provisions.

We have also found that some agencies do not take a holistic, risk- informed approach to environmental cleanup that aligns limited funds with the greatest risks to human health and the environment. Since 1994, we have made at least 28 recommendations related to addressing the federal government’s environmental liability. These include 22 recommendations to the Departments of Energy (DOE) or Defense (DOD), 1 recommendation to OMB to consult with Congress on agencies’ environmental cleanup costs, and 4 recommendations to Congress to change the laws governing cleanup activities. Of these, 13 recommendations remain unimplemented. If implemented, these steps would improve the completeness and reliability of the estimated costs of future cleanup responsibilities, and lead to more risk-based management of the cleanup work.

What Needs to Be Done

Of the federal government’s estimated $447 billion environmental liability, DOE is responsible for by far the largest share of the liability, and DOD is responsible for the second largest share. The rest of the federal government makes up the remaining 3 percent of the liability with agencies such as the National Aeronautics and Space Administration (NASA) and the Departments of Transportation, Veteran’s Affairs, Agriculture (USDA), and Interior holding large liabilities (see figure 2).

Agencies spend billions each year on environmental cleanup efforts but the estimated environmental liability continues to rise. For example, despite billions spent on environmental cleanup, DOE’s environmental liability has roughly doubled from a low of $176 billion in fiscal year 1997 to the fiscal year 2016 estimate of $372 billion. In the last 6 years alone, DOE’s Office of Environmental Management (EM) has spent $35 billion, primarily to treat and dispose of nuclear and hazardous waste, and construct capital asset projects to treat the waste; however, EM’s portion of the environmental liability has grown over this same time period by over $90 billion, from $163 billion to $257 billion (see figure 3).

Progress in addressing the U.S. government’s environmental liabilities depends on how effectively federal departments and agencies set priorities, under increasingly restrictive budgets, that maximize the risk reduction and cost-effectiveness of cleanup approaches. As a first step, some departments and agencies may need to improve the completeness of information about long-term cleanup responsibilities and their associated costs so that decision makers, including Congress, can consider the full scope of the federal government’s cleanup obligations. As a next step, certain departments, such as DOE, may need to change how they establish cleanup priorities. For example, DOE’s current practice of negotiating agreements with individual sites without considering other sites’ agreements or available resources may not ensure that limited resources will be allocated to reducing the greatest environmental risks, and costs will be minimized.

Completeness of Environmental Liability Estimates

In 1994, we recommended that Congress amend certain legislation to require agencies to report annually on progress in implementing plans for completing site inventories, estimates of the total costs to clean up their potential hazardous waste sites, and agencies’ progress toward completing their site inventories and on their latest estimates of total cleanup costs. We believe these recommendations are as relevant, if not more so, today.

In 2015, we recommended that USDA develop plans and procedures for completing its inventories of potentially contaminated sites. USDA disagreed with this recommendation. However, we continue to believe that USDA’s inventory of contaminated and potentially contaminated sites—in particular, abandoned mines, primarily on Forest Service land—is insufficient for effectively managing USDA’s overall cleanup program. Interior is also faced with an incomplete inventory of abandoned mines that it is working to improve.

Reliability of Environmental Liability Estimates

In 2006, we recommended that DOD develop, document, and implement a program for financial management review, assessment, and monitoring of the processes for estimating and reporting environmental liabilities. This recommendation has not been implemented.

Risk-Based Decision Making

We have found in the past that DOE’s cleanup strategy is not risk based and should be re-evaluated. DOE’s decisions are often driven by local stakeholders and certain requirements in federal facilities agreements and consent decrees. In 1995, we recommended that DOE set national priorities for cleaning up its contaminated sites using data gathered during ongoing risk evaluations. This recommendation has not been implemented.

In 2003, we recommended that DOE ask Congress to clarify its authority for designating certain waste with relatively low levels of radioactivity as waste incidental to reprocessing, and therefore not managed as high-level waste. In 2004, DOE received this specific authority from Congress for the Savannah River and Idaho Sites, thereby allowing DOE to save billions of dollars in waste treatment costs. The law, however, excluded the Hanford Site.

More recently, in 2015, we found that DOE is not comprehensively integrating risks posed by National Nuclear Security Administration’s (NNSA) nonoperational contaminated facilities with EM’s portfolio of cleanup work. By not integrating nonoperational facilities from NNSA, EM is not providing Congress with complete information about EM’s current and future cleanup obligations as Congress deliberates annually about appropriating funds for cleanup activities. We recommended that DOE integrate its lists of facilities prioritized for disposition with all NNSA facilities that meet EM’s transfer requirements, and that EM should include this integrated list as part of the Congressional Budget Justification for DOE. DOE neither agreed nor disagreed with this recommendation.

See pages 232-247 for additional details on what we found.

2020 Decennial Census

One of the most important functions of the U.S. Census Bureau (Bureau) is conducting the decennial census of the U.S. population, which is mandated by the Constitution and provides vital data for the nation. This information is used to apportion the seats of the U.S. House of Representatives; realign the boundaries of the legislative districts of each state; allocate billions of dollars in federal financial assistance; and provide social, demographic, and economic profiles of the nation’s people to guide policy decisions at each level of government. A complete count of the nation’s population is an enormous challenge as the Bureau seeks to control the cost of the census while it implements several new innovations and manages the processes of acquiring and developing new and modified IT systems supporting them. Over the past 3 years, we have made 30 recommendations to help the Bureau design and implement a more cost-effective census for 2020; however, only 6 of them had been fully implemented as of January 2017.

The cost of the census, in terms of cost for counting each housing unit, has been escalating over the last several decennials. The 2010 Census was the costliest U.S. Census in history at about $12.3 billion, and was about 31 percent more costly than the $9.4 billion cost of the 2000 Census (in 2020 dollars). The average cost for counting a housing unit increased from about $16 in 1970 to around $92 in 2010 (in 2020 constant dollars). Meanwhile, the return of census questionnaires by mail (the primary mode of data collection) declined over this period from 78 percent in 1970 to 63 percent in 2010. Declining mail response rates—a key indicator of a cost-effective census—are significant and lead to higher costs. This is because the Bureau sends enumerators to each nonresponding household to obtain census data. As a result, nonresponse follow-up is the Bureau’s largest and most costly field operation. In many ways, the Bureau has had to invest substantially more resources each decade to match the results of prior enumerations.

The Bureau plans to implement several new innovations in its design of the 2020 Census. In response to our recommendations regarding past decennial efforts and other assessments, the Bureau has fundamentally reexamined its approach for conducting the 2020 Census. Its plan for 2020 includes four broad innovation areas that it believes will save it over $5 billion (2020 constant dollars) when compared to what it estimates conducting the census with traditional methods would cost. The Bureau’s innovations include (1) using the Internet as a self-response option, which the Bureau has never done on a large scale before; (2) verifying most addresses using “in-office” procedures and on-screen imagery rather than street-by-street field canvassing; (3) re-engineering data collection methods such as by relying on an automated case management system; and (4) in certain instances, replacing enumerator collection of data with administrative records (information already provided to federal and state governments as they administer other programs). These innovations show promise for a more cost-effective head count. However, they also introduce new risks, in part, because they include new procedures and technology that have not been used extensively in earlier decennials, if at all.

The Bureau is also managing the acquisition and development of new and modified IT systems, which add complexity to the design of the census. To help control census costs, the Bureau plans to significantly change the methods and technology it uses to count the population, such as offering an option for households to respond to the survey via the Internet or phone, providing mobile devices for field enumerators to collect survey data from households, and automating the management of field operations. This redesign relies on acquiring and developing many new and modified IT systems, which could add complexity to the design.

These cost risks, new innovations, and acquisition and development of IT systems for the 2020 Census, along with other challenges we have identified in recent years, raise serious concerns about the Bureau’s ability to conduct a cost-effective enumeration. Based on these concerns, we have concluded that the 2020 Census is a high-risk area and have added it to the High-Risk List in 2017.

What Needs to Be Done

To help the Bureau mitigate the risks associated with its fundamentally new and complex innovations for the 2020 Census, the commitment of top leadership is needed to ensure the Bureau’s management, culture, and business practices align with a cost-effective enumeration. For example, the Bureau needs to continue strategic workforce planning efforts to ensure it has the skills and competencies needed to support planning and executing the census. It must also rigorously test individual census-taking activities to provide information on their feasibility and performance, their potential for achieving desired results, and the extent to which they are able to function together under full operational conditions.

We have recommended that the Bureau also ensure that its scheduling adheres to leading practices and be able to support a quantitative schedule risk assessment, such as by having all activities associated with the levels of resources and effort needed to complete them. The Bureau has stated that it has begun maturing project schedules to ensure that the logical relationships are in place and plans to conduct a quantitative risk assessment. We will continue to monitor the Bureau’s efforts.

The Bureau must also improve its ability to manage, develop, and secure its IT systems. For example, the Bureau needs to prioritize its IT decisions and determine what information it needs in order to make those decisions. In addition, the Bureau needs to make key IT decisions for the 2020 Census in order to ensure they have enough time to have the production systems in place to support the end-to-end system test. To this end, we recommended the Bureau ensure that the methodologies for answering the Internet response rate and IT infrastructure research questions are determined and documented in time to inform key design decisions. Further, given the numerous and critical dependencies between the Census Enterprise Data Collection and Processing and 2020 Census programs, their parallel implementation tracks, and the 2020 Census’s immovable deadline, we recommended that the Bureau establish a comprehensive and integrated list of all interdependent risks facing the two programs, and clearly identify roles and responsibilities for managing this list. The Bureau stated that it plans to take actions to address our recommendations.

It is also critical for the Bureau to have better oversight and control over its cost estimation process and we have recommended that the Bureau ensure its cost estimate is consistent with our leading practices. For example, the Bureau will need to, among other practices, document all cost-influencing assumptions; describe estimating methodologies used for each cost element; ensure that variances between planned and actual cost are documented, explained, and reviewed; and include a comprehensive sensitivity analysis, so that it can better estimate costs. We also recommended that the Bureau implement and institutionalize processes or methods for ensuring control over how risk and uncertainty are accounted for and communicated within its cost estimation process. The Bureau agreed with our recommendations, and we are currently conducting a follow-up audit of the Bureau’s most recent cost estimate and will determine whether the Bureau has implemented them.

Sustained congressional oversight will be essential as well. In 2015 and 2016, congressional committees held five hearings focusing on the progress of the Bureau’s preparations for the decennial. Going forward, active oversight will be needed to ensure these efforts stay on track, the Bureau has needed resources, and Bureau officials are held accountable for implementing the enumeration as planned.

We will continue monitoring the Bureau’s efforts to conduct a cost- effective enumeration. To this end, we have ongoing work focusing on such topics as the Bureau’s updated lifecycle cost estimate and the readiness of IT systems for the 2018 End-to-End Test.

See pages 219 – 231 for additional details on what we found.

Monitoring Previous High-Risk Areas

After we remove areas from the High-Risk List we continue to monitor them, as appropriate, to determine if the improvements we have noted are sustained and whether new issues emerge. If significant problems again arise, we will consider reapplying the high-risk designation. DOD’s Personnel Security Clearance Program is one former high-risk area that we continue to closely monitor in light of government-wide reform efforts.

Personnel Security Clearances

The Office of the Director of National Intelligence (ODNI) estimates that approximately 4.2 million federal government and contractor employees held or were eligible to hold a security clearance as of October 1, 2015. Personnel security clearances provide personnel with access to classified information, the unauthorized disclosure of which could, in certain circumstances, cause exceptionally grave damage to national security. High profile security incidents, such as the disclosure of classified programs and documents by a National Security Agency contractor and the OPM data breach of 21.5 million records, demonstrate the continued need for high-quality background investigations and adjudications, strong oversight, and a secure IT process, which have been areas of long- standing challenges for the federal government.

In 2005, we designated the DOD personnel security clearance program as a high-risk area because of delays in completing background investigations and adjudications. We continued the high-risk designation in the 2007 and 2009 updates to our High-Risk List because of issues with the quality of investigation and adjudication documentation, and because delays in the timely processing of security clearances continued.

In our 2011 high-risk report, we removed DOD’s personnel security clearance program from the High-Risk List because DOD took actions to develop guidance to improve its adjudication process, develop and implement tools and metrics to assess quality of investigations and adjudications, and improve timeliness for processing clearances. We also noted that DOD continues to be a prominent player in the overall security clearance reform effort, which includes entities within the OMB, OPM, and ODNI that comprise the Performance Accountability Council (PAC) which oversees security clearance reform. The executive branch has also taken steps to monitor its security clearance reform efforts. The GPRA Modernization Act of 2010 requires OMB to report through a website—performance.gov—on long-term cross-agency priority goals, which are outcome-oriented goals covering a limited number of crosscutting policy areas, as well as goals to improve management across the federal government. Among the cross-agency priority goals, the executive branch identified security clearance reform as one of the key areas it is monitoring.

Since removing DOD’s personnel security clearance program from the High-Risk List, the government’s overall reform efforts that began after passage of the Intelligence Reform and Terrorism Prevention Act of 2004 have had mixed progress, and key reform efforts have not yet been implemented. In the aftermath of the June 2013 disclosure of classified documents by a former National Security Agency contractor and the September 2013 shooting at the Washington Navy Yard, OMB issued, in February 2014, the Suitability and Security Processes Review Report to the President, a 120-day review of the government’s processes for granting security clearances, among other things.

The 120-day review resulted in 37 recommendations, 65 percent of which have been implemented as of October 2016, including the issuance of executive branch-wide quality assessment standards for investigations in January 2015. Additionally, the recommendations led to expanding DOD’s ability to continuously evaluate the continued eligibility of cleared personnel. However, other recommendations from the 120-day review have not yet been implemented. For example, the reform effort is still trying to fully implement the revised background investigation standards issued in 2012 and improve data sharing between local, state, and federal entities.

In addition, the 120-day review further found that performance measures for investigative quality are neither standardized nor implemented consistently across the government, and that measuring and ensuring quality continues to be a challenge. The review contained three recommendations to address the development of quality metrics, but the PAC has only partially implemented those recommendations. We previously reported that the executive branch had developed some metrics to assess quality at different phases of the personnel security clearance process; however, those metrics had not been fully developed and implemented.

The development of metrics to assess quality throughout the security clearance process has been a long-standing concern. Since the late 1990s we have emphasized the need to build and monitor quality throughout the personnel security clearance process. In 2009, we again noted that clearly defined quality metrics can improve the security clearance process by enhancing oversight of the time required to process security clearances and the quality of the investigation and adjudicative decisions. We recommended that OMB provide Congress with results of metrics on comprehensive timeliness and the quality of investigations and adjudications. According to ODNI, in October 2016, ODNI began implementation of a Quality Assessment and Reporting Tool to document customer issues with background investigations. The tool will be used to report on the quality of 5 percent of each executive branch agency’s background investigations.

ODNI officials stated that they plan to develop metrics in the future as data are gathered from the tool, but did not identify a completion date for these metrics. Separately, the NDAA for Fiscal Year 2017, among other things, requires DOD to institute a program to collect and maintain data and metrics on the background investigation process, in the context of developing a system for performance of background investigations. The PAC’s effort to fully address the 120-day review and our recommendations on establishing metrics on the quality of investigations as well as DOD’s efforts to address the broader requirements in the NDAA for Fiscal Year 2017 remain open and will need to be a continued focus of the department moving forward in its effort to improve its management of the security clearance process.

Further, in response to the 2015 OPM data breach, the PAC completed a 90-day review which led to an executive order establishing the National Background Investigations Bureau, within OPM, to replace the Federal Investigative Services and transferred responsibility to develop, maintain and secure new IT systems for clearances to DOD. Additionally, the Executive Order made DOD a full principal member of the PAC. The Executive Order also directed the PAC to review authorities, roles, and responsibilities, including submitting recommendations related to revising, as appropriate, executive orders pertaining to security clearances. This effort is ongoing.

In addition to addressing the quality of security clearances and other goals and recommendations outlined in the 120-day and 90-day reviews, and the government’s cross-agency priority goals, the PAC has the added challenge of addressing recent changes that may result from the NDAA for Fiscal Year 2017. Specifically, section 951 of the Act requires the Secretary of Defense to develop an implementation plan for the Defense Security Service to conduct background investigations for certain DOD personnel—presently conducted by OPM—after October 1, 2017. The Secretary of Defense must submit the plan to the congressional defense committees by August 1, 2017. It also requires the Secretary of Defense and Director of OPM to develop a plan by October 1, 2017, to transfer investigative personnel and contracted resources to DOD in proportion to the workload if the plan for DOD to conduct the background investigations were implemented. It is unknown if these potential changes will impact recent clearance reform efforts.

Given the history and inherent challenges of reforming the government- wide security clearance process, coupled with recent amendments to a governing Executive Order and potential changes arising from the NDAA for Fiscal Year 2017, we will continue reviewing critical functions for personnel security clearance reform and monitor the government’s implementation of key reform efforts. We have ongoing work assessing progress being made on the overall security clearance reform effort and in implementing a continuous evaluation process, a key reform effort considered important to improving the timeliness and quality of investigations. We anticipate issuing a report on the status of the government’s continuous evaluation process in the fall of 2017. Additionally, we have previously reported on the importance of securing federal IT systems and anticipate issuing a report in early 2017 that examines IT security at OPM and efforts to secure these types of critical systems. Continued progress in reforming personnel security clearances is essential in helping to ensure a federal workforce entrusted to protect U.S. government information and property, promote a safe and secure work environment, and enhance the U.S. government’s risk management approach.

The high-risk assessment continues to be a top priority and we will maintain our emphasis on identifying high-risk issues across government and on providing insights and sustained attention to help address them, by working collaboratively with Congress, agency leaders, and OMB. As part of this effort, with the new administration and Congress in 2017 we hope to continue to participate in regular meetings with the incoming OMB Deputy Director for Management and with top agency officials to discuss progress in addressing high-risk areas. Such efforts have been critical for the progress that has been made.

This high-risk update is intended to help inform the oversight agenda for the 115th Congress and to guide efforts of the administration and agencies to improve government performance and reduce waste and risks. We are providing this update to the President and Vice President, congressional leadership, other Members of Congress, OMB, and the heads of major departments and agencies.

Appendix I: Background

What Is the History of the High-Risk Program?

In 1990, we began a program to report on government operations that we identified as “high risk.” Since then, generally coinciding with the start of each new Congress, we have reported on the status of progress addressing high-risk areas and have updated the High-Risk List. Our most recent high-risk update was in February 2015. That update identified 32 high-risk areas.

Overall, this program has served to identify and help resolve serious weaknesses in areas that involve substantial resources and provide critical services to the public. Since our program began, the federal government has taken high-risk problems seriously and has made long- needed progress toward correcting them. In a number of cases, progress has been sufficient for us to remove the high-risk designation. A summary of changes to our High-Risk List over the past 27 years is shown in table 3. This 2017 update identifies 34 high-risk areas.

What Are the Criteria for Being Added to the High- Risk List?

To determine which federal government programs and functions should be designated high risk, we use our guidance document, Determining Performance and Accountability Challenges and High Risks. In making this determination, we consider whether the program or function is of national significance or is key to performance and accountability.

Further, we consider qualitative factors, such as whether the risk involves public health or safety, service delivery, national security, national defense, economic growth, or privacy or citizens’ rights, or could result in significantly impaired service, program failure, injury or loss of life, or significantly reduced economy, efficiency, or effectiveness.

We also consider the exposure to loss in monetary or other quantitative terms. At a minimum, $1 billion must be at risk, in areas such as the value of major assets being impaired; revenue sources not being realized; major agency assets being lost, stolen, damaged, wasted, or underutilized; potential for, or evidence of improper payments; and presence of contingencies or potential liabilities.

Before making a high-risk designation, we also consider corrective measures planned or under way to resolve a material control weakness and the status and effectiveness of these actions.

What Are the Criteria for Removal from the High- Risk List?

Our experience has shown that the key elements needed to make progress in high-risk areas are top-level attention by the administration and agency leaders grounded in the five criteria for removal from the High-Risk List, as well as any needed congressional action. The five criteria for removal that we issued in November 2000 are as follows:

Leadership Commitment. Demonstrated strong commitment and top leadership support.

Capacity. Agency has the capacity (i.e., people and resources) to resolve the risk(s).

Action Plan. A corrective action plan exists that defines the root cause, solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended.

Monitoring. A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures.

Demonstrated Progress. Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area.

How Can Agencies Use the Criteria to Make Progress on High-Risk Issues?

The five criteria form a road map for efforts to improve and ultimately address high-risk issues. Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list. Our April 2016 report provided additional information drawn from our 2015 high-risk update on how agencies had made progress addressing high-risk issues. We provided illustrative actions that agencies took that led to progress or removal from our High-Risk List. This information provides additional guidance to agencies whose programs are on the High-Risk List.

Figure 4 shows the five criteria and illustrative actions taken by agencies to address the criteria as cited in that report. Importantly, the actions listed are not “stand alone” efforts taken in isolation from other actions to address high-risk issues. That is, actions taken under one criterion may be important to meeting other criteria as well. For example, top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress—actions which are also vital to monitoring criteria.

How Are High-Risk Areas Rated?

In each of our high-risk updates, for more than a decade, we have assessed progress to address the five criteria for removing a high-risk area from the list. In our 2015 update, we added clarity and specificity to our assessments by rating each high-risk area’s progress on the criteria and used the following definitions:

Met. Actions have been taken that meet the criterion. There are no significant actions that need to be taken to further address this criterion.

Partially Met. Some, but not all, actions necessary to meet the criterion have been taken.

Not Met. Few, if any, actions towards meeting the criterion have been taken.

Figure 5 shows a visual representation of varying degrees of progress in each of the five criteria for a high-risk area. Each point of the star represents one of the five criteria for removal from the High-Risk List and each ring represents one of the three designations: not met, partially met, or met. An unshaded point at the innermost ring means that the criterion has not been met, a partially shaded point at the middle ring means that the criterion has been partially met, and a fully shaded point at the outermost ring means that the criterion has been met.

Further, a plus symbol inside the star indicates the rating for that criteria progressed since our last high-risk update in 2015. Likewise, a minus symbol inside the star indicates the rating for that criteria declined since our last update. At the bottom of the star graphic are summary statements showing the number of criteria that have been met as well as the number that progressed, declined, or both since the 2015 high-risk update.

Some high-risk areas are comprised of segments or subareas that make up the overall high-risk area. For example, the high-risk area Transforming EPA’s Process for Assessing Toxic Chemicals includes two segments—EPA’s Integrated Risk Information System and the Toxic Substances Control Act—to reflect two interrelated parts of the overall high-risk area. Multidimensional high-risk areas such as these have separate ratings for each segment as well as a summary rating of the overall high-risk area that reflects a composite of the ratings received under the segment for each of the five high-risk criteria.

What Is the History of Programs Removed from the High-Risk List?

A summary of areas removed from our High-Risk List over the past 27 years is shown in figure 6.

When Were Areas Added to the High-Risk List?

The areas on our 2017 High-Risk List, and the year each was designated as high risk, are shown in table 4.

Appendix II: Overview for Each High-Risk Area

The following pages provide overviews of the 34 high-risk areas on our updated list. Each overview discusses (1) why the area is high risk, (2) the actions that have been taken and that are under way to address the problem since our last update in 2015, and (3) what remains to be done. Each of these high-risk areas is also described on our High-Risk List website, http://www.gao.gov/highrisk/overview. We also provide additional details on the one area that was removed from the High-Risk List in 2017.

Strategic Human Capital Management

Why Area Is High Risk

Since we last reported on government-wide efforts to address skills gaps, the Office of Personnel Management (OPM), the Chief Human Capital Officers (CHCO) Council, and individual agencies have strengthened their leadership over this area; however, OPM and agencies have only partially met the criteria for removal from the High-Risk List. Mission- critical skills gaps within the federal workforce pose a high risk to the nation. Regardless of whether the shortfalls are in such government-wide occupations as cybersecurity and acquisitions, or in agency-specific occupations such as nurses at the Veterans Health Administration (VHA), skills gaps impede the federal government from cost-effectively serving the public and achieving results. Agencies can have skills gaps for different reasons: they may have an insufficient number of people or their people may not have the appropriate skills or abilities to accomplish mission-critical work. Moreover, current budget and long-term fiscal pressures, the changing nature of federal work, and a potential wave of employee retirements that could produce gaps in leadership and institutional knowledge, threaten to aggravate the problems created by existing skills gaps. Indeed, the government’s capacity to address complex challenges such as disaster response, national and homeland security, and rapidly-evolving technology and privacy security issues requires a skilled federal workforce able to work seamlessly with other agencies, with other levels of government, and across sectors.

We first added strategic human capital management to the High-Risk List in 2001. In our 2015 update, we noted that while OPM and agencies had made strides in developing an infrastructure for identifying and addressing skills gaps, they needed to do additional work to more fully use workforce analytics to identify their gaps, implement specific strategies to address these gaps, and evaluate the results of actions taken so as to demonstrate progress in closing the gaps. Mission critical skills gaps were also a factor in making other areas across government high risk. Of the 34 other high-risk areas covered in this report, 15 areas—such as IT management, acquisitions, and management of oil and gas resources—had skills gaps playing a contributory role.

What GAO Found

Since we last reported on government-wide efforts to address skills gaps, OPM, the CHCO Council, and individual agencies have strengthened their leadership over this area, including establishing a new human capital framework to guide their efforts. In doing so, they have (1) taken important steps to institutionalize efforts to close skills gaps and (2) enhanced the analytical method used to identify skills gaps. However, OPM and agencies have only partially met the criteria for removal from the High-Risk List for developing the capacity to close skills gaps, designing and implementing action plan strategies for closing skills gaps, and monitoring efforts to close existing skills gaps as well as identify emerging ones. Additionally, OPM and agencies have not yet demonstrated sustainable progress in closing skills gaps.

To date, Congress has provided agencies with authorities and flexibilities to manage the federal workforce and make the federal government a more accountable employer. For example, Congress included a provision in the National Defense Authorization Act for Fiscal Year 2016 to extend the probationary period for newly hired civilian Department of Defense (DOD) employees from 1 year to 2 years. As we noted in our 2015 report, better use of probationary periods gives agencies the ability to ensure an employee’s skills are a good fit for all critical areas of a particular job. Dismissing employees who cannot do the work becomes more difficult and time consuming after the probationary period because of the procedural requirements agencies must follow and the greater appeal rights afforded.

Further, oversight hearings held by the House and Senate focusing on federal human capital management challenges have been important for ensuring that OPM and agencies continue to make progress in acquiring, developing, and retaining employees with the skills needed to carry out the government’s vital work.

What Remains to Be Done

OPM and agencies can continue taking actions to address skills gaps with respect to capacity, action plan, monitoring, and demonstrated progress. In particular, we have identified several priority recommendations to OPM, in its role as leader for human capital management in the federal government:

OPM needs to strengthen the approach and methodology for addressing skills gaps by working with agencies to develop targets that are clear, measurable, and outcome-oriented.

OPM needs to establish a schedule specifying when it will modify its EHRI database to collect staffing data, in concert with agency CHCOs, and needs to help bolster agencies’ ability to assess workforce competencies, either by sharing competency surveys, disseminating lessons learned, or by other means.

OPM, in consultation with the CHCO Council, should develop a core set of human capital metrics that agencies can use to monitor progress in closing skills gaps through HRstat reviews, and OPM should ensure that these efforts are coordinated with other agency skills gap initiatives.

Individual agencies must also take steps to address skills gaps identified in our prior work. For example, we recommended that the Department of Veterans Affairs (VA) institute a system-wide evaluation of the initiatives to recruit and retain VHA nurses. Doing so could provide VHA with better data to identify resource needs across its medical centers and ensure that its nursing workforce is keeping pace with the health care needs of veterans. VA agreed with our recommendation and indicated in August 2016 that it had formed a working group that is charged with reporting on observations from data on recruitment and retention effectiveness by October 2017.

Continued congressional attention to improving the government’s human capital policies and procedures will be essential going forward. For example, in our August 2016 report, to help improve the federal hiring process, we recommended that OPM assess the effectiveness of government hiring authorities to determine whether opportunities exist to refine, consolidate, eliminate, or expand them. In cases where legislation would be necessary to implement changes, we recommended that OPM should work with the CHCO Council to develop legislative proposals. OPM concurred with this recommendation and said it would work with the CHCO Council and others to develop proposals as appropriate.

Additional Details on What GAO Found

Leadership Commitment

OPM and agencies have fully met the leadership criterion for removal from the High-Risk List. In December 2016, OPM finalized revisions to its strategic human capital management regulation that include the new Human Capital Framework. This framework is to be used by agencies to plan, implement, evaluate, and improve human capital policies and programs. Additionally, the revised regulation provides that agency human capital policies and programs must monitor and address skills gaps within government-wide and agency-specific mission-critical occupations by using comprehensive data analytic methods and gap closure strategies. The revised regulation also requires that agency leadership participate in a quarterly, data-driven review process known as HRstat, which, as we reported in 2015, could be an important tool in reviewing key performance metrics related to closing skills gaps.

OPM and the CHCO Council also improved the method that agencies use to identify mission-critical occupations with skills gaps, in response to our recommendation. We previously reviewed the CHCO Council’s 2011- 2012 efforts to identify skills gaps. We reported that those efforts lacked a quantitative grounding and the CHCO Council did not use workforce analytics, such as employee attrition rates, until after it had already selected an initial set of occupations based on qualitative methods. In 2015, OPM and the CHCO Council worked with agencies to refine their inventory of government-wide and agency-specific skills gaps. They narrowed the scope for identifying skills gaps by using a quantitative multi-factor model—which included the 2-year retention rate, the quit rate, retirement rate, and average manager satisfaction with applicant quality. Using this model, OPM, the CHCO Council, and agencies identified six government-wide occupational areas with mission-critical skills gaps:

Human Resources Specialist;

The Science, Technology, Engineering, and Mathematics (STEM) functional area.

OPM and the CHCO Council asked individual agencies to use the same process to identify 2 to 3 occupations within their own agency, resulting in 48 unique occupations with agency-specific skills gaps among the 24 Chief Financial Officers Act agencies.

OPM also worked with the Office of Management and Budget (OMB) to issue guidance in November 2016 that outlined three broad objectives and seven practices agencies should use to achieve excellence in hiring. As part of OPM’s People and Culture Cross-Agency Priority goal, this memorandum encouraged agencies to, among other things, use data to inform workforce planning and strategic recruitment—as well as fully leverage relevant hiring authorities—consistent with our prior recommendations.

With these actions, OPM, the CHCO Council, and agencies have built a framework to address skills gaps. It will be important for OPM to sustain this leadership commitment through budgetary challenges and the transition to a new administration so that institutional gains are not lost.

Capacity

OPM and agencies have partially met this criterion. After agencies identified sets of occupations with skills gaps, OPM and the CHCO Council worked with the agencies to establish working groups of occupational leaders and CHCO representatives—known as Federal Agency Skills Teams (FAST). According to OPM, the FASTs are to analyze root causes, develop strategies to address skills gaps through action plans, and monitor progress in closing skills gaps within each occupation. Beginning in January 2017, each FAST for both government- wide and agency-specific skills gaps is to report quarterly to OPM on progress and ensure that action plan strategies and performance metrics are aligned with the root cause analyses performed by the FASTs. These institutional resources can help sustain efforts to address skills gaps going forward.

OPM has made less progress on other aspects of capacity building. For example, OPM has not finalized efforts to centralize collection of agency staffing data that could be used to detect emerging skills gaps. OPM officials have reported that modifying the Enterprise Human Resources Integration (EHRI) database to perform this function may not be feasible. Moreover, OPM officials reported that they were still working with stakeholders to develop a framework to assist agencies in assessing competencies. We reported, in 2015, that agencies vary in the extent to which they assess competencies, and thus some agencies have limited ability to respond to external workforce planning factors, despite the importance of conducting these assessments. Without more rigorous data collection across government on the number and skills of people filling mission-critical occupations, OPM and agencies may be unable to build the predictive capacity to identify and address emerging skills gaps.

Action Plan

OPM and agencies have partially met this criterion. Working with the CHCO Council, OPM designed an action plan template that agency FASTs are to use as a model. In reviewing past efforts to address skills gaps, we found that agencies’ planning documents did not always adhere to best practices for project planning. We found that some plans did not consistently identify the root causes of the skills gaps, assign roles and responsibilities for implementing actions, or develop and use outcome- oriented performance metrics. OPM and the CHCO Council included all of these practices in their most recent template, which asks each agency FAST to identify key actions, responsible parties for those actions, milestones, time frames, and performance metrics for monitoring progress and skills gap risk reduction and closure. Moreover, the template asks FASTs to explain how the actions discussed in the document relate to the root cause of that skills gap. Going forward, OPM and the CHCO Council will need to ensure that agencies and their FASTs use the template appropriately and incorporate the best practices into their action plans.

OPM has yet to show, however, whether agencies are consistently adopting these practices in their action plans. As of the end of 2016, nine agencies had not submitted action plans for closing skills gaps. OPM officials noted that they are still working with agencies on the submission of the outstanding plans.

Monitoring

OPM and agencies have partially met this criterion. Agencies can take a number of actions to meet the monitoring criterion for removal from the High-Risk List, such as (1) holding frequent review meetings to assess status and performance, (2) reporting to senior managers on program progress and potential risks, and (3) tracking progress against goals. As noted, OPM’s revisions to its strategic human capital management regulations will require agency leadership to participate in quarterly, data- driven HRstat review sessions, and beginning in 2017 each FAST is to report quarterly to OPM and show that action plan strategies are aligned with monitored performance metrics. Together, these two actions could help ensure that skills gaps receive the visibility and attention of senior managers—as well as the accountability that comes from presenting quarterly results—that have been applied to other human capital challenges such as improving employee engagement.

However, OPM could do more to assist agencies in developing consistent practices for HRstat and to improve the visibility of skills gaps to managers. In 2015, we recommended that OPM work with the CHCO Council to develop a core set of metrics that agencies should use in HRstat to track common skills gap challenges, while still allowing agencies discretion to include metrics that meet their specific needs. In response to our recommendation, OPM officials stated that they consider HRstat an agency-centric initiative and that, while OPM has no plans to prescribe a core set of skills gap metrics that all agencies must use for HRstat, OPM may recommend metrics for each type of skills gap challenge (e.g., training, recruitment, staffing, or competency assessments) that an agency may encounter. OPM has, however, used its November 2016 guidance to recommend specific metrics to be tracked in HRstat that are tailored to improving hiring practices. We maintain that this practice should be applied to skills gaps in general and that an appropriate core set of metrics would be beneficial because it would (1) help ensure agencies were monitoring skills gaps with a consistent set of robust metrics, (2) provide OPM and Congress greater visibility over government-wide progress in addressing skills gaps, and (3) help OPM and agencies target government-wide actions toward those areas where progress is lagging across agencies.

OPM officials have also said that they have no plans to require agencies to integrate the work of their FASTs with their HRstat reviews. OPM officials again cited deference to agencies on identifying the most appropriate metrics to use for their HRstat reviews. The quarterly reporting mechanism that OPM has instituted with each agency FAST could be an effective monitoring tool going forward; however, requiring agencies to routinely monitor skills gap metrics as part of the mandatory HRstat reviews could increase the visibility and urgency of skills gaps for top agency management.

Demonstrated Progress

OPM and agencies have not met this criterion because at present there are no government-wide targets or goals for closing skills gaps, and agencies are not reporting progress. In our 2015 review we reported that government-wide goals to close skills gaps lacked clarity and measurability. OPM previously had a Cross Agency Priority (CAP) goal to close skills gaps by 50 percent in at least 3 of the government-wide mission-critical occupations by the end of fiscal year 2013. The CAP Goal on skills gaps provided important visibility across the government. Following the expiration of this CAP Goal, the Fiscal Year 2015 Budget included a 4-year CAP Goal on People and Culture that included workforce planning elements related to skills gaps but had no government-wide performance targets for closing skills gaps. Currently there are no government-wide goals regarding skills gaps that have the same visibility that the prior CAP Goal provided. As a result, it is unclear what would be the appropriate yardstick for closing skills gaps across the government.

OPM and agencies also have not reached the stage of reporting progress on strategies to close skills gaps. As part of the multi-year process OPM and the CHCO Council have developed with agency FASTs, OPM expects to see agencies reporting progress according to their performance metrics by September 2017. As noted above, not all agencies have even drafted action plans with performance metrics as of December 2016.

Strengthening agencies’ abilities to identify and close skills gaps is critical because they can affect mission accomplishment across the government. Since our 2015 high-risk report, we have published over two dozen additional reports with findings related to skills gaps. Additionally, as noted above, 15 other sections in this report feature discussions related to skills gaps. Included in the examples below are issues found elsewhere in the 2017 high-risk report.

Information Technology (IT) Workforce. We have underscored IT skills gaps in prior high-risk reports, and elements of the IT workforce– particularly cybersecurity– have been highlighted in OPM’s skills gap efforts since 2011. Challenges remain in this area. In November 2016, we reported that five selected agencies had not consistently applied key workforce planning steps and activities that help to ensure that program staff members have the knowledge and skills critical to successfully acquire IT investments. Moreover, we reported in April 2016 that the Federal Emergency Management Agency (FEMA) had not established time frames for completing its workforce planning activities and lacked an understanding of its regional IT workforce. In particular, FEMA’s 2014 competency assessment only covered part of its IT workforce, and multiple regional offices told us that they faced shortages in IT staff, such as computer and network engineers. Without a better understanding of its current IT workforce, FEMA will be unable to address its workforce planning needs and may not have the skills needed to respond to major disasters. The Department of Homeland Security (DHS) concurred in April 2016 with our recommendation to establish time frames for current and future workforce planning, and we will verify these efforts going forward. See Improving the Management of IT Acquisitions and Operations on page 180 for more information.

Acquisition Management. Agencies have continued to face challenges in hiring sufficient staff and in monitoring the competencies of its workforce in acquisitions, an area we have highlighted in prior high-risk reports. For instance, DHS’s 2016 staffing assessments did not take into account all acquisition-related positions, potentially limiting DHS’s insight into the size and nature of potential staffing shortfalls. DHS announced plans in December 2016 to pilot new staffing assessment guidance to be more inclusive of acquisition positions, but the timing of full implementation is not yet known. Additionally, in December 2015, we found that while DOD has assessed workforce competencies for nearly all of its 13 career acquisition fields, the agency has not established a timeline for reassessing competencies in 10 of those fields to gauge progress addressing previously identified gaps. Officials agreed with our recommendation to work with functional leaders in setting timeframes for completing future career field competency assessments and, according to an October 2016 workforce strategic plan, intend to conduct career field competency assessments at a minimum of every 5 years. Doing so will better allow the agency to track improvements in the capability of a workforce that oversaw $273.5 billion in contracts for goods and services in fiscal year 2015. See Strengthening Department of Homeland Security Management Functions on page 354 and DOD Contract Management on page 483 for more information.

Oil and Gas Management. In 2014, we recommended that The Department of the Interior (Interior) should collect data on hiring times and explore the expanded use of existing authorities to retain key oil and gas oversight positions, such as petroleum engineers, geologists, and geophysicists. In September 2016, we found that Interior continued to face challenges hiring and retaining staff for these positions and has taken steps to address low salaries and lengthy hiring times for certain occupations but has not evaluated the effectiveness of such measures. Moreover, Interior has not evaluated training needs or the effectiveness of existing training and has not promoted collaboration across its bureaus to discuss and address shared hiring and retention challenges. We recommended that Interior take steps to evaluate its training programs and promote cross-bureau hiring collaboration. In response to our recommendations, Interior officials indicated that their Office of Policy, Management, and Budget would monitor cross-bureau collaboration on a range of issues including hiring, retention, and training through ongoing quarterly performance reviews and that Interior’s bureaus would coordinate their training needs. See Management of Federal Oil and Gas Resources on page 136 for more information.

Veterans Health Administration (VHA) Human Resources Personnel. In our December 2016 report on VHA’s human resources (HR) capacity, we recommended that VHA (1) develop its own comprehensive competency assessment tool for HR staff that evaluates knowledge of all three of VHA’s personnel systems and (2) ensure that all VHA HR staff complete it so that VHA may use the data to identify and address competency gaps among medical center HR staff. Without such a tool, VHA will have limited insights into the abilities of its HR staff and be ill-positioned to provide necessary support and training. The Department of Veterans Affairs (VA) agreed with both recommendations and indicated it has realigned its HR training office to ensure that a comprehensive competency assessment tool be developed and implemented. See Managing Risks and Improving VA Health Care on page 627 for more information.

Oversight of Medical Products. As part of our December 2016 report, we found that vacancies at foreign Food and Drug Administration (FDA) offices persist. As of July 2016, 46 percent of foreign offices’ authorized positions, including those covering staff conducting medical product investigations, were vacant, and we found that FDA still faces challenges in recruiting staff to these positions. While FDA has set a goal for reducing this vacancy rate, the performance measure selected to track progress on this goal includes both foreign and domestic staff in FDA’s Office of International Programs. FDA could thus fulfill its overall vacancy goal without lowering vacancies in foreign offices. The Department of Health and Human Services (HHS) agreed with our December 2016 recommendation to establish staffing goals by position type at foreign offices, and FDA indicated that recruiting and hiring have long been challenges at these offices. We will monitor future developments in FDA’s foreign inspection staffing. See Protecting Public Health through Enhanced Oversight of Medical Products on page 400 for more information.

In addition, our work published since the 2015 high-risk report has identified additional skills gaps that will require agencies’ attention because of their operational impact. For example, we reported in October 2015 that the Small Business Administration (SBA) did not have an up-to- date agency-wide competency assessment. Officials said that when SBA centralized its loan processing functions—and thus removed these functions from the agency’s district offices—as part of a 2004 reorganization, district offices had to take on new responsibilities, and certain staff no longer had skills that matched their day-to-day work. For example, employees with financial backgrounds—needed to process loans—were now asked to perform marketing and business development tasks. SBA also noted that the skills gap had been compounded by recent changes in job requirements and new initiatives that required new skill sets for its employees. SBA agreed with our recommendation to complete a workforce plan that includes a competency and skills gap assessment, and in October 2016 SBA indicated it had finalized such an assessment and would be incorporating it into its strategic workforce planning process.

Going forward, agencies will need to continue to monitor these and other existing and newly emerging skills gap challenges. Managing these challenges is especially important because, as we have reported previously, agencies are facing a wave of potential retirements, as figure 7 shows. According to OPM data, government-wide over 34 percent of federal employees on board by the end of fiscal year 2015 will be eligible to retire by 2020. Some agencies, such as the Department of Housing and Urban Development, will have particularly high eligibility levels by 2020.

Various factors can affect when individuals actually retire, and some amount of retirement and other forms of attrition can be beneficial because it creates opportunities to bring fresh skills on board and it allows organizations to restructure themselves to better meet program goals and fiscal realities. But if turnover is not strategically monitored and managed, gaps can develop in an organization’s institutional knowledge and leadership.

GAO Contact

For additional information about this high-risk area, contact Robert Goldenkoff at 202-512-6806 or GoldenkoffR@gao.gov or Yvonne Jones at 202-512-6806 or JonesY@gao.gov.

Related GAO Products

Veterans Health Administration: Management Attention Is Needed to Address Systemic, Long-standing Human Capital Challenges. GAO-17-30. Washington, D.C.: December 23, 2016.

Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but Needs to Assess the Effectiveness and Staffing of Its Foreign Offices. GAO-17-143. Washington, D.C.: December 16, 2016.

IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; Selected Departments Need to Assess Skill Gaps. GAO-17-8. Washington, D.C.: November 30, 2016.

Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring, Retention, and Training but Needs a More Evaluative and Collaborative Approach. GAO-16-742. Washington, D.C.: September 29, 2016.

Aviation Security: TSA Should Ensure Testing Data Are Complete and Fully Used to Improve Screener Training and Operations. GAO-16-704. Washington, D.C.: September 7, 2016.

Federal Hiring: OPM Needs to Improve Management and Oversight of Hiring Authorities. GAO-16-521. Washington, D.C.: August 2, 2016.

Information Technology: FEMA Needs to Address Management Weaknesses to Improve Its Systems. GAO-16-306. Washington, D.C.: April 5, 2016.

Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts and Improve Workforce Capability. GAO-16-80. Washington, D.C.: December 14, 2015.

VA Health Care: Oversight Improvements Needed for Nurse Recruitment and Retention Initiatives. GAO-15-794. Washington, D.C.: October 30, 2015.

Small Business Administration: Leadership Attention Needed to Overcome Management Challenges. GAO-15-347. Washington, D.C.: September 22, 2015.

Federal Workforce: Improved Supervision and Better Use of Probationary Periods Are Needed to Address Substandard Employee Performance. GAO-15-191. Washington, D.C.: February 6, 2015.

Federal Workforce: OPM and Agencies Need to Strengthen Efforts to Identify and Close Mission-Critical Skills Gaps. GAO-15-223. Washington, D.C.: January 30, 2015.

Managing Federal Real Property

Why Area Is High Risk

The federal government’s real estate portfolio is vast and diverse— including approximately 273,000 buildings that are leased or owned in the United States and that cost billions of dollars annually to operate and maintain by civilian and defense agencies. Since federal real property management was placed on the High-Risk List in 2003, the federal government has given high-level attention to this issue, such as issuing the National Strategy for the Efficient Use of Real Property (National Strategy) in 2015, which provides a foundation to further assist agencies in strategically managing their real property inventories. However, federal agencies continue to face long-standing challenges in several areas of real property management, including: (1) disposing of excess and underutilized property effectively, (2) relying too heavily on leasing, (3) collecting reliable real property data to support decision making, and (4) protecting federal facilities. Issues with the reliability of the Federal Real Property Profile (FRPP) data—particularly the utilization variable—make it difficult to quantify the overall number of vacant and underutilized federal buildings.

In September 2016, we reported on some vacant properties in the Washington, D.C., area that illustrate the challenges associated with disposing of or repurposing vacant property. Figure 8 illustrates the following examples:

The Cotton Annex: This building, held by the General Services Administration (GSA), which serves as the federal government’s primary disposal agent, is located just a couple blocks off the National Mall in Washington, D.C., is approximately 118,000 gross square feet and has been vacant since 2007. In 2016, we found that GSA’s recent attempt to exchange the property for construction services failed when GSA was unable to obtain sufficient value from the exchange, making the fate of this unneeded building unclear.

GSA Warehouses: In 2014, we found that some GSA warehouses listed in FRPP as used had been vacant for as long as 10 years. GSA only lists warehouses as unused if they are in the process of being disposed. Interpreting use this way in FRPP caused GSA to list as used some warehouses that had been vacant for years. We made a priority recommendation to GSA, to improve the way GSA manages its warehouses. According to GSA officials, they are in the process of developing a Guide for Strategic Warehouse Planning.

St. Elizabeths: The west campus of St. Elizabeths, a National Historic landmark in Washington, D.C., is made up of 61 buildings on about 182 acres. Many buildings have been vacant for extended periods of time and are in badly deteriorated condition. As we reported in 2014, GSA developed a plan to establish a consolidated headquarters for the Department of Homeland Security (DHS) on the site in 2009. Since then, GSA has completed construction of a new headquarters building for the Coast Guard on the campus, but most of the project has been delayed. The estimated timeline for completing the project has been extended multiple times, from an initial estimated completion date of 2016, to an estimated completion date of 2021 based on a scaled back plan as of 2015.

In addition, the federal government continues to face challenges in protecting federal facilities from potential attacks. For example, DHS’s Federal Protective Service (FPS), responsible for the physical protection of 9,500 federal facilities, continues to work to apply a risk-based approach for assessing facilities and ensuring that guards are adequately trained. In January 2017, we also reported that GSA is leasing from foreign owners about 3.3 million square feet in 20 buildings that require higher levels of security that could present security risks, such as espionage and unauthorized cyber and physical access.

What GAO Found

The federal government continues to meet the high-risk criterion for demonstrating leadership commitment to improving the management of real property by executing a number of reform efforts since the last high- risk update in 2015. For example, the Office of Management and Budget (OMB) has issued several key guidance documents since 2015. Most notably, OMB introduced the National Strategy in March 2015, and more recently issued a memo on Improving Federal Real Property Data Quality in January 2016. In response to OMB’s memo, GSA issued its Federal Real Property Data Validation and Verification (V&V) Guidance in May 2016. These actions represent key examples of the federal government’s continued commitment to improve its management of real property. The federal government has also continued to make progress toward increasing its capacity, developing an action plan, and monitoring its progress toward improving real property management and has made improvements in the demonstrating progress criterion to move it from a not met to a partially met rating. For example, in June 2016, OMB and GSA continued efforts to implement our March 2016 recommendation to improve FRPP data quality by conducting an in-depth survey of agencies and soliciting information on several data elements that have been known to be unreliable. GSA issued a memo in December 2016 to Chief Financial Officer (CFO) Act agencies that revised the definitions to improve the consistency and quality of several FRPP data elements. GSA also launched the Asset Consolidation Tool, a software application that allows federal agency users to generate geospatial information about assets in close proximity to identify potential candidates for colocation and consolidation. In addition, GSA implemented two priority recommendations since 2015 related to improving data reliability and is taking steps toward developing a 5-year capital plan.

Although progress is evident, these reforms have not fully addressed the underlying challenges to manage real property efficiently. For example, we found that federal agencies have not demonstrated that they have the capacity to reduce their reliance on costly leases, particularly high-value leases where owning properties would be less costly in the long run. GSA has also made strides to improve data reliability, including but not limited to issuing new data validation and verification guidance that requires agencies to investigate anomalies and resolve them. However, GSA will not finish measuring and tracking the progress of its data reliability efforts until late in 2017; agencies submitted their first data under the new approach in December 2016 and address all data irregularities by October 2017.

Related to physical security, we found that the federal government could do more to improve capacity, monitoring, action plans, and demonstrate progress. For example, FPS, GSA, and other agencies could improve the action plan criterion by collaborating and by clearly defining roles and responsibilities to adequately protect federal facilities. Further, FPS has taken some action to demonstrate progress but has yet to fully implement our March 2015 and September 2013 recommendations to improve security screening at federal buildings and guard training, respectively.

In December 2016, Congress enacted two real property reform bills that could address the long-standing problem of federal excess and underutilized property. The Federal Assets Sale and Transfer Act of 2016 may help address stakeholder influence by establishing an independent board to identify and recommend at least five high-value civilian federal buildings for disposal within 180 days after the board members are appointed, as well as develop recommendations to dispose and redevelop federal civilian real properties. Additionally, the Federal Property Management Reform Act of 2016 codified the Federal Real Property Council (FRPC) for the purpose of ensuring efficient and effective real property management while reducing costs to the federal government. The FRPC is required to establish a real property management plan template, which must include performance measures, and strategies and government-wide goals to reduce surplus property or to achieve better utilization of underutilized property. In addition, federal agencies are required to annually provide FRPC a report on all excess and underutilized property and identify leased space that is not fully used or occupied.

What Remains to Be Done

While the federal government has made progress on different aspects of managing federal real property, additional work is needed. In order to further improve the management of real property, OMB and GSA should implement our open recommendations to build upon the National Strategy and improve data reliability. Improving data reliability was also included as a priority recommendation in our August 2016 letter to the GSA Administrator. While the National Strategy mentions some underlying causes of the challenges that federal agencies face in managing their portfolios, it does not expound on the extent to which these challenges impede agencies’ ability to dispose of, better utilize, or repair their real property and offers discussion on how agencies can overcome these challenges by addressing the underlying causes, such as legal and budgetary limitations and competing stakeholder interests.

OMB also could increase the usefulness of the National Strategy by discussing alternative funding mechanisms, such as retaining fees and enhanced-use leasing. Further, despite OMB’s efforts to focus agencies’ attention on measuring progress through the Reduce the Footprint policy, the government’s efforts to monitor progress remain limited without reliable real property data in the FRPP. In June 2016, OMB and GSA officials noted that they continue to implement our March 2016 recommendation to analyze the differences in how agencies collected and reported data by conducting a survey of agencies that contribute FRPP data on several key indicators such as status, utilization, and replacement value. GSA plans to convene an inter-agency working group in early 2017 to discuss each of the data elements and devise an action plan to address the findings of the survey.

To further build capacity and develop action plans for reducing the federal government’s overreliance on costly leasing, GSA should implement our priority recommendation from 2013 to develop a strategy for the federal government to own rather than lease prioritized high-value properties such as agency headquarters buildings. While GSA has taken some steps to increase its capacity to make its existing leasing program less costly by increasing competition, further action is required to decrease leasing costs by reducing unneeded fees, which is one of our priority recommendations.

Finally, FPS, GSA, and other agencies can take additional measures to increase capacity, develop action plans, and monitor as well as demonstrate progress in securing federal facilities and courthouses. For example, FPS can take additional action to address our March 2016 recommendation to improve human capital planning by developing performance measures with targets that are aligned to FPS goals. FPS and the Department of Justice’s (DOJ) U.S. Marshals Service (USMS) can continue work they have under way to implement our March 2015 recommendation to improve their security screening at federal buildings and courthouses. Further, FPS should implement our September 2013 recommendation to ensure that all guards have received screening and active-shooter training. Finally, the Administrator of GSA and the Secretary of Homeland Security should work jointly to implement our other open priority recommendation to improve the management of the Department of Homeland Security headquarters consolidation project.

Additional Details on What GAO Found

Excess and Underutilized Property

Leadership Commitment

OMB continues to meet this criterion by demonstrating leadership commitment to reducing the amount of excess and underutilized federal real property. In March 2015, OMB implemented our recommendation by issuing government-wide guidance—the National Strategy—which identifies actions to reduce the size of the federal real property portfolio by prioritizing consolidation, colocation, and disposal actions. The strategy provides a foundation to further assist agencies strategically manage their real property. In conjunction with the National Strategy, OMB also issued the Reduce the Footprint policy, which requires all CFO Act agencies to implement a 5-year, rolling planning process that sets annual square-feet reduction targets to reduce their real property portfolios and to adopt space design standards to optimize domestic office space use.

Capacity

OMB and federal real property-holding agencies continue to partially meet the criterion for having the capacity to address the risks associated with managing excess and underutilized property. For example, GSA introduced the Asset Consolidation Tool in June 2016. It allows users to identify potential candidates for colocation and consolidation by generating geospatial information about assets in close proximity. In addition, GSA also introduced the Real Property Management Tool that uses multiple sources to help agencies identify opportunities for property consolidations, collocations, and disposals. While progress is evident, we have previously identified additional ways the federal government can strengthen its capacity to reduce excess and underutilized property. In 2016, we reported that the National Strategy mentions some of the causes underlying the challenges federal agencies face in managing their portfolios—such as limited funding—but it neither addresses the extent to which challenges impede agencies’ abilities to dispose of, better use, or repair their real property, nor does it offer guidance on how agencies can overcome these challenges by addressing the underlying causes.

Furthermore, the strategy does not discuss alternative-funding mechanisms that we have previously identified to help manage budgetary constraints, such as retaining fees in real property and exploring enhanced use lease authority. OMB staff told us that their efforts are focused on identifying policy options within the current statutory framework to reduce excess and underutilized property while seeking legislative options to address the underlying challenges. We recommended that OMB expand the National Strategy to more clearly articulate planned actions and identify alternative approaches to address underlying causes of real property problems. In June 2016, OMB staff told us that they plan to expand the National Strategy since it is not a one-time policy but a living document that they plan to use to address long- standing challenges. As of December 2016, OMB had not made any changes to the National Strategy.

Action Plan

OMB showed improvement and met the criterion of establishing an action plan for reducing excess and underutilized property. Under the Reduce the Footprint policy, OMB has, for the first time, established a government-wide action plan to use property as efficiently as possible and to reduce agency portfolios through annual reduction targets. For example, the Reduce the Footprint policy requires agencies to develop and submit annual Real Property Efficiency Plans, which describe the agency’s overall strategic and tactical approach in managing its real property, including measures to dispose of unneeded properties, improve efficiency, and save money. The policy also requires agencies to adopt space design standards to optimize how they use domestic office space and to set annual square foot reduction targets for their portfolio of office and warehouse space.

Monitoring

OMB and federal real property-holding agencies continue to partially meet the criterion for monitoring progress toward reducing excess and underutilized real property. To implement the National Strategy, the Reduce the Footprint policy requires agencies to set annual reduction targets to measure agency performance. When agencies combine these reduction targets with the fiscal year 2014 benchmarking metrics developed under the President’s Management Agenda, the government has a 3-year set of performance measures to drive portfolio-wide efficiency improvements and property disposals. Despite multiple efforts outlined above, the government’s efforts remain limited without reliable real property data in the FRPP, which is necessary to effectively measure reductions in excess and underutilized property. For example, in our March 2016 report, we found that agencies tailored how they collect and report data to meet their mission needs and portfolio requirements, thus limiting OMB’s and GSA’s insight into the quality of the FRPP data and the extent to which agencies are following sound and comparable collection and reporting practices.

For example, our review found that some of the agencies estimated, rather than determined, actual operating costs for each building, as these agencies do not maintain data on costs for specific buildings. As a result, standardizing data has been challenging since agencies have applied different approaches to collecting data that align closely with their mission but that in some cases are inconsistent with existing GSA guidance. In December 2016, GSA issued a memo to senior real property officers of the FRPC that revised the definitions to improve the consistency and quality of several FRPP data elements including replacement value, annual maintenance costs, and annual operating costs. Although a step in the right direction, agencies are not required to implement these revised definitions until the December 2018 FRPP reporting cycle.

Demonstrated Progress

Since the last high-risk update, OMB and GSA have demonstrated some progress and partially met this criterion by taking a number of steps to reduce excess and underutilized properties. GSA implemented a new asset management tool, the Federal Real Property Profile Management System (FRPP MS), which helps agencies identify opportunities to consider new space and improves transparency by enabling agencies to access each other’s data. GSA officials said that the new platform will include capabilities to help identify underutilized properties and potential candidates for colocations and consolidations and address long-standing management challenges, while OMB staff noted that the new platform has the potential to improve real property data management. Further, OMB reported, in September 2016, that in fiscal years 2014 and 2015 the federal government disposed of over 12,000 buildings with 71.8 million square feet of space, saving $64 million in annual operation and maintenance costs. While progress is apparent, we testified in September 2016 that a lack of reliable data makes it difficult to accurately measure the amount of excess property and has undermined efforts to effectively reform real property management and judge progress. In two assessments of the federal government’s reported results of real property reforms, we identified problems with data reliability. While OMB and GSA have taken steps to address some of these data reliability issues such as revising FRPP definitions to improve data quality and consistency, more time is needed to determine the effectiveness of these measures and to demonstrate that the federal government’s real property data are reliable.

Costly Leasing

Leadership Commitment

OMB and GSA continue to meet this criterion and demonstrate leadership commitment in addressing its overreliance on leasing privately owned space in situations where owning buildings would be more cost efficient in the long run. As previously stated, OMB implemented our recommendation in March 2015 to issue a National Strategy, which requires agencies to identify opportunities to consolidate within their leased assets and to improve space utilization, steps that would reduce leasing. In addition, GSA could also save money by reducing the costs of the leases that remain. For example, GSA has implemented a number of measures, including leasing reform, and, at a June 2015 hearing, a top GSA manager stated that the agency’s ongoing lease reform efforts include plans to reduce costs by increasing competition for its leases.

Capacity

GSA still does not meet this criterion as it has not demonstrated that it has the capacity to reduce its reliance on costly leases, particularly high- value leases that represent a disproportionately large amount of the rent GSA pays. Although GSA has taken some actions to reduce the size of its leases, it has not addressed its overall reliance on high-value leases (defined as $2.85 million and over per year in rent) in situations where ownership would be less expensive in the long run. In particular, GSA has not implemented our 2013 recommendation to develop a strategy to increase ownership investments for a prioritized list of high-value leases where it would be less expensive in the long run to own. GSA has taken some steps to increase its capacity to reduce the cost of its existing leasing program by increasing competition for GSA leases but has not implemented our other recommendation to decrease leasing costs by reducing interest fees. For example, we found that GSA could potentially help tenant agencies save millions of dollars for some leases by loaning them the funds needed to improve newly leased spaces—that is, to make tenant improvements—instead of having the tenants finance these costs with private-sector owners at private-sector interest rates as high as 9 percent over the term of the lease.

Action Plan

GSA showed improvement and partially met the action plan criterion by taking some steps to rank and prioritize long-term ownership solutions for current high-value leases. For example, GSA developed and provided us a list of criteria to rank and prioritize the space needs that are currently being met in high-value leases to determine which of those leases would benefit most from converting to a federally owned solution. GSA has also implemented a new software program for its 5-year capital-planning process that considers avoiding lease costs, among many other criteria, in prioritizing projects for approval. According to GSA officials, several of the projects approved in the capital plan covering fiscal years 2015-2019 would reduce lease costs by moving tenants out of leases into federally owned property. These efforts are producing incremental progress, but GSA has not implemented our recommendation to create a long-term, cross-agency strategy for considering targeted investments in ownership.

In addition, we reported, in January 2016, that while GSA has taken steps to reform leasing and reduce leasing costs, certain factors—such as a tenant agency’s need for space in restricted geographic areas and specialized building requirements—may drive down competition and result in agencies obtaining leasing rates that are higher than local market rates. Developing additional plans to reduce barriers to competition, where possible, and identifying sources of capital to allow tenants to fund tenant improvements could decrease leasing costs and lead to millions in cost savings for some leases.

Monitoring

OMB and GSA have shown improvement and partially met the criterion for monitoring progress toward reducing its overreliance on leasing privately owned space. By issuing the National Strategy, OMB instituted key property management reform by requiring agencies to measure the costs and utilization of individual real property assets to support more efficient use of federal space, which would include reducing the amount of space leased. However, GSA has not implemented our recommendation to set a long-term, cross-agency strategy for investing in ownership, which would improve the ability to monitor and track progress by defining success. As previously mentioned, adopting criteria to rank and prioritize potential long-term ownership alternatives to current high-value leases could help develop goals and a strategy to consider targeted investments in ownership specifically related to these costly leases. With regard to the costs of leasing, GSA is making progress by monitoring the extent to which its leases are competitive and signed at rates below the private sector. However, GSA should also implement our 2016 recommendations to reduce the costs to tenants by exploring strategies to enhance competition for GSA leases and reducing unneeded fees.

Demonstrated Progress

OMB and GSA have demonstrated some progress since 2015 and partially met this criterion. OMB required agencies to reduce their overall footprint through the Reduce the Footprint policy and the National Strategy. Even though the National Strategy does not directly address the issue of leasing, it requires agencies to adopt space design standards to optimize how they use federal domestic office space, a step that would likely include reducing leased space by using space more efficiently and consolidating leases onto federally owned property. According to GSA data, the amount of space that GSA leases has fallen for 3 straight years, but only by 4 percent since 2013. GSA’s recent progress in reducing its reliance on leasing has been modest. GSA has outlined a number of actions that it has taken to implement our January 2016 recommendation to reduce leasing costs for federal agencies by increasing competition for GSA leases. Specifically, it has established a framework for broadening the delineated geographic areas agencies request—a key driver for competition. GSA officials said in 2016 that the agency has also implemented a performance measure to encourage competition. As a result, GSA said that 81 percent of its leases are competitive. However, these steps to reduce the costs of leases are still too recent to clearly demonstrate progress. Further, fully implementing our recommendation for GSA to develop and use criteria to rank and prioritize potential long- term ownership solutions to create a cross-agency strategy for making those investments is a needed first step in addressing its overreliance on leasing that could then lead to demonstrating progress in saving money in the long term.

Data Reliability

Leadership Commitment

The federal government continued to demonstrate leadership commitment and met this criterion by taking a number of steps to improve data reliability within the FRPP. In addition to the National Strategy, which called for additional data quality improvements that support data-driven decision making, in January 2016, OMB issued a government-wide memo requiring all CFO Act agencies to implement standard data validation and verification checks when submitting their annual FRPP data to GSA beginning in fiscal year 2017. Subsequently, in May 2016, GSA issued its Federal Real Property Data Validation and Verification (V&V) Guidance, which establishes a new mandatory data validation and verification process and requires agencies to investigate data anomalies.

Capacity

OMB and GSA improved the government’s capacity to ensure that reliable data are available to inform real property decision making through a series of reforms to FRPP and now meet this criterion. For example, GSA upgraded FRPP from its legacy system to a new platform with several enhancements and tools. The new FRPP MS is an asset management tool that now supports the new Asset Consolidation Tool, which helps agencies identify opportunities to consider new space and improves transparency by enabling agencies to access each other’s data. GSA has also improved agencies’ capacity to submit accurate data by improving the clarity of variables and helping with data verification.

Action Plan

GSA continues to partially meet this criterion by putting plans in place to continue implementing our recommendations aimed at addressing the reliability of federal real property data. In June 2016, OMB and GSA noted that they continue to implement our recommendation to improve FRPP data quality by conducting an in-depth survey focusing on several data elements including replacement value, status, owned and otherwise managed operating costs, repair needs, utilization, and lease costs. GSA officials told us that they implemented the survey to better understand the methods CFO Act agencies are employing to collect and prepare real property data submitted into the FRPP. Each survey question began with the FRPP definition for a specific data element, followed by a series of questions designed to elicit information about how each agency applies the FRPP reporting requirements. GSA completed its analysis of the survey results, and in December 2016, GSA issued a memorandum to senior real property officers of FRPC based on the survey results designed to improve the consistency and quality of real property data. In addition, GSA plans to convene an inter-agency working group—made up of GSA, OMB, and executive branch agencies that contribute data to the FRPP—in early 2017 to discuss each of the data elements and devise an action plan to address the findings of the survey. The working group will review the survey results in more detail and reach consensus on: (1) changes to the definitions and requirements for these data elements in the FRPP data dictionary; (2) limitations on the use of the data for cross- agency analysis, and (3) best practices and methodologies for reporting these data elements.

Monitoring

The federal government continues to partially meet the criterion for monitoring progress toward improving FRPP data reliability. With OMB issuing its January 2016 memo on improving federal real property data quality and GSA issuing its recent V&V guidance, agencies will be required to adhere to a revised process for resolving data anomalies when they submit data into the FRPP. Specifically, the V&V guidance now includes a new mandate—referred to as anomaly resolution—that requires agencies to investigate whether the underlying data flagged by the anomalies are accurate or inaccurate. GSA’s updated information technology platform, FRPP MS, allows GSA and agencies to analyze the numbers and percentages of anomalies resolved versus total number of assets in a given anomaly category. The system will maintain records of data anomalies for each year that V&V is performed. Moreover, agencies will have year-to-year records of all data tagged as anomalous, as well as the reason for the tag. This has the potential to improve data quality, promote consistency among agencies, and enable OMB and other policymakers to measure how data quality improves over time. Although a step in the right direction, measuring and tracking the progress of these V&V checks will have to wait several years, as agencies submitted data under the new approach in December 2016, and will be required to address all data irregularities by October 2017.

Demonstrated Progress

GSA showed improvement since 2015 and partially met the demonstrating progress criterion by improving the reliability of federal real property data, but challenges still remain. In March 2016, we reported that OMB and GSA took important steps to revise and modify several FRPP data definitions based upon user feedback and internal data evaluations. As previously mentioned, GSA issued its federal real property data validation and verification guidance, requiring agencies to confirm whether data flagged as anomalous are accurate or inaccurate, and has plans in place to address our recommendations through the recent survey it administered. However, until GSA acts on these survey findings and takes concrete steps to address differences in data collection and identify any limitations, the usefulness of FRPP data for decision making will remain unclear. For example, in our March 2016 report, we found that some of the agencies in our review estimated, rather than determined, actual operating costs into FRPP for each building, as these agencies do not maintain data on costs for each specific building. Estimating practices also varied by agency. As a result, it may be difficult for OMB or agencies to accurately determine aggregate cost savings from successfully reducing excess or underutilized property. Finally, it is unlikely that all of the data for 2 dozen variables submitted by agencies each year on over half a million buildings and structures will ever be completely correct and consistent. As a result, GSA should fully implement our 2016 recommendation to assess, analyze, and identify any limitations in how agencies collect and report data to FRPP.

Physical Security

Leadership Commitment

The federal government continued to meet the criterion for demonstrating leadership commitment to improving the physical security of federal facilities. In August 2013, the Interagency Security Committee (ISC), a DHS-chaired organization, showed leadership commitment by issuing a consolidated set of standards for physical security at federal facilities, called The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard. In January 2016, it continued to show leadership commitment by updating the Risk Management Process elements related to current threats, countermeasures to mitigate the threats, and the protection level for federal child care centers. In 2015, FPS, which protects about 9,500 federal facilities in conjunction with GSA, implemented our recommendation by issuing a revised government facilities sector plan that identifies goals and describes resources that support the risk management approach.

Capacity

FPS and GSA continued to partially meet the criterion for having the capacity to address the risks associated with ensuring the safety of our federal facilities. For example, FPS developed a Strategic Human Capital Plan that included strategies tailored to address identified gaps and needs in its workforce and identified actions that build organizational capability to support those strategies. FPS also designed and plans to implement a staffing model—which identifies the federal workforce necessary to meet its mission—consistent with most key practices we identified. However, FPS has not fully developed performance measures to evaluate progress toward goals, which is also a key strategic workforce planning principle. For example, FPS has not identified performance measures for all of the Plan’s strategies, nor has it included performance targets. Additionally, FPS has made consistent progress in its efforts to conduct facility security assessments that are consistent with ISC standards. Specifically, in March 2012, FPS developed the Modified Infrastructure Survey Tool (MIST) to assess the vulnerabilities of federal facilities. In October 2016, FPS officials stated that FPS inspectors are currently using MIST augmented with external threat and consequence data to provide a more complete assessment for federal facilities than can be achieved by using MIST alone. As of October 2016, FPS had also developed a Mission Needs Assessment that outlines how FPS will enhance its ability to assess risks to federal facilities by incorporating threat, vulnerability, and consequence information in a single, integrated, and automated tool. FPS officials said that this new tool could improve FPS’s ability to better protect federal facilities and help minimize agencies’ duplicative risk assessment activities.

Action Plan

FPS has shown improvement since our last high-risk update and partially met this criterion by developing action plans that should improve the physical security of federal facilities. We recommended, in December 2015, that FPS and GSA—two agencies that share responsibility for protecting federal facilities—take actions to improve their collaboration and finalize the two agencies’ memorandum of agreement (MOA) accordingly. As of August 2016, FPS reported that it has taken steps with GSA to resolve differences in agency opinions on security-related authorities for protecting federal real property. FPS also stated that once an agreement or an updated MOA has been established, both agencies would be better positioned to devise a plan with time frames for finalizing a joint strategy. However, progress toward an agreement is slow; the MOA has not been updated since 2006. Further, in September 2011, we recommended that FPS and DOJ work with other agencies to improve collaboration to address a number of courthouse security challenges. USMS and FPS formed a working group in 2015 to assess the costs and benefits of a pilot program that would enhance security. However, as of January 2017, FPS, USMS, the Administrative Office of the U.S. Courts, and GSA were still working to finalize the draft MOA on courthouse security.

Monitoring

The federal government has shown improvement since our last high-risk update and partially met the criterion for monitoring progress in securing our nation’s federal facilities. For example, we reported, in March 2015, that action is needed to better assess cost-effectiveness of security enhancements at federal facilities. In December 2015, ISC implemented our recommendation that they help federal agencies implement the cost- effectiveness and performance measurements by amending the federal government’s risk management standard and published new guidance intended to help federal entities make the most effective use of resources available for physical security across their facilities. As a result, federal entities will be able to better determine the benefits of security investments and assess whether they have reduced federal facilities’ vulnerability to threats, including acts of terrorism or other forms of violence. With regard to FPS guard training, further action is required to monitor progress. FPS relies on 13,500 privately contracted guards to provide security to federal facilities under the custody and control of GSA. We recommended in September 2013 that FPS immediately determine which guards have not had screener (x-ray and magnetometer equipment) or active-shooter scenario training and ensure the training has been provided to them. FPS has taken some steps to build a monitoring and tracking system to identify guards who completed training but has not yet completed and implemented the tracking system. In addition, we reported in January 2017 that GSA is leasing from foreign owners about 3.3 million square feet in 20 buildings that require higher levels of security. Most of the tenant agencies we contacted were unaware that the space they occupy is in a foreign-owned building. Federal officials who assess foreign investments and some tenant agencies said that leasing space in foreign-owned buildings could present security risks, such as espionage and unauthorized cyber and physical access. We recommended that GSA identify foreign owners of high security space and inform the tenant agencies for any needed security mitigation. GSA agreed with the recommendations.

Demonstrated Progress

Although FPS and other agencies have improved some areas of physical security, they have not yet met the criterion for demonstrated progress. To do so, FPS and USMS should continue work they have under way to implement our March 2015 recommendation related to security screening at federal buildings and courthouses. More specifically, we recommended that (1) FPS develop and implement a strategy for using covert-testing data and data on prohibited items to improve FPS’s security-screening efforts and (2) USMS develop and implement a strategy for using intrusion-testing data and data on prohibited items to improve security screening at federal courthouses held by GSA. Further, FPS must fully implement our September 2013 recommendations to ensure that its guards have met training and certification requirements and that contract guard companies’ instructors be certified to teach basic and refresher training courses to guards. As previously described, developing a tracking system that monitors guards’ training would also improve the way FPS oversees its contract guard program, which is central to effectively protecting employees and visitors in federal facilities.

Benefits Achieved by Implementing Our Recommendations

In July 2011, we recommended that FPS establish a process for verifying the accuracy of federal facility and guard training and certification data before entering them into the guard database. FPS developed and implemented procedures in 2014 to verify the accuracy of that data before entering it into its interim contract guard database. This step will help FPS in its continued efforts to verify the accuracy of federal facility and contract guard data.

In June 2012, we recommended that OMB, in collaboration with Federal Real Property Council member agencies, develop and publish a national strategy for managing federal excess and underutilized real property. In the spring of 2015, OMB issued the National Strategy. By issuing the National Strategy, the federal government has taken a major step forward to increase the efficiency of federal real property management and address long-standing real property challenges.

In March 2015, we recommended that the Secretary of Homeland Security direct ISC to develop guidance for helping federal entities meet the cost-effectiveness and performance measurement aspects of lSC’s risk management standard. In December 2015, ISC published new guidance that provides entities with an introduction and understanding of the most efficient processes and procedures to effectively allocate physical security resources across an entities’ portfolio of facilities, including discussions on how to determine cost- effectiveness and implement performance measures. As a result, federal entities will be able to better determine the benefits of security investments and whether they have reduced federal facilities’ vulnerability to acts of terrorism or other forms of violence.

In August 2012, we recommended that DHS direct FPS to coordinate with GSA and other federal tenant agencies to reduce any unnecessary duplication in security assessments of facilities under the custody and control of GSA. In 2016, we determined that FPS had taken steps to coordinate with these agencies. For example, in 2014, FPS surveyed GSA and other federal agencies to determine why they were conducting their own risk assessments, among other things. As a result of both coordinating with and surveying GSA as well as other federal agencies, FPS has reduced or prevented the duplication of effort associated with its risk assessments.

GAO Contact

For additional information about this high-risk area, contact the following people. On real property management, contact Dave Wise at (202)512- 2834 or wised@gao.gov. On issues related to physical security of federal facilities, contact Lori Rectanus at (202) 512-2834 or rectanusl@gao.gov.

Related GAO Products

Federal Real Property: GSA Should Inform Tenant Agencies When Leasing High-Security Space from Foreign Owners. GAO-17-195. Washington, D.C.: January 3, 2017.

Federal Real Property: Efforts Made, but Challenges Remain in Reducing Unneeded Facilities. GAO-16-869T. Washington, D.C.: September 23, 2016.

Federal Real Property: Actions Needed to Enhance Information on and Coordination among Federal Entities with Leasing Authority. GAO-16-648. Washington, D.C.: July 6, 2016.

Federal Real Property: Observations on GSA’s Canceled Swap Exchange Involving Buildings in the Federal Triangle South Area, GAO-16-571R. Washington, D.C.: June 16, 2016.

Federal Real Property: Improving Data Transparency and Expanding the National Strategy Could Help Address Long-standing Challenges. GAO-16-275. Washington, D.C.: March 31, 2016.

Federal Protective Service: Enhancements to Performance Measures and Data Quality Processes Could Improve Human Capital Planning. GAO-16-384. Washington, D.C.: March 24, 2016.

Federal Real Property: GSA Could Decrease Leasing Costs by Encouraging Competition and Reducing Unneeded Fees. GAO-16-188. Washington, D.C.: January 13, 2016.

Homeland Security: FPS and GSA Should Strengthen Collaboration to Enhance Facility Security. GAO-16-135. Washington, D.C.: December 16, 2015.

Homeland Security: Actions Needed to Better Manage Security Screening at Federal Buildings and Courthouses. GAO-15-445. Washington, D.C.: March 31, 2015.

Homeland Security: Action Needed to Better Assess Cost-Effectiveness of Security Enhancements at Federal Facilities. GAO-15-444. Washington, D.C.: March 24, 2015.

Federal Real Property: Strategic Focus Needed to Help Manage Vast and Diverse Warehouse Portfolio. GAO-15-41. Washington, D.C.: November 12, 2014.

Capital Financing: Alternative Approaches to Budgeting for Federal Real Property. GAO-14-239. Washington, D.C.: March 12, 2014.

Federal Facility Security: Additional Actions Needed to Help Agencies Comply with Risk Assessment Methodology Standards. GAO-14-86. Washington, D.C.: March 5, 2014.

Federal Real Property: Greater Transparency and Strategic Focus Needed for High-Value GSA Leases. GAO-13-744. Washington, D.C.: September 19, 2013.

Federal Protective Service: Challenges with Oversight of Contract Guard Program Still Exist, and Additional Management Controls Are Needed. GAO-13-694. Washington, D.C.: September 17, 2013.

Critical Infrastructure: DHS Needs to Refocus Its Efforts to Lead the Government Facilities Sector. GAO-12-852. Washington, D.C.: August 13, 2012.

Federal Protective Service: Actions Needed to Assess Risk and Better Manage Contract Guards at Federal Facilities. GAO-12-739. Washington, D.C.: August 10, 2012.

Federal Buildings Fund: Improved Transparency and Long-term Plan Needed to Clarify Capital Funding Priorities. GAO-12-646. Washington, D.C.: July 12, 2012.

Federal Real Property: National Strategy and Better Data Needed to Improve Management of Excess and Underutilized Property. GAO-12-645. Washington, D.C.: June 20, 2012.

Federal Courthouses: Improved Collaboration Needed to Meet Demands of a Complex Security Environment. GAO-11-857. Washington, D.C.: September 28, 2011.

Funding the Nation’s Surface Transportation System

Why Area Is High Risk

The nation’s surface transportation system—including highways, transit, maritime ports, and rail systems that move both people and freight—is critical to the economy and affects the daily lives of most Americans. However, the system is under growing strain, and the cost to repair and upgrade the system to meet current and future demands is estimated in the hundreds of billions of dollars. The oldest portions of the Interstate Highway System are approaching 60 years of age, and 10 percent of the nation’s bridges were rated as structurally deficient in 2015. While this percentage of bridges rated as structurally deficient improved from 13 percent in 2006, bridge conditions may become more challenging to address as a growing proportion approach the end of their 50-year design life.

Challenges to the nation’s surface transportation system are amplified by shifting demographics, the need to transport the goods and services to support a growing economy, rapid development of new technologies, and other factors. The U.S. population is expected to increase by 70 million over the next 30 years. As the Department of Transportation (DOT) has reported, this projected increase includes a growing percentage of Americans over the age of 65 with limited ability to drive or use transit to access critical services, and millennials, many of whom drive less than previous generations and choose to live in urban areas where they can walk, bike, or use public transportation. Though employment options in suburban areas are increasing, poverty is also increasing in such areas. Collectively, these changes will complicate future infrastructure planning decisions.

These trends are altering transportation investment decision making. The amount of freight moving through the country is expected to grow, a factor that will place strain on existing freight bottlenecks. Rapidly evolving vehicle technologies present new opportunities, but also pose challenges to creating a statutory and regulatory framework that will allow people to use these technologies while addressing privacy and other concerns they raise. Climate change also poses risks to existing transportation assets and presents opportunities and challenges to enhance resilience and reduce potential future losses, rather than simply pursuing a reactive approach of funding after a disaster occurs. financial condition and fiscal outlook. Funding the nation’s surface transportation system has been on GAO’s High-Risk List since 2007.

What GAO Found

There is no rating for this high-risk area because addressing it primarily involves congressional action and the high-risk criteria and subsequent ratings were developed to reflect the status of agencies’ actions and the additional steps they need to take.

Motor fuel taxes and additional truck-related taxes that support the Highway Trust Fund—the major source of federal surface transportation funding—are eroding. Federal motor fuel tax rates have not increased since 1993, and drivers of passenger vehicles with average fuel efficiency currently pay about $96 per year in federal gasoline taxes. Because of inflation, the 18.4 cent-per-gallon tax on gasoline enacted in 1993 is worth about 11 cents today. The tax base will likely continue to erode as demand for gasoline decreases with the introduction and adoption of more fuel-efficient and alternative fuel vehicles. To maintain spending levels of about $45-50 billion a year for highway and transit programs and to cover revenue shortfalls, Congress transferred a total of about $141 billion in general revenues to the Highway Trust Fund on eight occasions from 2008 through 2015. This funding approach has effectively ended the long-standing principle of “users pay” in highway finance, breaking the link between the taxes paid and the benefits received by highway users.

The most recent surface transportation reauthorization measure, enacted in December 2015 and which authorized funding through 2020, was the Fixing America’s Surface Transportation (FAST) Act. In addition to funds authorized from the Highway Trust Fund, the FAST Act provided around $70 billion of the $141 billion in transfers from general revenues. The general revenues provided in the FAST Act represented a one-time transfer of funding, not a sustainable long-term source of revenues. After 2020, the gap between projected revenues and spending will recur. In March 2016, the Congressional Budget Office estimated that $107 billion in additional funding would be required to maintain current spending levels plus inflation from 2021 through 2026, as shown in figure 9.

What Remains to Be Done

Congress and the administration need to agree on a long-term plan for funding surface transportation. Continuing to augment the Highway Trust Fund with general revenues may not be sustainable, given competing demands and the federal government’s fiscal challenges. A sustainable solution would balance revenues to and spending from the Highway Trust Fund. New revenues from users can come only from taxes and fees; ultimately, major changes in transportation spending or in revenues, or in both, will be needed to bring the two into balance. enhancing the management of discretionary grant programs. These actions are essential to maximizing the use of available resources.

Additional Details on What GAO Found

The challenge of funding the nation’s surface transportation system is magnified by the fact that spending for surface transportation programs has not commensurately improved system performance. Many programs have not effectively addressed key challenges—such as deteriorating infrastructure conditions and increasing congestion and freight demand— because federal goals and roles have been unclear, programs have lacked links to performance, and programs have not used the best tools and approaches to ensure effective investment decisions. Beginning in 2008, we recommended that Congress consider a fundamental reexamination of these programs to clarify federal goals and roles, establish performance links, and improve investment decision making. More recently, we found that it can be difficult to determine the extent to which federal funding has improved system performance. Specifically, in 2016, we found that while the Federal Highway Administration (FHWA) collects and maintains data on both federal funding for bridge projects and bridge conditions, it lacks a means of demonstrating the link between such funding and changes in bridge conditions. We recommended that the FHWA Administrator develop an efficiency measure to demonstrate the link between funding and bridge infrastructure outcomes, and report that information to Congress. DOT concurred with our recommendation and we are awaiting information on what steps DOT plans to take to implement it.

Congress passed provisions in MAP-21 in 2012 to help address the key challenges we identified in 2008. Among other things, the act included provisions to move toward a more performance-based highway and transit program. Specifically, MAP-21 established national performance goals in areas such as infrastructure condition, safety, and system performance; MAP-21 also outlined a three-stage process in which (1) DOT establishes performance measures for these national goals, (2) states and other grantees set targets based on these performance measures and report annually on their progress, and (3) DOT evaluates whether grantees have met their targets and reports to Congress. bridge conditions, and system performance. For example, the System Performance Measure rule includes measures for freight movement, traffic congestion, and air quality and received over 8,800 public comments. MAP-21 also required states to report on their progress in implementing the transportation performance management requirements to DOT by October 2016 and required DOT to report to Congress on progress made by October 2017. Because several of the final rules were recently issued, it is too early for states to report on progress, and thus DOT provided guidance to states, requesting that they instead report on their general performance management activities. We plan to report on DOT and state progress and anticipated challenges implementing the new national transportation performance management framework in the summer of 2017.

Congress and DOT have also taken steps to more strategically address freight congestion, though many of DOT’s actions are in the early stages. For example, MAP-21 established national goals and directed the Secretary of Transportation to establish a national freight network, develop a strategic freight plan, and provide the tools necessary to support a performance-based approach for evaluating and selecting new freight projects. The 2015 FAST Act made some changes to, and built upon, some of MAP-21’s freight provisions. Specifically, it extended the deadline for DOT to finalize the National Freight Strategic plan from October 2015 to December 2017. The public comment period for the draft plan closed on April 2016 and, according to DOT, it is on track to finalize the plan by the new deadline. The FAST Act also directed DOT to establish for the first time a National Multimodal Freight Network and also a National Highway Freight Network.

The National Highway Freight Network is to be used to strategically direct federal resources and policies toward improved performance of highway portions of the U.S. freight transportation system. Finally, the FAST Act established a competitive grant program to fund freight and highway projects of regional or national importance. In 2016, DOT awarded approximately $760 million for the Fostering Advancements in Shipping and Transportation for the Long-term Achievement of National Efficiencies (FASTLANE) grant program to 18 freight projects. outcome—that of returning revenues to their attributed state of origin. For three highway programs designed to meet national and regional transportation priorities, we recommended that Congress consider a competitive, criteria-based process for distributing federal funds. The FAST Act authorized about a dozen new discretionary grant programs, some of which DOT is already implementing, including the FASTLANE program. While over 90 percent of funds will continue to be distributed by formula, the FAST Act represents a promising development to address national and regional transportation priorities.

Nevertheless, we have found challenges with DOT’s implementation of discretionary grant programs, including problems documenting key evaluation and project selection decisions. For example, in May 2014, we found that DOT did not document key decisions—such as accepting and reviewing project applications received after the published deadline, or changes to projects’ technical ratings— and deviated from established procedures and recognized internal control practices in awarding Transportation Investment Generating Economic Recovery (TIGER) discretionary grants. We recommended that the Secretary of Transportation establish additional accountability measures by, among other things, issuing a decision memorandum or similar mechanism to document and approve major decisions in the application evaluation and project-selection process. DOT generally agreed with, but has not fully implemented, this recommendation.

In addition, in December 2016, we found that the Federal Transit Administration (FTA) did not document key decisions in awarding $3.6 billion in discretionary, competitive grants for projects to increase the resilience of transit systems to withstand future disasters in areas affected by Hurricane Sandy. For example, FTA did not document how it addressed reviewers’ concerns that some of the proposed—and ultimately funded—projects were outside the scope of the grant program. We also found that because FTA did not incorporate information collected from applicants and reviewers into its selection process, it may have funded projects that may no longer be needed if other resilience projects in the same region are implemented. We recommended that FTA examine its funded projects for potential duplication with other resilience efforts and determine if realigning or rescinding those funds is appropriate. DOT concurred with our recommendation and we are awaiting information on what steps DOT plans to take to implement it. we recommended in December 2016 that the Secretary of Transportation issue a directive governing department-wide and modal administration discretionary grant programs. Such a directive should include requirements to, among other things, (1) develop an up-front plan for evaluating project proposals to ensure DOT reviews applications consistently; and (2) document key decisions, including the reason for any rating changes, as well as how high-level concerns raised during the process were addressed. Developing such a directive would help to ensure the integrity of future DOT discretionary grant programs. DOT concurred with our recommendation and we are awaiting information on what steps DOT plans to take to implement it.

GAO Contact

For additional information about this high-risk area, contact Susan Fleming at (202) 512-2834 or FlemingS@gao.gov.

Related GAO Products

DOT Discretionary Grants: Problems with Hurricane Sandy Transit Grant Selection Process Highlight the Need for Additional Accountability. GAO-17-20. Washington, D.C.: December 14, 2016.

West Coast Ports: Better Supply Chain Information Could Improve DOT’s Freight Efforts. GAO-17-23. Washington, D.C.: October 31, 2016.

Highway Bridges: Linking Funding to Conditions May Help Demonstrate Impact of Federal Investment. GAO-16-779. Washington, D.C.: September 14, 2016.

U.S. Border Communities: Ongoing DOT Efforts Could Help Address Impacts of International Freight Rail. GAO-16-274. Washington, D.C.: January 28, 2016.

Surface Transportation: DOT Is Progressing Toward a Performance- Based Approach, but States and Grantees Report Potential Implementation Challenges. GAO-15-217. Washington, D.C.: January 16, 2015.

Surface Transportation: Department of Transportation Should Measure the Overall Performance and Outcomes of the TIGER Discretionary Grant Program. GAO-14-766. Washington, D.C.: September 23, 2014.

Freight Transportation: Developing National Strategy Would Benefit from Added Focus on Community Congestion Impacts. GAO-14-740. Washington, D.C.: September 19, 2014.

Surface Transportation: Actions Needed to Improve Documentation of Key Decisions in the TIGER Discretionary Grant Program. GAO-14-628R. Washington, D.C.: May 28, 2014.

Highway Trust Fund: Pilot Program Could Help Determine the Viability of Mileage Fees for Certain Vehicles. GAO-13-77. Washington, D.C.: December 13, 2012.

Highway Trust Fund: All States Received More Funding Than They Contributed in Highway Taxes from 2005 to 2009. GAO-11-918. Washington, D.C.: September 8, 2011.

Surface Transportation: Clear Federal Role and Criteria-Based Selection Process Could Improve Three National and Regional Infrastructure Programs. GAO-09-219. Washington, D.C.: February 6, 2009.

Surface Transportation: Restructured Federal Approach Needed for More Focused, Performance-Based, and Sustainable Programs. GAO-08-400. Washington, D.C.: March 6, 2008.

Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Finance

Why Area Is High Risk

Congress and financial regulators have made progress in meeting criteria for removing the issue area of reforming the U.S. financial regulatory system from our High-Risk List. However, definitive steps have yet to be taken to address the federal government’s role in housing finance. As the worst financial crisis in more than 75 years unfolded, unprecedented federal support was provided to many firms, including Fannie Mae and Freddie Mac, two large, housing-related government-sponsored enterprises (the enterprises). Many households suffered as a result of falling asset prices, tightening credit, and increasing unemployment. These events clearly demonstrated that the U.S. financial regulatory system had failed to respond effectively to developments in the markets and to the increase in systemic risks that contributed to the crisis. Given the challenges that regulators would face in identifying and implementing changes to reduce the potential for such events to occur again, we designated reform of the financial regulatory system as a high-risk area in 2009. developments at the enterprises and FHA, we added this issue to the scope of this high-risk area in 2013.

What GAO Found

Congress and financial regulators have made progress in meeting criteria for removing the issue area of reforming the U.S. financial regulatory system from our High-Risk List, but additional steps are needed to improve the structure of the financial regulatory system and the implementation of some reforms. Demonstrating leadership commitment and capacity, Congress enacted sweeping reforms in 2010 through the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act) and regulators have worked to implement the act’s numerous reforms. Continued leadership commitment from financial regulators and Congress will be needed to fully implement the reforms and additional work will be needed to exhibit capacity to complete oversight and monitoring plans, monitor progress, and demonstrate the effectiveness of the new oversight bodies and regulations.

Policymakers have made proposals to overhaul the federal role in the housing finance system, but additional leadership commitment will be needed to reach consensus and enact changes to the system. The ongoing federal conservatorship of the enterprises and FHA’s need for supplemental funds in 2013 underscore the need to reconsider the federal role. Federal agencies have taken some steps to develop plans, build capacity, and provide monitoring mechanisms that could help build a more robust housing finance system. However, progress toward resolving the federal role within that system will be difficult to achieve without an overall blueprint for change. new and more complex financial products for consumers and investors. Taking steps to better position regulators to oversee firms and products that pose risks to the financial system and consumers, and to adapt to new products and participants as they arise, could reduce the likelihood that the financial markets will experience another financial crisis similar to the one in 2007–2009.

Losses from risky mortgage products also resulted in the enterprises being placed into federal conservatorship in 2008, creating an explicit fiscal exposure for the federal government. The enterprises received more than $187 billion in financial assistance from the Department of the Treasury (Treasury) through purchases of senior preferred stock, but have paid more than $250 billion in dividends to Treasury under the stock purchase agreements. Distressed housing and mortgage markets also expanded FHA’s role in the mortgage market, while leading to deterioration in the agency’s financial condition from which it has taken years to recover. In 2015, mortgages directly or indirectly supported by the federal government accounted for more than 70 percent of the dollar value of new single-family mortgage originations, according to data from Inside Mortgage Finance.

Although more needs to be done to address this high-risk issue, there have been several benefits achieved by implementing our recommendations.

In a March 2016, we reported that Treasury had not instituted a system to review the extent to which it would use the available program balance for the Making Home Affordable (MHA) program. Consistent with our recommendations, Treasury updated estimates of future MHA program expenditures, deobligated $2 billion from the MHA program, and announced a $2 billion increase in funding for the Hardest Hit Fund.

In June 2013, we made recommendations intended to increase FHA’s returns on sales of foreclosed properties with FHA-insured mortgages. FHA’s actions in response to our recommendations improved its returns and led to financial benefits totaling more than $3.4 billion in fiscal years 2013–2016. approximately $7.1 billion dollars, which was returned to the general fund in fiscal year 2013.

In November 2005, we recommended that FHA take a number of steps to mitigate the risks associated with mortgages with down payment assistance from nonprofit organizations funded by property sellers. Citing our work, Congress prohibited seller-funded down- payment assistance, effective October 1, 2008. In fiscal year 2013, the financial benefit to the federal government of not insuring such loans was approximately $2.5 billion.

What Remains to Be Done

Actions Needed to Complete and Ensure the Effective Functioning of Reforms to the U.S. Financial Regulatory System

Continued leadership commitment is needed to ensure that financial regulations foster stable, competitive and well-functioning markets. Our review of selected major rules—that is, those likely to result in an annual impact on the economy of $100 million or more, among other things— found that regulators generally quantified some of the costs but not always the benefits of each rule, noting data and other limitations. Although the federal financial regulators—as independent agencies—are not subject to executive orders requiring detailed cost-benefit analysis in accordance with Office of Management and Budget (OMB) guidance, we have recommended that the regulators more fully incorporate OMB’s regulatory guidance into their written rulemaking policies. However, not all regulators have implemented this recommendation. The Administration and members of Congress have expressed intentions to reduce financial regulatory burdens. Such actions would be most effective if they largely preserve the benefits sought by the regulations while allowing institutions to comply with the requirements in less costly ways. requirements that regulators adopted for banks in October 2013 have some provisions that will not be fully effective until January 2019.

Additional leadership from Congress is also needed to improve the inefficiencies that hamper the current financial regulatory system. Although the Dodd-Frank Act implemented a number of key reforms intended to address significant weaknesses and gaps in the regulatory system, the U.S. financial regulatory structure remains complex, with responsibilities fragmented among a number of regulators that have overlapping authorities. We have noted that this fragmentation, overlap, and duplication introduce significant challenges for efficient and effective oversight of financial institutions and activities.

The framework we developed in 2009 for evaluating regulatory reform proposals noted that an effective regulatory system would address certain structural shortcomings created by fragmentation and overlap. To help achieve this, we have suggested that Congress consider whether additional changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap in the oversight of financial institutions and activities to improve the efficiency and effectiveness of oversight. For example, Congress could consider consolidating the number of federal agencies involved in overseeing the safety and soundness of depository institutions, combining the entities involved in overseeing the securities and derivatives markets, transferring the remaining prudential regulators’ consumer protection authorities over large depository institutions to the Consumer Financial Protection Bureau (CFPB), and determining the optimal federal role in insurance regulation.

Congressional leadership also could improve the ability of the U.S. regulatory system to address systemic risks. Although the Financial Stability Oversight Council (FSOC) represents advancement in addressing systemic risk threats to the U.S. financial system, its legal authorities may not be broad enough to ensure that it can address all threats effectively. Under the Dodd-Frank Act, FSOC can respond to certain potential systemic risks primarily through its authority to designate certain entities or activities that pose a threat to financial stability for enhanced supervision by a specific federal regulator. We reported in February 2016 that FSOC’s designation authorities, by statute, cannot be used to address certain types of risks, such as specific industry-wide activities involving nonbank financial institutions, and the full scope of FSOC’s designation authority remains untested and unclear to date.

FSOC has other nondesignation authorities that allow it to recommend that individual regulators address specific risks, but these recommendations are nonbinding. As a result, we suggested that Congress consider whether legislative changes would be necessary to align FSOC’s authorities with its mission to respond to systemic risks. Such actions could include changes to FSOC’s mission, its authorities, or both, or to the missions and authorities of one or more of the FSOC member agencies to support a stronger link between its responsibility and capacity to respond to systemic risks.

Additional leadership, planning, capacity, and monitoring activities by U.S. financial regulators also could improve systemic risk oversight. While the newly created systemic risk and financial research bodies have been established, we have continued to identify additional steps they need to take to fully meet their envisioned missions. The Dodd-Frank Act maintained the independence of the system’s multiple regulators but created FSOC to identify and respond to systemic risks. We noted in February 2016 that this approach to systemic risk oversight requires consistent and highly effective interagency collaboration and the use of good quantitative and qualitative information. However, we reported then that FSOC’s Systemic Risk Committee is not fully and consistently informed by the Office of Financial Research (OFR) and the Federal Reserve’s monitoring tools or other outputs, and we recommended this be done.

In addition, we found that both OFR and the Federal Reserve conduct broad-based systemic risk monitoring activities that aim to identify threats across the financial system and recommended that the two agencies jointly articulate individual and common goals for their systemic risk monitoring activities, including a plan to monitor progress toward articulated goals, and formalize regular strategic and technical discussions around their activities and outputs to support those goals. Such efforts could help ensure that FSOC more accurately measures the effect of significant Dodd-Frank Act regulations but also more efficiently coordinates with its members to leverage retrospective reviews. agencies, to better ensure that the monitoring and analysis of the financial system are comprehensive and not unnecessarily duplicative. In addition, to improve the data that council members need to conduct their responsibilities, FSOC should direct OFR to work with its members to identify and collect the data necessary to assess the effect of the Dodd- Frank Act regulations on, among other things, the stability, efficiency, and competitiveness of the U.S. financial markets.

Financial regulators need to demonstrate further progress by taking additional actions. Although FSOC’s ability to identify firms whose financial difficulties could pose threats to the overall financial system is an important oversight tool, we reported in November 2014 that the transparency of its process for designating systemically important nonbank entities could be improved. Designating these entities in a way that supports public and market confidence could help mitigate the potential for such entities to endanger the stability of the U.S. financial system. Thus, we recommended that FSOC take various steps to improve the tracking of its process and disclose the rationales for its designations in greater detail. Since then, FSOC has issued supplemental procedures for nonbank financial company designations that stated its commitment to continuing to provide the public with an understanding of the council’s analysis and a subsequent designation document included additional information compared to prior ones. However, that document did not fully explain how FSOC concluded that a company’s characteristics were sufficiently large or significant enough, or had other attributes, to meet a determination standard.

Corporation address these weaknesses. In addition, we recommended in 2016 numerous steps the Federal Reserve could take to improve the stress tests that assess how large financial institutions would be affected by changes in economic or other conditions.

Additional progress is needed to address other risks. Although the Federal Reserve has worked with the two clearing banks for the repurchase (repo) market to reduce their problematic credit exposures, the FSOC 2015 annual report notes that the risk of fire sales of collateral by creditors of a defaulted broker-dealer remains an important financial stability concern. For instance, many of the creditors may themselves be vulnerable to runs in a stress event. As a result, the council expressed the need for market participants to continue to improve the settlement processes for these transactions.

Actions Needed to Resolve the Federal Role in Housing Finance

Resolving the role of the federal government in housing finance will require continued leadership commitment by Congress and the administration. Prolonged conservatorships and a change in leadership at FHFA could shift priorities for the conservatorships, which in turn could send mixed messages and create uncertainties for market participants and hinder the development of the broader secondary mortgage market. For this reason, we said in November 2016 that Congress should consider legislation establishing objectives for the future federal role in housing finance, including the structure of the enterprises, and a transition plan to a reformed housing finance system that enables the enterprises to exit conservatorship.

Maintaining FHA’s long-term financial health and defining its future role also will be critical to any effort to overhaul the housing finance system. We previously recommended that Congress or FHA specify the economic conditions that FHA’s Mutual Mortgage Insurance (MMI) Fund would be expected to withstand without requiring supplemental funds. As evidenced by the $1.68 billion FHA received in 2013, the 2 percent capital requirement for FHA’s MMI Fund may not always be adequate to avoid the need for supplemental funds under severe stress scenarios.

Implementing our recommendation would be an important step not only in addressing FHA’s long-term financial viability, but also in clarifying FHA’s role. FHA also will need to sustain the progress it made in strengthening the health of the MMI Fund and implementing sound risk-management practices. Furthermore, it will be important for FHA and other agencies with housing finance-related responsibilities to fully implement our recommendations on evaluating the effectiveness of foreclosure mitigation actions, opportunities for consolidating similar housing programs, and the effect of recent mortgage market regulations.

Due to the interconnected nature of the housing finance system and the central role homeownership plays in the U.S. economy, changes will need to be carefully designed and implemented. In October 2014, we issued a framework consisting of nine elements that Congress and others can use as they consider changes to the housing finance system. The framework has the following elements: clearly defined and prioritized goals for the housing finance system; policies and mechanisms that are aligned with goals and other adherence to an appropriate financial regulatory framework; government entities with the capacity to manage risks; protections for mortgage borrowers and actions to address barriers to protection for mortgage securities investors; consideration of the cyclical nature of housing finance and the effect of housing finance on financial stability; recognition and control of fiscal exposure and mitigation of moral hazard; and emphasis on implications of the transition.

Each element in the framework is critically important in establishing the most effective and efficient housing finance system. Applying the elements of this framework would help policymakers identify the relative strengths and weaknesses of any proposals they consider. Similarly, the framework can be used to craft proposals or to identify changes to existing proposals to make them more effective and appropriate for addressing any limitations of the current system. However, any viable proposal for change must recognize that sometimes tradeoffs will exist among and within the nine elements. If Congress enacts changes to the housing finance system, relevant federal agencies will need to develop the capacity and action plans necessary to effectively implement the changes and monitor progress.

FHA needs to complete or build on steps it has taken in response to two priority recommendations that were not fully implemented as of October 2016. First, FHA has partially addressed recommendations from our June 2012 report on reducing losses from troubled mortgages, but needs to finish analyzing and reevaluating its loss mitigation approaches in order to optimize these efforts. Second, FHA and other agencies that are part of a single-family housing task force need to evaluate and report on the opportunities for consolidating similar housing programs, as we recommended in an August 2012 report.

Congressional Actions Needed

federal role in housing finance, including the structure of the enterprises, and a transition plan to a reformed housing finance system that enables the enterprises to exit conservatorship.

Additional Details on What GAO Found

Implementation and Effective Functioning of Regulations and New Financial Regulatory Bodies

Leadership Commitment

U.S. financial system and acting to mitigate risks that might destabilize the system. In addition, the act consolidated responsibility for consumer financial protection laws into a new agency, CFPB. However, some reforms, including several rules addressing over-the-counter derivatives reforms, have yet to be fully implemented.

Additional leadership is needed from Congress to address the limitations that hamper the current financial regulatory structure. Although the Dodd- Frank Act made changes that were consistent with some of the characteristics we have identified for an effective financial regulatory framework, the existing regulatory structure does not always ensure (1) efficient and effective oversight, (2) consistent consumer protections, and (3) consistent financial oversight. As a result, negative effects of fragmented and overlapping authorities persist throughout the system. Without congressional action it is unlikely that remaining fragmentation and overlap in the U.S. financial regulatory system can be reduced or that policymakers and regulators can more effectively and efficiently oversee financial institutions. Members of Congress have also expressed concerns about the burdens that the new regulations may have created for financial institutions and have indicated plans to reduce these burdens.

Capacity

they continue to face such constraints they are taking steps to address their obligations to finalize the remaining rules.

Action Plan

Regulators have made some progress in developing action plans for completing reforms and have partially met this criterion for removal from the High-Risk List. Since 2010, regulators have taken steps to prioritize rulemakings, including FSOC issuing an integrated implementation road map for required rules and publishing a consultation framework for guiding rulemaking coordination activities among agencies. FSOC’s annual reports serve as the council’s key accountability document, as each report discusses the progress regulators have made in implementing reforms, identifies newly emerging threats, and includes recommendations to address them. We also reported in February 2016 that the work of FSOC’s Systemic Risk Committee has become better integrated into the council’s annual reports.

Monitoring

over time, may be useful to these regulators in monitoring the effect of regulations on banks and credit unions.

Demonstrated Progress

Regulators have partially met the demonstrated progress criterion for removal from the High-Risk List. The new regulatory bodies have been taking actions to carry out their missions. For example, FSOC meets regularly to discuss issues related to risks to the U.S. financial system and issues an annual report that addresses market and regulatory developments across the financial system.

As a result of FSOC determining that the activities or characteristics of some entities are systemically important, various financial market utilities (which perform key functions in the financial system) were designated to be subject to prescribed risk management standards and four nonbank financial companies were designated to be subjected to enhanced prudential standards and supervision by the Board of Governors of the Federal Reserve (Federal Reserve), although the United States District Court for the District of Columbia rescinded the designation applicable to one company and FSOC rescinded the designation of another after the company changed its operations to reduce its systemic importance.

As part of making progress in demonstrating the effectiveness of implemented reforms, FSOC also issued a mandated report in March 2016 that addressed the effect regulatory changes are having on firm sizes, diversification, and other issues. CFPB has implemented rules and taken enforcement actions that resulted in billions of dollars of relief to consumers. With the recent crisis demonstrating the importance of efficiently resolving systemically important financial institutions that fail, the Federal Reserve and the Federal Deposit Insurance Corporation completed several annual reviews of resolution plans that the Dodd-Frank Act mandates large systemically important financial institutions prepare. And in response to one of our recommendations, the agencies made additional information public about the criteria they use to evaluate the plans.

Regulators also made progress reducing the potential systemic implications of certain concentrations of credit risks the Dodd-Frank Act had not addressed. Regulators have been working to reduce the potential for serious problems arising from the failure of one of the two clearing banks that provide credit to facilitate transactions in the tri-party repurchase (repo) market that provides short-term funding to many financial institutions. FSOC’s 2015 annual report noted that market participants have reduced their reliance on intraday credit from the clearing banks, which reduces the risks posed by these activities.

Resolution of the Role of the Federal Government in Housing Finance

Leadership Commitment

housing finance system. As of December 2016, none of the proposals had passed the Senate or the House of Representatives.

Housing and regulatory agencies also have demonstrated commitment to strengthening the housing finance system. FHA has enhanced its risk- management practices in response to our recommendations, including creating credit and operational risk committees, and has taken actions to recapitalize its MMI Fund. FHFA has continued efforts to develop a single security for the enterprises—which may enhance market liquidity for mortgaged-backed securities—and put in place a common securitization platform for the enterprises. Additionally, as we reported in our 2015 high-risk update, financial regulators have finalized rules defining qualified mortgages and qualified residential mortgages that are designed to prevent a recurrence of risky mortgage origination and securitization practices.

Capacity

Agencies have partially met this criterion for removal from the High-Risk List. FHA has made progress in strengthening its financial capacity. In fiscal years 2009–2014, FHA’s MMI Fund was out of compliance with its statutory 2 percent minimum capital requirement. And at the end of fiscal year 2013, FHA drew on $1.68 billion in permanent and indefinite budget authority to ensure the MMI Fund had sufficient resources to pay for expected future losses on existing insurance obligations. However, as of September 30, 2016, the MMI Fund’s capital ratio was in compliance with the statutory requirement and stood at 2.32 percent. scores. FHA took steps to mitigate losses by revising guidelines on home retention options for struggling borrowers and by implementing cost- effective alternatives for disposing of nonperforming loans and foreclosed properties. FHA also acted on our recommendations for increasing returns on foreclosed properties, which could help strengthen its financial position.

Under FHFA’s conservatorship, the enterprises generally have operated profitably since 2012, and, through September 2016, paid more than $250 billion to Treasury in dividends. However, FHFA’s Inspector General warned in March 2015 that the continued profitability of the enterprises was not assured and that the enterprises faced many financial challenges. These challenges included lower earnings on their retained investment portfolios and a reduced capacity to absorb future losses due to a capital reserve amount that falls to $0 by 2018. Without a capital reserve, any quarterly losses—including those due to market fluctuations and not necessarily to economic conditions—would require the enterprises to draw additional funds from Treasury. Treasury has provided about $187.5 billion in funds as capital support to the enterprises, with an additional $258.1 billion available to the enterprises should they need further assistance.

Congress should consider granting FHFA the authority to examine third parties, including nonbank mortgage servicers doing business with the enterprises. As of December 2016, Congress had not yet acted on that recommendation.

Action Plan

Although fundamental changes to the housing finance system have yet to be enacted, federal agencies have taken some planning steps in relation to resolving the federal role in housing finance and have therefore partially met this criterion for removal from the High-Risk List. As we noted in our 2015 high-risk update, these steps included a 2011 Treasury-HUD plan outlining a vision for the federal role, a 2014 FHFA plan identifying strategic goals for enterprise conservatorship, and a 2014 Treasury initiative to obtain public comments on the role of the private- label securities market in the current and future housing finance system. As we found in November 2016, FHFA’s 2014 strategic plan shifted emphasis away from contracting the enterprises’ operations, which was a goal in the 2012 plan developed under FHFA’s previous director. Since launching its initiative in 2014, Treasury has provided a forum for stakeholders in the private-label market to identify the structural reforms needed to bring back capital into that market in a responsible way. Additionally, in July 2016, Treasury, FHFA, and HUD issued a report with guiding principles for future efforts to mitigate mortgage losses based on lessons from the financial crisis.

Monitoring

through their housing market scorecard. Furthermore, FHFA and FHA have continued to monitor and report on the financial condition of the enterprises and FHA’s MMI Fund.

A number of agencies—such as CFPB and HUD—have begun planning required retrospective reviews of mortgage market reforms—specifically, the qualified mortgage and qualified residential mortgage rules noted previously. However, in June 2015, we found the agencies had not yet developed sufficient metrics, baselines, and analytical methods to effectively conduct the retrospective reviews. We recommended that they complete plans for the reviews and include the three elements we identified. As of December 2016, some of the agencies reported making progress to develop these improvements but had not yet completed them.

Demonstrated Progress

Policymakers and regulators have not met this criterion for removal from the High-Risk List. Overall progress on resolving the federal role in housing finance will be difficult to achieve until Congress provides further direction by enacting changes to the housing finance system. Federal agencies have begun taking some planning, capacity building, and monitoring steps. Among these are actions mentioned above to strengthen the financial condition of FHA and mitigate risks of the housing enterprises. FHFA and FHA have also taken steps to monitor progress in these areas by reporting on their financial condition and activities. Furthermore, Treasury and HUD have combined to report regularly on the condition of the housing market. Nonetheless, assessing progress against specific goals is not yet possible because Congress has not provided an overall blueprint for the future federal role in housing finance or determined the specific roles federal agencies will play.

Benefits Achieved by Implementing Our Recommendations

to the TARP-funded Hardest Hit Fund, as authorized. Consistent with our recommendations, Treasury updated estimates of future MHA program expenditures, deobligated $2 billion from the MHA program, and announced a $2 billion increase in funding for the Hardest Hit Fund.

In June 2013, we found that HUD’s performance in selling foreclosed properties with FHA-insured mortgages lagged the performance of Fannie Mae and Freddie Mac. We made recommendations intended to increase FHA’s returns on such property dispositions. FHA’s actions in response to our recommendations improved its returns and led to financial benefits totaling more than $3.4 billion in fiscal years 2013–2016.

In a June 2012 report on federal foreclosure mitigation efforts, we found that Treasury had not reassessed its need for the $8 billion letter of credit facility for FHA’s Refinance for Borrowers in Negative Equity Positions program. We recommended that Treasury and FHA update their estimates of program participation and use the updated estimates to reassess the terms of the letter of credit facility. The agencies implemented our recommendation. As a result, Treasury amended the purchase agreement and deobligated approximately $7.1 billion dollars, which was returned to the general fund in fiscal year 2013. training for its staff and obtained assurance from the Office of Management and Budget that its collection of credit card data complied with federal requirements. These steps should help ensure CFPB collects and protects consumer financial data in accordance with federal requirements.

After the Dodd-Frank Act prohibited certain types of proprietary trading that had caused large losses for banks, regulators implemented our recommendation to improve their oversight by reviewing trading data before issuing final rules to implement the restriction in December 2013. These rules also identified trading data some firms will have to report to regulators. As a result, regulators should have better information to help them reduce the risk that banks will incur large trading losses.

FHA takes possession of thousands of homes as a result of foreclosures on FHA-insured mortgages. In June 2013, we found FHA generally did not take market conditions into account when reducing list prices for unsold foreclosed properties, but instead generally followed standardized schedules. We recommended that FHA adopt practices used by other federally related housing entities, which base price reduction decisions on property-level information and market conditions. FHA implemented our recommendations in June 2016, which could reduce holding times for and improve returns on foreclosed properties.

Additionally, in response to our November 2011 recommendation that FHA establish ongoing mechanisms for anticipating potential risks presented by changing conditions, FHA created credit and operational risk committees, which have specified tools they use to address emerging risks. Taking these steps should help FHA more effectively identify, plan for, and address risks facing the agency.

GAO Contact

For additional information about this high-risk area, contact Lawrance Evans at (202) 512-8678 or evansl@gao.gov.

Related GAO Products

U.S. Financial Regulatory System

Resolution Plans: Regulators Have Refined Their Review Processes but Could Improve Transparency and Timeliness. GAO-16-341. Washington, D.C: April 12, 2016.

Financial Regulation: Complex and Fragmented Structure Could Be Streamlined to Improve Effectiveness. GAO-16-175. Washington, D.C: February 25, 2016.

Dodd-Frank Regulations: Impacts on Community Banks, Credit Unions and Systemically Important Institutions. GAO-16-169. Washington, D.C: December 30, 2015.

Bank Regulation: Lessons Learned and a Framework for Monitoring Emerging Risks and Regulatory Response. GAO-15-365. Washington, D.C: June 25, 2015.

Financial Stability Oversight Council: Further Actions Could Improve the Nonbank Designation Process. GAO-15-51. Washington, D.C: November 20, 2014.

Financial Stability: New Council and Research Office Should Strengthen the Accountability and Transparency of Their Decisions. GAO-12-886. Washington, D.C: September 11, 2012.

Dodd-Frank Act Regulations: Implementation Could Benefit from Additional Analyses and Coordination. GAO-12-151. Washington, D.C: November 10, 2011.

Financial Regulation: A Framework for Crafting and Assessing Proposals to Modernize the Outdated U.S. Financial Regulatory System. GAO-09-216. Washington, D.C.: January 8, 2009.

Federal Role in Housing Finance

Federal Housing Finance Agency: Objectives Needed for the Future of Fannie Mae and Freddie Mac After Conservatorships. GAO-17-92. Washington, D.C.: November 17, 2016.

Nonbank Mortgage Servicers: Existing Regulatory Oversight Could Be Strengthened. GAO-16-278. Washington, D.C.: March 10, 2016.

Mortgage Reforms: Actions Needed to Help Assess Effects of New Regulations. GAO-15-185. Washington, D.C.: June 25, 2015.

Housing Finance System: A Framework for Assessing Potential Changes. GAO-15-131. Washington, D.C.: October 7, 2014.

Mortgage Financing: FHA’s Fund Has Grown, but Options for Drawing on the Fund Have Uncertain Outcomes. GAO-01-460. Washington, D.C.: February 28, 2001.

Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability

Why Area Is High Risk

The U.S. Postal Service (USPS) faces a serious financial situation that is putting its mission of providing prompt, reliable, and efficient universal mail services at risk. It reported a net loss of $5.6 billion in fiscal year 2016—its 10th consecutive year of net losses. Additionally, it continues to face unfunded liabilities that have grown from 99 percent of USPS revenues in fiscal year 2007 to 169 percent of revenues in fiscal year 2016. These unfunded liabilities—totaling about $121 billion at the end of fiscal year 2016—consist mostly of retiree health and pension benefit obligations for which USPS has not set aside sufficient funds to cover. For example, since September 2010, USPS has not made almost $34 billion in required prefunding retiree health payments, which has led to an unfunded liability of about $52 billion. USPS’s ability to make payments to cover its unfunded liabilities is challenged due to (1) continued expected declines in mail volumes; (2) growing expenses; (3) expiration of a temporary rate surcharge (which generated $4.6 billion in additional revenue from its January 2014 inception to its April 2016 discontinuation); and (4) no planned new major cost-savings initiatives. As a result, it is not likely that USPS will be able to make all of its required health and pension payments in fiscal year 2017. of USPS by not saddling it with bills after employees have retired. USPS retirees participate in the same health and pension benefit programs as other federal retirees. Thus, if USPS ultimately does not adequately fund these benefits and if Congress wants these benefits to be maintained at current levels, funding from the U.S. Treasury and hence the taxpayer would be needed to continue the benefit at the same levels. Alternatively, unfunded benefits could pressure USPS to reduce benefits or pay for postal workers. In July 2009, we added USPS’s financial condition to the list of high-risk areas needing attention by Congress and the executive branch to achieve broad-based restructuring.

What GAO Found

USPS has partially met all five of the criteria for removal from the High- Risk List. Although USPS has taken some steps to improve its financial situation, it has limited ability to resolve its financial difficulties, in part due to statutorily defined requirements, such as requirements to maintain 6- day delivery and resistance from external groups. USPS has made efforts to reduce its physical footprint, grow its shipping and package services, raise revenue, and reduce the gap between expenses and revenue. However, these initiatives are insufficient to restore USPS’s financial viability. USPS has no plans to initiate new major initiatives that would achieve necessary cost savings—USPS has previously faced resistance to such efforts from customers and Congress.

USPS’s Five Year Strategic Plan for fiscal years 2017 to 2021 identified specific legislative changes needed for USPS to return to long-term financial health. Furthermore, USPS continued to monitor its situation through public quarterly and annual financial reports that discuss its financial status and performance, but has also reported that it cannot secure its near- or long-term financial outlook without the passage of targeted postal reform legislation. The House Committee on Oversight and Government Reform approved a bill that addressed some of USPS’s solvency challenges; however, the bill was not enacted and there continues to be a lack of consensus about how to address the trade-offs that are inherent with resolving USPS’s financial difficulties.

What Remains to Be Done

USPS needs to continue taking action to reduce costs related to its operations, workforce, and facilities, and to increase revenues so that it can reduce its net losses, fully make its required payments to fund employee benefits, repay its debt, and generate capital for investments, such as replacing its aging vehicle fleet.

Congress and USPS need to agree on a comprehensive package of actions to improve USPS’s financial viability. These actions include (1) modifying USPS’s retiree health benefit payments in a fiscally responsible manner; (2) facilitating USPS’s ability to better align costs with revenues; and (3) requiring any binding arbitration in the negotiation process for USPS labor contracts to take USPS’s financial condition into account.

Additional Details on What GAO Found

Leadership Commitment

While USPS’s leadership has been committed to increasing revenue and reducing expenses in an effort to put USPS on a more stable financial path, USPS has no plans to initiate new major initiatives that would achieve necessary cost savings. Although USPS has previously faced resistance to such efforts from customers and Congress, committing to major cost-saving initiatives may serve to reiterate the need for broad- based restructuring. The efforts USPS has implemented thus far have been insufficient to eliminate net losses. For example, a temporary 4.3 percent “exigent” surcharge was implemented to address losses from decreased mail volume during the Great Recession, which occurred between December 2007 and June 2009. The surcharge began in January 2014 and was discontinued in April 2016, generating $4.6 billion in additional revenue during this period—including $1.1 billion in fiscal year 2016, $2.1 billion in fiscal year 2015, and $1.4 billion in fiscal year 2014. Furthermore, starting in fiscal year 2011, USPS established Delivering Results, Innovation, Value, and Efficiency initiatives to reduce the large gap between revenue and costs, and to implement strategic initiatives with measurable outcomes.

Capacity

and its overall workforce increased in fiscal years 2015 and 2016 due, in part, to significant volume-growth in shipping and packages (14.1 percent in fiscal year 2015 and 13.8 percent in fiscal year 2016), which are more labor intensive to process.

USPS reported that although the 15.8 percent growth in shipping and packages revenue helped generate additional total revenue of $2.6 billion (a 3.7 percent increase), package growth also contributed to an increase of 18,000 employees in fiscal year 2016, and an increase in total expenses of about $3.1 billion (about 4.2 percent). In addition, although it experienced net losses, USPS’s compensation expenses increased by 2 percent in fiscal year 2016 due to salary increases and additional work hours. Furthermore, as part of its efforts to reduce excess capacity, USPS revised its standards for on-time mail delivery in January 2015 by increasing the number of days for some mail to be delivered and still be considered on time. Even with the revised standards, on-time delivery performance declined significantly, particularly for the second quarter of fiscal year 2015, a decline USPS attributed to operational changes enacted in January 2015 and adverse winter weather. Performance has rebounded since then, but with the rebound came increases in workforce and mail transportation costs.

Action Plan

USPS’s Five-Year Strategic Plan for fiscal years 2017 to 2021 outlines its strategy for achieving financial viability. USPS’s plan summarizes changes that USPS has made or plans to make, and those that it would like Congress to address in postal reform legislation. We continue to believe that legislative action is needed to address USPS’s financial challenges, and in the interim, as previously noted, USPS has no current plans to undertake additional major initiatives to achieve significant cost savings in its operations—USPS has previously faced resistance to such efforts from customers and Congress.

Monitoring

USPS continued to monitor its situation through public quarterly and annual financial reports that discuss its financial status and performance, including trends USPS expects to become more pronounced and will significantly impact its current business model. USPS, however, has also reported that it cannot secure its near- or long-term financial outlook without the enactment of targeted postal reform legislation.

Demonstrated Progress

USPS’s actions have demonstrated some progress in achieving cost savings, as noted above. USPS has reported, however, that despite these efforts, statutory restrictions on its business model have left it unable to cover its total costs.

We have issued a number of reports that included strategies and options for USPS to generate revenue, reduce costs, increase the efficiency of its delivery operations, and restructure the funding of pension and retiree health benefits. USPS has already acted on some of these strategies and options. Nonetheless, we have also reported that USPS’s actions alone under its existing authority will be insufficient to achieve sustainable financial viability and that comprehensive legislation is urgently needed to position USPS to be a sustainable entity.

Benefits Achieved by Implementing Our Recommendations

USPS improved the usefulness and transparency of its delivery performance information. USPS updated its website in June 2016 to include trend data for on-time delivery performance for all 67 postal districts beginning in the second quarter of fiscal year 2015 to the current quarter. While this accomplishment will not lead to financial benefits, the updated website will lead to more transparent and effective oversight of delivery performance to hold USPS accountable for meeting its statutory mission to provide service in all areas of the nation. As a result, USPS performance information is easily accessible and Postal stakeholders can determine whether delivery performance is a problem in rural areas.

Congress has taken limited action over the past year to address the need for postal reform including the following:

A January 2016 hearing titled, “Laying out the Reality of the United States Postal Service,” held by the Senate Committee on Homeland Security and Governmental Affairs.

A May 2016 hearing regarding USPS’s ongoing financial challenges held by the House Committee on Oversight and Government Reform.

The House Committee on Oversight and Government Reform approved a bill that addressed some of USPS’s solvency challenges; however, this bill was not enacted.

GAO Contact

For additional information about this high-risk area, contact Lori Rectanus at (202) 512-2834 or rectanusl@gao.gov.

Related GAO Products

U.S. Postal Service: Continuing Financial Challenges and the Need for Postal Reform. GAO-16-651T. Washington, D.C.: May 11, 2016.

U.S. Postal Service: Post Office Changes Suggest Cost Savings, but Improved Guidance, Data, and Analysis Can Inform Future Savings Efforts. GAO-16-385. Washington, D.C.: April 29, 2016.

U.S. Postal Service: Financial Challenges Continue. GAO-16-268T. Washington, D.C.: January 21, 2016.

U.S. Postal Service: Actions Needed to Make Delivery Performance Information More Complete, Useful, and Transparent. GAO-15-756. Washington, D.C.: September 30, 2015.

U.S. Postal Service: Status, Financial Outlook, and Alternative Approaches to Fund Retiree Health Benefits. GAO-13-112. Washington, D.C.: December 4, 2012.

U.S. Postal Service: Strategies and Options to Facilitate Progress toward Financial Viability. GAO-10-455. Washington, D.C.: April 12, 2010.

Management of Federal Oil and Gas Resources

Why Area Is High Risk

The Department of the Interior (Interior) has taken some steps to strengthen how it manages federal oil and gas resources, but has not met the criteria for removal from our High-Risk List. Interior has not implemented four of our recommendations to improve the verification of oil and gas produced from federal leases, and the reasonableness and completeness of royalty data. Management of federal oil and gas resources was added it to the High-Risk List in 2011. We identified challenges in Interior’s management of oil and gas on leased federal lands and waters. We found that Interior (1) lacked reasonable assurance that it was collecting its share of revenue from oil and gas produced on federal lands and waters; (2) continued to experience problems hiring, training, and retaining sufficient staff to oversee and manage oil and gas operations on federal lands and waters; and (3) was undertaking a major reorganization of its oversight of offshore oil and gas management and revenue collection functions. In 2013, after concluding that Interior had fundamentally completed its reorganization, we narrowed the high-risk area to Interior’s revenue collection and human capital challenges. For this update, we are reopening the third segment based on our February 2016 report, in which we found that Interior’s restructuring of the Bureau of Safety and Environmental Enforcement (BSEE) has made limited progress addressing long-standing deficiencies in the bureau’s investigative, environmental compliance, and enforcement capabilities.

Federal oil and gas resources provide an important source of energy for the United States; create jobs in the oil and gas industry; and generate billions of dollars annually in revenues that are shared between federal, state, and tribal governments. Interior reported collecting over $49 billion from fiscal years 2011 through 2015 from royalties and other payments. This makes oil and gas resources one of the federal government’s largest sources of nontax revenue. Moreover, the April 2010 explosion onboard the Deepwater Horizon and subsequent oil spill in the Gulf of Mexico highlighted the importance of Interior’s management of permitting and inspection processes to ensure operational and environmental safety. oversight responsibilities to two new bureaus—the Bureau of Ocean Energy Management (BOEM) and BSEE—and assigning the revenue collection function to a new Office of Natural Resources Revenue (ONRR). BLM did not restructure its management of onshore federal oil and gas activities.

BSEE’s mission is to promote safety, protect the environment, and conserve offshore resources through regulatory oversight and enforcement. It oversees offshore operations, which includes the authority to investigate incidents that occur on the outer continental shelf, monitor operator compliance with environmental stipulations, and take enforcement actions against operators that violate safety or environmental standards. Yet more than 5 years after its creation, BSEE continues to use investigative policies and procedures that predate the Deepwater Horizon explosion. BSEE’s outdated policies and procedures do not require planning investigations, gathering and documenting evidence, and ensuring quality control, potentially undermining the effectiveness of investigations. Moreover, BSEE’s ongoing restructuring of its environmental compliance program reverses steps taken to address post–Deepwater Horizon incident concerns, risking the bureau’s abilities to oversee environmental compliance. Additionally, BSEE did not review its maximum daily civil penalty as required by the Outer Continental Shelf Lands Act.

What GAO Found

management, we are expanding the Management of Federal Oil and Gas Resources high-risk area to again include a segment on Interior’s restructuring of offshore oil and gas oversight.

What Remains to Be Done

Interior has partially met the criteria to address the revenue collection and human capital challenges we identified, and has implemented some of the recommendations we made. However, Interior needs to do more to meet its responsibilities to manage federal oil and gas resources, and to maintain leadership commitment in addressing the remaining four criteria.

Leadership Commitment: To address its human capital challenges, Interior needs to evaluate the effectiveness of incentives such as special salary rates, analyze hiring time data, and evaluate the bureaus’ training programs. To enhance Interior’s oversight of oil and gas development, and fully implement the bureau’s restructuring and effectively oversee offshore oil and gas development, BSEE leadership needs to take several steps, such as completing draft policies outlining the responsibilities of its divisions, and updating and developing procedures to guide them. BSEE leadership also needs to conduct a risk analysis of its environmental compliance program.

Capacity: To address its revenue collection challenges, Interior will need to identify the staffing resources necessary to consistently meet its annual goals for inspecting and verifying oil and gas production. To address its human capital challenges, Interior needs to evaluate whether its efforts to increase compensation paid to key oil and gas staff were effective in hiring and retaining staff. Interior also needs to fully evaluate the bureaus’ training programs and look for potential opportunities to share training resources.

Action Plan: To address its revenue collection challenges, Interior needs to continue its efforts related to its study on automating data collection from production metering systems. To address its human capital challenges, Interior needs to track, monitor, and analyze the effectiveness of the incentives paid to key oil and gas staff. Interior also needs to analyze data from its new human resources software system in order to identify steps in the hiring process that may be causing delays. Regarding training, Interior needs to review training and identify opportunities to share training resources. measured, and that the federal government is collecting an appropriate share of oil and gas revenues. To address its human capital challenges, Interior needs to track and monitor performance metrics for incentive payments and special salary rates, capture accurate data on hiring time from a new human resources software system, and evaluate training programs.

Demonstrated Progress: To address its revenue collection challenges, Interior needs to continue to effectively implement our related recommendations as outlined in the areas above. To address its human capital challenges, Interior must continue to show progress in hiring, retaining, and training its key oil and gas staff.

Additional Details on What GAO Found

Overall, Interior has partially met the criteria for leadership commitment, capacity, action planning, monitoring, and demonstrated progress. All of the 2017 ratings are the same as the 2015 ratings except for leadership commitment, which dropped from met to partially met for the human capital challenges segment, discussed below.

Royalty Determination and Collection

Interior has demonstrated leadership commitment to address revenue collection weaknesses and partially met the remaining four criteria.

Leadership Commitment

Mining Services Group to help identify potentially erroneous data submitted by companies paying royalties. ONRR is also studying whether it can use automated data collection from metering systems to more efficiently obtain oil and gas production data used to determine royalties from companies.

Capacity

Interior’s capacity to address weaknesses in revenue collection is uneven. In recent years, Interior has hired offshore inspection staff to focus primarily on oil and gas measurement inspections. We found in April 2015 that BSEE came close to meeting its annual inspection goals for verifying oil and gas production in the Gulf of Mexico for fiscal years 2009 through 2013. On the other hand, for the same time frame, we found that BLM did not meet its oil and gas production inspection goals, which officials attributed, in part, to insufficient inspection staff.

Action Plan

Interior has plans in place to continue implementing our recommendations aimed at correcting weaknesses in its revenue collection policies and practices. In November 2014, Interior provided a briefing document specifying goals and time frames for several areas related to these weaknesses. For example, in December 2013, we recommended that BLM issue revised regulations to provide it with greater flexibility in setting royalty rates and better ensure that the public receives a fair return from the oil and gas produced from federal leases. In November 2014, Interior stated that it planned to begin addressing this issue in fiscal year 2015 by issuing an advanced notice for proposed rulemaking. In November 2016, Interior amended its regulations to, among other things, allow for greater flexibility in setting royalty rates. Interior’s briefing document also specified other goals and time frames for completing a study on automating data collection from production metering systems, and for establishing procedures on when to periodically assess its fiscal system. Interior completed the latter of these two actions in August 2016.

Monitoring

implemented the guidance. The new guidance outlines criteria for approving “commingling” requests—requests to combine oil or gas from public, state, or private leases prior to royalty measurement—and identifies considerations for determining whether commingling is in the public interest. This includes ensuring that BLM has the ability to verify that production is accurately measured and properly reported. Because it has not scheduled and completed a review of the effectiveness of the new commingling guidance after its implementation, BLM does not have reasonable assurance that its staff are consistently applying the new guidance, and that staff are able to verify production.

Demonstrated Progress

Interior has demonstrated progress addressing weaknesses in its revenue collection policies and practices. As of January 2017, we found that Interior implemented 42 of 46 recommendations we had made since September 2008 addressing revenue collection weaknesses, including those related to oil and gas production verification and royalty data. However, as mentioned above, Interior has not completed reviewing the effectiveness of the new commingling guidance. Additionally, in March 2010, we found that Interior’s production accountability program did not sufficiently address key factors that could affect gas measurement accuracy, and recommended that Interior establish goals for particular types of measurement inspections. Interior agreed with the recommendation, but as of October 2016, it has not fully implemented it. Without completing this action, Interior cannot be assured that oil and gas are being reasonably measured and associated royalty payments are correct.

Human Capital Challenges

Interior has partially met the five criteria below.

Leadership Commitment

The rating for leadership commitment dropped from ‘met’ in 2015 to ‘partially met’ in 2017. In January 2014, we recommended that Interior explore expanding its use of hiring incentives and systematically collect and analyze hiring data. Interior agreed with our recommendations and began to more systematically collect and analyze hiring data to identify causes for delays and expedite the hiring process. In November 2014, Interior senior officials briefed us on planned actions to address the department’s human capital challenges. As of September 2016, however, some of these planned actions had not yet been implemented or completed, as we reported. For example, Interior senior officials told us that they would implement a performance measure framework to evaluate the effectiveness of incentives on a quarterly basis beginning in April 2015. However, as of July 2016, a senior official from the Office of Policy, Management and Budget said these quarterly reviews had not yet begun. had provided limited leadership to facilitate the bureaus sharing training resources. We also reported that BSEE has not implemented a certification program for its inspectors, although the Outer Continental Shelf Safety Oversight Board and Interior Inspector General recommended it in 2010.

Capacity

Interior continues to partially meet this criterion. In 2010, we found that Interior’s bureaus experienced high turnover rates in key oil and gas inspection and engineering positions. In January 2014, we found that Interior’s hiring and retention challenges were largely due to lower salaries and a slow hiring process compared with similar positions in industry. The fiscal year 2012 attrition rate for petroleum engineers at BLM was more than 20 percent, or more than double the average federal attrition rate of 9.1 percent. The attrition rate for other key oil and gas staff was lower, but still a challenge because some field offices had only a few employees in any given position, and a single separation could significantly affect operations. According to Interior officials, these challenges made it more difficult for some field offices to conduct oversight activities, including inspecting production facilities.

Since fiscal year 2012, Interior has increased compensation for certain key oil and gas staff by using special salary rates, incentive payments, and student loan repayments. During fiscal years 2012 through 2016, Interior had special salary rates—authorized by Congress in annual appropriations acts—that allowed it to pay certain staff up to 25 percent more than their basic pay. In addition, some of the bureaus increased compensation through other tools, such as incentive payments and student loan repayments. For example, for fiscal years 2012 through 2014, BLM and BSEE substantially increased the number of employees receiving a retention incentive payment from 14 to 346 employees. During the same period, BSEE and BOEM increased the number of staff receiving a student loan repayment from 25 to 66 employees. Officials from the three bureaus said that anecdotally they know that efforts to increase the compensation paid to key oil and gas staff, along with an industry downturn that reduced private sector hiring, had likely helped them fill vacancies. Outside of these anecdotal observations, however, Interior and the bureaus have not evaluated whether their efforts, and the specific tools they used, were effective in hiring and retaining staff. them information about the overall effectiveness of their training efforts by measuring the effect on staff’s job performance and comparing program benefits to training costs.

Action Plan

Interior continues to partially meet this criterion. Interior does not have a written action plan summarizing how it will address its human capital challenges; however, agency officials have described some actions it plans to take to address these challenges. To evaluate the effectiveness of the agency’s efforts to increase compensation paid to key oil and gas staff, such as the use of incentive payments and special salary rates, officials said in September 2016, that they had developed initial performance metrics and gathered data for the first three quarters of fiscal year 2016. Officials said they would continue to track and monitor the data on a quarterly basis.

To address the lengthy hiring process, officials from the three bureaus said in June 2016 that they had started analyzing data extracted from a new human resources software system in order to identify steps in the hiring process that may be causing delays. Regarding training, a senior Interior official we interviewed told us in January 2016, that their Interior Training Directors Council—composed of senior training officials across Interior—would begin reviewing training across the bureaus and seek to identify opportunities to share training resources. However, as of June 2016, officials had not reported any progress made by the council, and it is unclear what, if any, steps the office has taken to review training and identify opportunities to share training resources. In addition, it is unclear what, if any, actions the agency will take in response to the recommendations we issued in September 2016 directing the agency to develop technical competencies for all key oil and gas staff, and annually evaluate the bureaus’ training programs and viability of a certification program for BSEE inspectors.

Monitoring

Interior continues to partially meet this criterion. Interior and the three bureaus have taken some steps to reduce hiring times, but did not have complete and accurate data to identify the causes of delays in the hiring process. Without reliable data, Interior’s bureaus cannot effectively implement changes to expedite the hiring process. We recommended in January 2014 that Interior systematically collect data on hiring times for key oil and gas positions, ensure the accuracy of the data, and analyze the data to identify the causes of delays and expedite the hiring process. In June 2016, officials from the three bureaus said that they had started analyzing data extracted from a new human resources software system in order to identify steps in the hiring process that may be causing delays.

Once Interior has the systems in place to capture accurate data on hiring, the department will be able to monitor hiring times and the causes of delays in the hiring process.

In addition, Interior officials said in September 2016 that they had developed initial performance metrics to track and monitor on a quarterly basis the effectiveness of incentive payments and special salary rates that the agency has used to try to increase compensation paid to its key oil and gas staff. These officials also said they had gathered data for the first three quarters of fiscal year 2016, and would continue to track and monitor the data on a quarterly basis. However, the agency had not yet used these data to evaluate the effectiveness of incentives. We recommended that Interior regularly evaluate the effectiveness of available incentives, such as special salary rates, the student loan repayment program, and other incentives in hiring and retaining key oil and gas staff.

In regards to training, we reported in September 2016 that Interior had not evaluated training needs or effectiveness as required by law and regulations, according to officials, and we recommended the agency annually evaluate the bureaus’ training programs. We also reported that Interior’s bureaus have not evaluated training needs or effectiveness as directed by departmental policy. We recommended in September 2016 that the agency develop technical competencies for all key oil and gas staff, and annually evaluate the bureaus’ training programs and the viability of a certification program for BSEE inspectors. It is unclear what, if any, actions the agency will take in response to these recommendations.

Demonstrated Progress

Interior continues to partially meet this criterion. In 2015, we reported that Interior and the three bureaus had taken some actions to address these hiring and retention challenges, but had not fully used their existing authorities to supplement salaries and provide other recruitment, relocation, and retention incentives. staff up to 25 percent more than their basic pay. In September 2016, Interior described its plans to collect data on the three incentives and special salary rates in order to measure effectiveness.

Regarding their lengthy hiring process, in January 2014, we reported that Interior records showed that the average time to hire petroleum engineers and inspectors generally exceeded 120 calendar days—much longer than OPM’s target of 80 calendar days. We also found in September 2016 that each of the three bureaus has taken steps to begin to address their lengthy hiring process. In 2015, the three bureaus adopted new human resources software that officials said will provide them with better data to track their hiring process. In June 2016, officials from the three bureaus said that they had started analyzing data extracted from this new system to identify steps in the hiring process that may be causing delays.

Regarding training, we found in March 2010 that Interior had not consistently and appropriately trained offshore inspection and engineering staff. In July 2012, we reported that Interior was creating a new training program for its offshore inspection and engineering staff. However, in September 2015, BSEE inspectors at four local offices told us that the offshore training courses BSEE provided them, which were primarily led by contractors, did not adequately prepare them to perform inspections because the courses focused on how equipment operates, and did not teach them how to inspect the equipment. More broadly, we found in September 2016 that none of the three bureaus had evaluated training needs or effectiveness as directed by departmental policy. Without evaluating its bureaus’ training efforts, Interior may not be able to ensure that its key oil and gas staff are being adequately trained to conduct oversight, and may be ineffectively and inefficiently spending training funds.

Restructuring of Offshore Oil and Gas Oversight

capabilities. Moreover, BSEE’s deficient oversight capabilities continue to undermine its ability to effectively oversee offshore oil and gas development.

Benefits Achieved by Implementing Our Recommendations

In response to recommendations we made in April, 2015, Interior issued updated onshore (1) gas measurement, (2) oil measurement, and (3) oil and gas site security regulations. These new regulations should help ensure that oil and gas produced from federal leases are accurately measured. Accurate measurement is critical for calculating the royalty payments operators pay the government.

In response to a recommendation we made in July 2012, Interior reported that the two bureaus, BOEM and BSEE, jointly approved an information technology plan. This plan, according to Interior documents, is a roadmap that outlines a framework for deploying technology resources throughout the organizations in support of bureau missions, goals, and program priorities.

In response to a recommendation we made in July 2012, BSEE in August 2013 and BOEM in September 2016 issued human capital plans.

In response to a recommendation we made in January 2014, Interior took several actions to bridge the salary gap for key oil and gas oversight staff. Specifically, BLM, BSEE, and BOEM increased the number of staff receiving retention, recruitment, or relocation incentive payments in fiscal year 2014 and in fiscal year 2015 issued guidance describing which staff should receive these incentives. In addition, in September 2016, Interior outlined steps it will take to assess the effectiveness of these incentives by tracking measures such as turnover and acceptance rates.

Interior also implemented recommendations that we identified as priority recommendations to the Secretary of Interior.

In response to a recommendation we made in December 2013, Interior took steps within its authority to revise BLM’s regulations to provide for flexibility to the bureau to make changes to onshore royalty rates, similar to that which is already available for offshore leases, to enhance Interior’s ability to make timely adjustments to the terms for federal onshore leases. fiscal system. These procedures identified generally when such an assessment should be done or what changes in the market or industry would signal that such an assessment should be done.

In response to a recommendation we made in December 2013, the Secretary of the Interior established documented procedures for determining whether and how to adjust lease terms for new offshore leases, including documenting the justification and analysis supporting any adjustments.

GAO Contact

For additional information about this high-risk area, contact Frank Rusco at (202) 512-3841 or ruscof@gao.gov.

Related GAO Products

Oil and Gas Oversight: Interior Has Taken Steps to Address Staff Hiring, Retention, and Training but Needs a More Evaluative and Collaborative Approach. GAO-16-742. Washington, D.C.: September 29, 2016.

Oil and Gas Management: Interior’s Bureau of Safety and Environmental Enforcement has Not Addressed Long-Standing Oversight Deficiencies. GAO-16-245. Washington, D.C.: February 10, 2016.

Oil and Gas Resources: Interior’s Production Verification Efforts and Royalty Data Have Improved, but Further Actions Needed. GAO-15-39. Washington, D.C.: April 7, 2015.

Oil and Gas: Updated Guidance, Increased Coordination, and Comprehensive Data Could Improve BLM’s Management and Oversight. GAO-14-238. Washington, D.C.: May 5, 2014.

Oil and Gas Management: Continued Attention to Interior’s Human Capital Challenges Is Needed. GAO-14-394T. Washington, D.C.: February 27, 2014.

Oil and Gas: Interior Has Begun to Address Hiring and Retention Challenges but Needs to Do More. GAO-14-205. Washington, D.C.: January 31, 2014.

Oil and Gas Resources: Actions Needed for Interior to Better Ensure a Fair Return. GAO-14-50. Washington, D.C.: December 6, 2013.

Oil and Gas Management: Interior’s Reorganization Complete, but Challenges Remain in Implementing New Requirements. GAO-12-423. Washington, D.C.: July 30, 2012.

Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks

Why Area Is High Risk

Climate change is considered by many to be a complex, crosscutting issue that poses risks to many environmental and economic systems and presents a significant financial risk to the federal government. According to the National Research Council (NRC), although the exact details cannot be predicted with certainty, there is clear scientific understanding that climate change poses serious risks to human society and many of the physical and ecological systems upon which society depends. According to the United States Global Change Research Program (USGCRP), among other reported impacts, climate change could threaten coastal areas with rising sea levels, alter agricultural productivity, and increase the costs of severe weather events as these once “rare” events potentially become more common and intense due to climate change. appropriations by the Congressional Research Service, the amount of inflation-adjusted disaster relief per fiscal year increased from a median of $6.2 billion for the years 2000 to 2006, to a median of $9.1 billion for the years 2007 to 2013 (46 percent).

These impacts call attention to areas where government-wide action is needed to reduce fiscal exposure, because, among other roles, the federal government (1) leads a strategic plan that coordinates federal efforts and also informs state, local, and private-sector action; (2) owns or operates extensive infrastructure vulnerable to climate impacts, such as defense facilities and federal property; (3) insures property and crops vulnerable to climate effects; (4) provides data and technical assistance to federal, state, local, and private-sector decision makers responsible for managing the impacts of climate change on their activities; and (5) provides disaster relief aid. As a result, we added Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks to the High-Risk List in 2013. climate can be viewed as an insurance policy against climate change risks.

Furthermore, according to NRC and USGCRP, the nation can reduce its vulnerability by limiting the magnitude of climate change through actions to limit greenhouse gas emissions. We recognize that (1) the federal government has a number of efforts underway to decrease domestic greenhouse gas emissions, and (2) the success of efforts to reduce greenhouse gas emissions depends in large part on cooperative international efforts. However, limiting the federal government’s fiscal exposure to climate change risks will be challenging no matter the outcome of efforts to reduce emissions, in part because greenhouse gases already in the atmosphere will continue altering the climate system for many decades, according to NRC and USGCRP.

What GAO Found

As of December 2016, the federal government has taken additional steps since our 2015 update and partially met four of the five criteria for removal from our High-Risk List—leadership commitment, capacity, action plan, and monitoring. Specifically, the federal government partially met the monitoring criterion, which had been rated not met in the 2015 report, and has taken further action in three criteria that remain partially met— leadership commitment, capacity, and action plan. However, the demonstrated progress criterion remains not met because it is too early to determine whether the federal government has made progress.

Various executive orders (E.O.), task forces, and strategic planning documents identify climate change as a priority and demonstrate leadership commitment. This leadership commitment needs to be sustained and enhanced to address all aspects of the federal fiscal exposure to climate change in a cohesive manner. As we reported in 2015, the federal government has some capacity to address the federal fiscal exposure to climate change. However, across its actions and strategies, the federal government has yet to clearly define the roles, responsibilities, and working relationships among federal, state, local, and private-sector entities, or how these efforts will be funded, staffed, and sustained over time. The federal government has taken further action by establishing a monitoring mechanism to review certain federal agencies’ efforts to reduce some aspects of their fiscal exposure to climate change, such as building efficiency. However, it is too early to determine the new mechanism’s effectiveness at demonstrating progress in implementing corrective measures, or whether the federal government will apply a similar mechanism across all areas of federal fiscal exposure to climate change.

What Remains to Be Done

strategic climate change priorities and develop roles, responsibilities, and working relationships among federal, state, and local entities.

The federal government has had many climate-related strategic planning activities that demonstrated leadership commitment, such as the President’s June 2013 Climate Action Plan and the March 2015 E.O.13693 Planning for Federal Sustainability in the Next Decade. However, it was unclear how the various planning efforts related to each other or whether they amounted to a government-wide approach for reducing federal fiscal exposures. Accordingly, leadership commitment needs to be enhanced, with increased focus on developing a cohesive strategy to reduce fiscal exposure across the full range of related federal activities. Further, the federal government will need to focus on implementing this strategy—by developing measurable goals; identifying the roles, responsibilities, and working relationships among federal, state, and local entities; identifying how such efforts will be funded and staffed over time; and establishing mechanisms to track and monitor progress.

2017 and 2018 budget requests; and (4) actions to achieve the government-wide goals for improving the climate resilience of federal facilities established by E.O. 13693.

Federal flood and crop insurance programs: This entails building climate resilience into the requirements for federal crop and flood insurance programs. Although the Federal Emergency Management Agency (FEMA) has plans to provide updated hazard products and tools that incorporate climate science on an advisory basis, and the U.S. Department of Agriculture (USDA) provides information on voluntary resilience-building actions for producers—policyholders are not required to use the information to improve their resilience and reduce federal fiscal exposure. As such, the federal government needs to address our October 2014 recommendations to incorporate, as appropriate, forward-looking standards into required minimum flood elevation standards for insured properties and long-term agricultural resilience into the allowable agricultural practices required for crop insurance by the federal government.

Technical assistance to federal, state, local, and private-sector decision makers: This involves the Executive Office of the President (EOP) helping federal, state, local, and private sector decision makers access and use the best available climate information by designating a federal entity to (1) develop and periodically update a set of authoritative climate observations and projections for use in federal decision making, which state, local, and private sector decision makers could also access to obtain the best available climate information; and (2) create a national climate information system with defined roles for federal agencies and nonfederal entities, such as academic institutions, with existing statutory authority. Additionally, to assist standards-developing organizations incorporate forward-looking climate information into building codes and other standards, we recommended in November 2016 that the Secretary of Commerce should direct the National Institute of Standards and Technology (NIST) to convene federal agencies for an ongoing effort to provide the best available forward-looking climate information to these standards-developing organizations.

Disaster aid: This involves implementing adequate budgeting and forecasting procedures to account for the costs of disasters. Additionally, the federal government has not yet defined the resources and government-wide structure to implement existing plans for reducing the federal fiscal exposure to disaster relief by improving resilience—with clear roles, responsibilities, and working relationships among federal, state, local, and private-sector entities.

Recognizing that each department and agency operates under its own authorities and responsibilities—and can therefore be expected to address climate change in different ways relevant to its own mission— federal efforts have encouraged a decentralized approach, with federal agencies incorporating climate-related information into their planning, operations, policies, and programs. While individual agency actions are necessary, a centralized national strategy driven by a government-wide plan is also needed to reduce the federal fiscal exposure to climate change, maximize investments, achieve efficiencies, and better position the government for success. Even then, such approaches will not be sufficient unless also coordinated with state, local, and private-sector decisions that drive much of the federal government’s fiscal exposure. The challenge is to develop a cohesive approach at the federal level that also informs state, local, and private-sector action.

The interagency Council on Climate Preparedness and Resilience (Resilience Council) established by E.O. 13653 recommended many of the same actions to future administrations in its October 2016 report Opportunities to Enhance the Nation’s Resilience to Climate Change. Among other actions, the Resilience Council called on the federal government to strengthen resilience coordination across federal agencies and increase the capacity for climate resilience efforts government-wide, expand incentives and requirements to increase resilience of infrastructure and buildings, improve awareness and dissemination of climate information, and enhance the usability of climate tools for decision making. Importantly, the Resilience Council recognized the need to coordinate resilience among multiple stakeholders—including all levels of government, academic institutions, and the private sector—through partnerships, shared knowledge and resources, and coordinated strategies, and to evaluate government-wide progress and performance of resilience investments. These are key elements of our criteria for removal from the High-Risk List.

Additional Details on What GAO Found

Federal Government as Leader of National Climate Strategic Plan

For its climate strategic planning efforts, the federal government partially met four of the five criteria—leadership commitment, capacity, action plan, and monitoring—and received a not met rating for the demonstrating progress criterion. The federal government is not well organized to address the fiscal risks to which climate change exposes it, partly because of the inherently complicated, crosscutting nature of the issue. The federal government would be better positioned to respond to the risks posed by climate change if federal efforts were more coordinated and were directed toward common goals.

As we reported in our 2015 update, the federal government had partially met our leadership commitment, capacity, and action plan criteria through several climate-related strategic planning activities, such as the President’s June 2013 Climate Action Plan and agency adaptation plans, but it was unclear how the various planning efforts related to each other or what they amount to as a government-wide approach for reducing federal fiscal exposures. Additionally, existing planning activities partially met our capacity criterion because they did not clearly define the roles and responsibilities among federal, state, and local entities, or the resources needed to implement these plans. Furthermore, we reported that the federal government had not met our monitoring and demonstrated progress criteria because there were no programs to monitor the effectiveness of strategic planning efforts. among other things, address resilience planning in coordination with state, local, and tribal communities. Additionally, in April 2016, CEQ and OMB issued a joint memo that expands their annual review of agency adaptation plans, to include agency self-assessments and annual, in- person discussions with OMB and CEQ to evaluate certain agencies’ progress implementing their adaptation plans. Furthermore, the October 2016 report Opportunities to Enhance the Nation’s Resilience to Climate Change from the interagency Resilience Council identified a set of key opportunities to guide sustained and coordinated action among federal agencies and invited stakeholders to work with these agencies on a shared climate resilience agenda.

For its strategic planning efforts, the federal government’s ratings are as follows.

Leadership Commitment

The federal government has partially met this criterion and has taken additional steps since our last high-risk update. Specifically, E.O. 13693 continues to demonstrate leadership commitment by establishing a government-wide approach and long-term goals for reducing some aspects of federal fiscal exposure to climate change. Further, the October 2016 Resilience Council report identified key opportunities to guide sustained and coordinated action among federal agencies and invited stakeholders to advance a shared climate resilience agenda. However, the EOP has yet to implement our May 2011 recommendation to clearly establish federal strategic climate change priorities that take into consideration the full range of climate-related activities within the federal government. Additionally, because of the potential long-term effects of climate change, leadership needs to be sustained well into the future.

Capacity

specified federal agencies to convene regional interagency working groups to, among other things, address resilience planning in coordination with state, local, and tribal communities. Further, the October 2016 Resilience Council report identifies opportunities to enhance capacity within the federal government and in local communities, among others. However, neither the October 2016 Resilience Council report nor the July 2015 E.O. 13693 implementing guidance specifically addresses the roles and responsibilities among federal, state, and local entities. Furthermore, neither the Resilience Council report nor the E.O. 13693 implementing guidance indicates how these efforts will be funded, staffed, and sustained over time.

Action Plan

The federal government has partially met this criterion and has taken additional steps since our last high-risk update. In particular, the implementing guidance for E.O. 13693 directs agencies to annually measure and report their progress on, among other things, reducing greenhouse gas emissions and incorporating climate-resilient design into new agency buildings in their strategic sustainability performance plans, starting in June 2016. Additionally, the October 2016 Resilience Council report identified key opportunities that future administrations could take to improve climate resilience across three themes: (1) advancing and applying science-based information, technology, and tools to address climate risk; (2) integrating climate resilience into federal agency missions, operations, and culture; and (3) supporting community efforts to enhance climate resilience. However, it is too early to determine how effective agency strategic sustainability performance plans under E.O. 13693 will be at reducing aspects of the federal fiscal exposure to climate change. Moreover, the October 2016 Resilience Council report provides a broad overview of key opportunities to improve climate resilience, but does not require implementation of specific actions to address these opportunities. As a result, it is unclear to what extent the Resilience Council report will help the government substantially complete actions to reduce federal fiscal exposure to climate change across the entire range of related federal activities.

Monitoring

responsible for implementing E.O. 13693 to advise OMB and CEQ on agencies’ performance of their E.O. responsibilities. Furthermore, the April 2016 joint CEQ and OMB memo established a monitoring mechanism to evaluate agencies’ progress on implementing their adaptation plans. However, it is too early to determine the effectiveness of the monitoring mechanisms. Additionally, the federal government has yet to establish a monitoring mechanism that addresses reducing federal fiscal exposure to climate change across the entire range of related federal activities.

Demonstrated Progress

The federal government has not met the criterion for demonstrating progress. Fiscal year 2016 is the first year agencies will include addressing aspects of fiscal exposure to climate change as part of the annual strategic sustainability performance plan process under E.O. 13693. Therefore, it is too early to determine whether the federal government has demonstrated progress. Additionally, E.O. 13693 does not address reducing federal fiscal exposure to climate change across the entire range of related federal activities, such as federal disaster aid programs.

Federal Government as Property Owner

For its role as property owner, the federal government partially met four of the five criteria—leadership commitment, capacity, action plan, and monitoring—and received a not met rating for the demonstrating progress criterion. The federal government owns and operates hundreds of thousands of facilities and manages millions of acres of land that could be affected by climate change. For example, DOD oversees more than 555,000 defense facilities and 28 million acres of land, with a replacement value DOD estimates at close to $850 billion. Federally funded and managed energy and water infrastructure, and federally managed land— about 650 million acres—are also vulnerable to changes in the climate, including more frequent and severe droughts and wildfires. For example, in a November 2016 assessment of federal fiscal risks related to climate change, OMB and the Council of Economic Advisers (CEA) reported that 18,000 facilities and structures with a replacement value of about $83 billion were in the 100-year floodplain and susceptible to future changes in flood risk. Further, OMB and CEA reported that annual federal wildland fire suppression expenditures could increase by about $2.3 billion by 2090.

As of our 2015 update, the federal government had partially met the criteria for leadership commitment, capacity, and action plan through various directives for agencies to develop climate change adaptation plans to integrate consideration of climate change into agency operations and missions, but leadership needed to be sustained over time and most agencies had yet to identify specific actions and the resources necessary to implement these plans. Additionally, we reported that the federal government had not met our monitoring and demonstrated progress criteria because there were no programs to monitor the effectiveness and sustainability of agency adaptation plans. federal projects. Moreover, DOD had yet to implement our May 2014 recommendations to develop a plan for completing climate change vulnerability assessments and clarifying how to account for climate change in planning as well as when comparing construction projects for funding.

Since our 2015 update, the federal government has made progress on our April 2013 NEPA recommendation, the May 2014 DOD recommendations, and in other areas. Specifically, in August 2016, CEQ issued final guidance for agencies on how to consider the effects of climate change when implementing NEPA. Also, among other actions responsive to our May 2014 recommendations, DOD issued a January 2016 directive on climate change adaptation and resilience that calls for DOD components to assess and manage climate change risks to build DOD’s resilience, when developing plans and implementing procedures.

In addition, the March 2015 E.O.13693 directed certain agencies to develop and annually update agency strategic sustainability performance plans, which, among other things, evaluate past performance toward achieving certain government wide sustainability performance goals— including incorporating climate-resilient design and management elements into the operation, repair, and renovation of existing agency buildings and the design of new agency buildings. Finally, the April 2016 joint CEQ and OMB memo expanded their annual review of agency adaptation plans to include agency self-assessments and annual, in- person discussions with OMB and CEQ to evaluate agencies’ progress implementing their adaptation plans.

Further, in July 2015, we reported that the January 2015 E.O. 13690, Establishing a Federal Flood Risk Management Standard and a Process for Further Soliciting and Considering Stakeholder Input requires all future federal investments in, and affecting, floodplains to meet a certain elevation level, as established by the standard. According to E.O.

13690, implementing the standard will ensure that agencies address current and future flood risk and ensure that projects funded with taxpayer dollars last as long as intended. Furthermore, since June 2015, OMB Circular A-11—government-wide guidance to agencies for developing their annual budgets—has directed agencies to include funding for resilience in construction and renovation of federal facilities in their fiscal year 2017 and 2018 budget requests, although the 2018 budget requests have not been finalized.

For its role as property owner, the federal government’s ratings are as follows.

Leadership Commitment

The rating for this criterion remains at partially met, but the federal government has taken additional steps since our 2015 update. E.O. 13693 and E.O.13690 reflect continued leadership commitment by establishing a government-wide approach for reducing fiscal exposure to climate change for federal facilities and federally-funded infrastructure in and affecting floodplains. However, because of the potential long-term effects of climate change, leadership needs to be sustained well into the future.

Capacity

The rating for this criterion remains at partially met, but the federal government has taken additional steps since our 2015 update. Under E.O. 13693 agencies must, where life-cycle cost effective, incorporate climate-resilient design and management elements into agency building operation, renovation, and design of new buildings. Furthermore, OMB’s revised Circular A-11 directs agencies to include funding for resilience in construction and renovation of federal facilities in their fiscal year 2017 and 2018 budget requests—although the budget requests for fiscal year 2018 have not been finalized. Moreover, the August 2016 CEQ final guidance for agencies on how to consider climate change when implementing NEPA may increase the consistency with which agencies address climate change in implementing the law. However, it is too early to determine whether these efforts will effectively build the capacity of the federal government to reduce its fiscal exposure as a property owner.

Action Plan

Standard. Moreover, DOD fully implemented one of our May 2014 recommendations by developing a plan and milestones for completing climate change vulnerability assessments. DOD has also made progress implementing components of our other recommendations for considering climate change impacts when planning installations and comparing construction projects for funding. However, it is too early to determine whether these plans will effectively reduce federal facilities’ fiscal exposure to climate change.

Monitoring

The rating for this criterion was upgraded from not met in our 2015 update to partially met. E.O. 13693 establishes a mechanism for OMB and an interagency steering committee to monitor agency progress toward sustainability goals—which include incorporation of climate-resilient design and management elements into the operation, repair and renovation of existing agency buildings. Additionally, the April 2016 joint CEQ and OMB memo to federal agencies established a monitoring mechanism to evaluate agencies’ efforts to implement their adaptation plans as part of their annual reviews of the plans. However, it is too early to determine the effectiveness of these monitoring mechanisms.

Demonstrated Progress

The federal government has not met the criterion for demonstrating progress. Fiscal year 2016 is the first year agencies will include “incorporating climate resilient design and management elements” as a measurable goal within their annual strategic sustainability performance plan under E.O. 13693. In addition, fiscal year 2017 is the first year of agencies’ implementation plans for the Federal Flood Risk Management Standard. Therefore, it is too early to determine whether the federal government has demonstrated progress.

Federal Insurance Programs

As the insurer of crops and property, the federal government partially met three of the five criteria—leadership commitment, capacity, and action plan—and received a not met rating for the monitoring and demonstrating progress criteria. Two important federal insurance efforts— the FEMA National Flood Insurance Program (NFIP) and USDA’s Federal Crop Insurance Corporation (FCIC)—face climate change and other challenges that increase federal fiscal exposure and send inaccurate price signals about risk to policyholders. For example, a November 2016 OMB and CEA report found that total annual premium subsidies for crop insurance could increase by about $4.2 billion in 2080 due to the effects of unmitigated climate change.

In our 2015 update, we reported that the federal government had partially met our leadership commitment criterion by commissioning climate change studies and incorporating climate change adaptation into their planning, which recognized climate change risks to federal insurers, but needed to sustain top leadership support and enhance it over time. We also reported that the federal government had not met the other four criteria because federal insurers had yet to identify specific actions and the resources necessary to address challenges inherent to federal insurance programs—such as how to encourage policyholders to reduce their long-term exposure to climate change given the short-term nature of insurance contracts—that may impede the ability of these programs to minimize long-term federal fiscal exposure to climate change. climate change. USDA did not specify its agreement or disagreement with our recommendation.

Since our 2015 update, FEMA and USDA have taken additional actions to understand and respond to climate change risks. For flood insurance, in February 2016, FEMA publicly released the 2015 Future Conditions Risk Assessment and Modeling report by the Technical Mapping Advisory Council (TMAC)—an advisory body created to review the national flood mapping program and make recommendations to FEMA. The report, which was required by law, has several recommendations on how FEMA could incorporate the best-available climate science to assess flood risk and incorporate such information into its advisory hazard products, tools, and information for local decision makers. For crop insurance, in May 2016, USDA publicly issued Building Blocks for Climate Smart Agriculture and Forestry: Implementation Plan and Progress Report for USDA’s framework for helping farmers, ranchers, and forestland owners respond to climate change, through voluntary and incentive-based actions.

For its role as the insurer of crops and property, the federal government’s ratings are as follows.

Leadership Commitment

Blocks for Climate Smart Agriculture and Forestry implementation plan continues leadership commitment by establishing long-term goals for reducing agricultural GHG emissions by improving producers’ soil health, nitrogen management, and land management practices, among others— practices that may also reduce federal fiscal exposure for insured crops by improving agricultural resilience to climate change. However, because of the potential long-term effects of climate change, leadership needs to be sustained well into the future.

Capacity

The rating for this criterion was upgraded from not met in our 2015 update to partially met. For flood insurance, a senior FEMA official has publicly stated that the agency will engage with stakeholders and partners to implement the recommendations of the TMAC report on incorporating climate science into its products and tools for decision makers. Additionally, the agency has begun conducting sea level rise pilot studies and work to identify related research gaps for additional pilot studies, according to the FEMA official. If FEMA implements the TMAC recommendations, it could improve climate change–related decision making capacity at federal, state, and local levels. For crop insurance, through its 2016 implementation plan, USDA has identified lead agencies and potential partnerships with public and private sector organizations to implement certain actions that could also improve agriculture’s resilience to climate change. Additionally, the USDA Regional Climate Hubs—which deliver science-based knowledge, practical information, and program support to farmers, ranchers, and forest landowners—may help improve producers’ capacity to understand and respond to climate change impacts. However, neither FEMA nor USDA has identified the resources necessary to implement the actions outlined in the TMAC report or USDA’s implementation plan. Additionally FEMA has not identified the roles, responsibilities, and working relationships among federal, state, and local entities for its effort to incorporate climate science into its products and tools.

Action Plan

actions to address aspects of climate change in federal insurance programs and have made these actions publicly available. In particular, for flood insurance, the publicly available TMAC report identified short- and long-term actions to incorporate climate change science into its products and tools for decision makers. However, FEMA has yet to establish milestones and metrics for implementing the recommendations—although a senior FEMA official stated that the agency plans to do so. For crop insurance, in its 2016 publicly available report, USDA has developed clear milestones and metrics to assess its progress implementing certain actions that could also improve agricultural resilience to climate change. However, neither federal insurance program has taken action to implement our October 2014 recommendations to improve the long-term resiliency of insured structures and crops—through changes to flood insurance standards or allowable growing practices for crop insurance.

Monitoring

The rating for this criterion remains at not met, but the federal government has taken some steps since our 2015 update. For crop insurance, USDA established milestones for certain actions from 2016 to 2018 in its 2016 implementation plan, and the plan indicates that USDA is developing a framework to estimate the adoption of conservation practices and technologies. However, it is unclear from the plan what mechanisms are in place for USDA to assess its overall progress toward the department- wide goals, or the frequency of assessment. For flood insurance, FEMA has yet to establish metrics and milestones within an action plan to monitor its progress implementing the TMAC recommendations for addressing climate change in flood insurance.

Demonstrated Progress

The federal government has not met the criterion for demonstrating progress. Without clear monitoring mechanisms for FEMA and USDA to assess their overall progress addressing aspects of climate change in federal insurance programs, it is unclear how either agency will be able to demonstrate progress. Additionally, FEMA has indicated that—consistent with the TMAC recommendations—it should provide its updated hazard products and tools that incorporate climate science on an advisory—not regulatory—basis. USDA has also framed its resilience-building actions for producers as voluntary. As a result, it is unclear to what extent policyholders in either federal insurance program will use the information provided to improve their resilience and reduce federal fiscal exposure.

Technical Assistance to Federal, State, Local, and Private-Sector Decision Makers

As the provider of technical assistance, the federal government partially met two of the five criteria—leadership commitment and action plan—and received a not met rating for the capacity, monitoring, and demonstrating progress criteria. Climate change has the potential to directly affect a wide range of federal services, operations, programs, and assets, as well as national security, increasing federal fiscal exposure in many ways. State, local, and private-sector decision makers can also drive federal climate-related fiscal exposures because they are responsible for planning, constructing, and maintaining certain types of vulnerable infrastructure paid for with federal funds, insured by federal programs, or eligible for federal disaster assistance. To reduce fiscal exposure, the federal government has a role to play in providing information to these decision makers so they can make more informed choices about how to manage the risks posed by climate change.

As reported in our 2015 update, the federal government had partially met our leadership commitment and action plan criteria through various strategic plans and E.O.s that directed certain federal agencies to work together to provide authoritative and readily accessible climate-related information, but the roles, responsibilities, and working relationships among federal, state, local, and private-sector entities were still unclear. We also reported that the federal government had not met our criteria for capacity, monitoring, and demonstrated progress because the resources and government-wide structure necessary to implement plans were not yet defined, and that because no monitoring programs existed, the ability to demonstrate progress was limited. to identify the best available climate-related information for state and local infrastructure planning.

Since our 2015 update, we have completed work related to federal climate-related technical assistance across several areas—including federal supply chain climate risk; government-wide options to provide climate information to federal, state, local, and private sector decision makers; fisheries management; and private sector use of climate information in design standards and building codes—and found that although the federal government had taken some steps, additional efforts are needed to address the High-Risk List criteria. As a result, the federal government’s ratings for the High-Risk List criteria under technical assistance have not changed. of such effects for specific fish stocks. Lastly, in November 2016, we reported on the use of climate information in design standards and building codes and found that standards-developing organizations such as professional engineering societies generally use historical data to develop standards and face institutional and technical challenges to using forward-looking climate information, including difficulty identifying the best available climate information. We found that government-wide coordination to help address these challenges could present a benefit by reducing the federal fiscal exposure to the effects of climate change.

For its efforts to provide technical assistance, the federal government’s ratings are as follows.

Leadership Commitment

The rating for this criterion remains at partially met. Top leadership support for providing climate-related technical assistance has continued since 2009 through various E.O.s and planning documents, such as the President’s June 2013 Climate Action Plan, the U.S. Global Change Research Program’s 2012-2021 strategic plan for climate change science, and, more recently, the October 2016 Resilience Council report. However, because of the potential long-term effects of climate change, leadership needs to be sustained well into the future.

Capacity

agencies and nonfederal entities with existing statutory authority. The EOP did not agree or disagree with this recommendation.

We also recently recommended that the EOP and other agencies provide guidance to help federal agencies and others use climate information. Specifically, in October 2015, we recommended that, within the EOP, the CEQ clarify the guidance to federal agencies on developing adaptation plans, to better assist agencies to include climate-related risks to their supply chains in their plans. CEQ agreed with this recommendation and implemented it in April 2016 by issuing a joint memo with OMB which, among other things, clarified the guidance to federal agencies for the November 2013 E.O. 13653 on Preparing the United States for the Impacts of Climate Change. Specifically, the joint memo directs agencies to include climate-related risks to supply chains in agency adaptation plans. In September 2016, we recommended that the Secretary of Commerce direct the National Marine Fisheries Service to develop guidance on how fisheries managers should incorporate climate information into different parts of the fisheries management process, such as fish stock assessments. Commerce agreed with this recommendation, but has yet to implement it. Lastly, in November 2016, we reported on using climate information in design standards and building codes. We found that standards-developing organizations, such as professional engineering societies, do not generally use forward-looking climate information and that they face institutional and technical challenges to doing so, including difficulty identifying the best available climate information. We also found that government-wide coordination to help address these challenges could present a benefit by reducing the federal fiscal exposure to the effects of climate change, and recommended that the Department of Commerce’s NIST convene federal agencies for an ongoing effort to provide the best available forward- looking climate information to standards-developing organizations. The Department of Commerce neither agreed nor disagreed with our recommendation. Implementing these recommendations would improve the federal government’s capacity as a provider of technical assistance.

Action Plan

plans and an E.O. that directed certain federal agencies to work together to develop and provide authoritative, easily accessible and useable information on climate preparedness and resilience. Additionally, the October 2016 Resilience Council report identified several opportunities to improve aspects of federal technical assistance government-wide, such as making climate tools easier for decision makers to use. However, existing plans and reports do not amount to a government-wide plan with clear milestones and metrics to address the challenges we’ve identified related to the federal government’s role in providing climate-related technical assistance, and government and private sector decision makers accessing and using such information.

Monitoring

The rating for this criterion remains at not met. The April 2016 joint memo by CEQ and OMB clarifies the process to monitor progress for certain agencies on several areas, including technical assistance. However, there are still no programs or mechanisms to monitor government-wide progress in addressing the challenges we’ve identified related to the federal government’s role in providing climate-related technical assistance. These challenges include clarifying the roles, responsibilities, and working relationships among federal, state, local, and private-sector entities; identifying the necessary resources and establishing the government-wide structure necessary to implement plans; and addressing the fragmentation of federal climate information across individual agencies that use the information in different ways to meet their missions.

Demonstrated Progress

The rating for this criterion remains at not met. Without a program or mechanism to monitor government-wide action addressing relevant challenges, it is unclear how the federal government can demonstrate progress.

Disaster Aid and Resilience

As the provider of disaster aid, the federal government partially met two of the five criteria—leadership commitment, and capacity—and received a not met rating for the action plan, monitoring, and demonstrating progress criteria. Multiple factors, including increased disaster declarations, climate change effects, and changing development patterns increase federal fiscal exposure to severe weather events, which have cost the nation hundreds of billions of dollars over the past decade. For example, from fiscal years 2005 through 2014, the federal government obligated at least $277.6 billion across 17 federal department and agencies for disaster assistance programs and activities. Such federal disaster aid functions as the insurance of last resort in certain circumstances because whatever is not covered by insurance or built to be resilient to extreme weather increases the federal government’s implicit fiscal exposure through disaster relief programs. For example, a November 2016 OMB and CEA report found that total annual expected disaster relief for hurricane damage could increase by about $50 billion by 2075. the risk of facing a large fiscal exposure at any time. Moreover, fiscal constraints would make it more difficult for the federal government to respond effectively in the future and such expenses could affect resources available for other key government programs.

Since our 2015 update, the federal government has made some progress addressing its federal fiscal exposure to disaster relief by improving resilience. Specifically, in our July 2015 report that examined disaster resilience efforts following Hurricane Sandy, we found that the President and Congress had taken multiple steps to enhance the federal government’s focus on disaster resilience through E.O.s, presidential policy directives, and enacted legislation. For example, we reported that E.O. 13690, Establishing a Federal Flood Risk Management Standard and a Process for Further Soliciting and Considering Stakeholder Input requires all future federal investments in, and affecting, floodplains to meet a certain elevation level, as established by the standard. Specifically, the standard provides 3 approaches that federal agencies can now use to establish the flood elevation and floodplain for consideration in their decision making: (1) climate-informed science approach, (2) adding 2-3 feet of elevation to the 100-year floodplain, and (3) using the 500-year floodplain. lifelines—such as communications, energy, transportation, and water management systems. As a result, we recommended that the Mitigation Framework Leadership Group (MitFLG)—an intergovernmental body to help coordinate hazard mitigation efforts of relevant local, state, tribal, and federal organizations—establish an investment strategy to identify, prioritize, and implement federal investments in disaster resilience.

As part of its response to this priority recommendation, FEMA developed a high-level work plan to guide MitFLG’s development of a disaster resilience investment strategy. Additionally, in May 2016, MitFLG solicited stakeholder input on its design of a new Federal Mitigation Investment Strategy. According to MitFLG, the strategy will identify, prioritize, and guide federal investments in disaster resilience and hazard mitigation- related activities and include recommendations to the President and Congress on how the nation should prioritize future investments. Additionally, the October 2016 Resilience Council report identified several opportunities to further integrate climate resilience into federal agency missions and improve federal support for communities’ resilience-building efforts, such as expanding incentives and requirements to increase the resilience of infrastructure and building communities’ capacity for climate resilience efforts.

For its role as the provider of disaster aid, the federal government’s ratings are as follows.

Leadership Commitment

The rating for this criterion remains at partially met. Top leadership has sustained support since 2009 through various E.O.s, such as E.O. 13690, and other documents, such as the October 2016 report on opportunities to enhance the nation’s resilience. However, because of the potential long-term effects of climate change, leadership needs to be sustained well into the future.

Capacity

identified three potential options for determining how a state, territory, or tribal government qualifies for federal disaster assistance. Additionally, in January 2016, FEMA solicited comments on implementing individualized deductibles for states, territories, and Indian tribes to qualify for disaster assistance under its Public Assistance program. FEMA is considering requiring states, territories, and Indian tribes to demonstrate satisfaction of a predetermined level of financial or other commitment before FEMA would provide financial assistance to them through this program. As of October 2016, FEMA was considering comments received on its proposal. Further, in March 2015, FEMA updated its guidance for state hazard mitigation plans to include a summary of the likelihood of future hazard events and changing future conditions, such as climate change, as a condition for receiving certain types of non-emergency disaster assistance. However, the federal government has yet to implement adequate budgeting and forecasting procedures to account for the costs of disasters. Additionally, the federal government has not yet defined the resources and government-wide structure to implement existing plans for reducing the federal fiscal exposure by improving resilience—with clear roles, responsibilities, and working relationships among federal, state, local, and private-sector entities.

Action Plan

The rating for this criterion remains at not met. As we mentioned previously, the federal government has taken steps to develop an action plan for improving resilience through developing the Federal Mitigation Investment Strategy. However, because a draft of this strategy is not yet available, it is too soon to evaluate it as an action plan to address federal fiscal exposure through disaster aid. Additionally, although the October 2016 Resilience Council report identifies several opportunities to improve federal and local climate resilience, it does not meet several action plan characteristics from our high-risk criterion, such as establishing goals and performance measures, developing a plan with clear milestones and metrics, and ensuring there are processes for reporting results, among others. As a result, it is unclear to what extent the October 2016 report will help the government substantially complete actions to reduce federal fiscal exposure to climate change as the provider of disaster aid.

Monitoring

The rating for this criterion remains at not met. The federal government has yet to implement programs or mechanisms to monitor the effectiveness of the measures identified across existing plans and standards.

Demonstrated Progress

plans and standards, the federal government cannot demonstrate progress in implementing corrective measures.

Benefits Achieved by Implementing Our Recommendations

In response to a recommendation we made in May 2014, the Office of the Secretary of Defense (OSD) and the services took a number of actions from September 2014 to July 2015 to develop a project plan and milestones for completing DOD’s screening-level climate change vulnerability assessment. OSD also took action to direct the services to develop plans and milestones that describe how they intend to use the data collected through the assessment to support climate change adaptation planning. By implementing our recommendation, OSD and the services can now inform the department’s decision makers about the vulnerabilities of DOD facilities and missions to the potential impacts of climate change. (GAO-14-446)

In response to a recommendation we made in October 2015, CEQ and OMB issued an April 2016 joint memo on climate adaptation planning that clarified the guidance for E.O. 13653 to include climate- related risks to supply chains in agency adaptation plans, among other things. (GAO-16-32)

GAO Contact

For additional information about this high-risk area, contact Alfredo Gómez Director, Natural Resources and Environment, (202)512-3841 or gomezj@gao.gov.

Related GAO Products

Climate Change: Improved Federal Coordination Could Facilitate Use of Forward-Looking Climate Information in Design Standards, Building Codes, and Certification. GAO-17-3. Washington, D.C.: November 30, 2016.

Federal Fisheries Management: Additional Actions Could Advance Efforts to Incorporate Climate Information into Management Decisions. GAO-16-827. Washington, D.C.: September 28, 2016.

Federal Disaster Assistance: Federal Departments and Agencies Obligated at Least $277.6 Billion during Fiscal Years 2005 through 2014. GAO-16-797. Washington, D.C.: September 22, 2016.

Polar Weather Satellites: NOAA Is Working to Ensure Continuity but Needs to Quickly Address Information Security Weaknesses and Future Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.

Climate Information: A National System Could Help Federal, State, Local, and Private Sector Decision Makers Use Climate Information. GAO-16-37. Washington, D.C.: December 8, 2015.

Federal Supply Chains: Opportunities to Improve the Management of Climate-Related Risks. GAO-16-32. Washington, D.C.: October 27, 2015.

Hurricane Sandy: An Investment Strategy Could Help the Federal Government Enhance National Resilience for Future Disasters. GAO-15-515. Washington, D.C.: July 30, 2015.

Climate Change: Better Management of Exposure to Potential Future Losses Is Needed for Federal Flood and Crop Insurance. GAO-15-28. Washington, D.C.: November 20, 2014.

Climate Change Adaptation: DOD Can Improve Infrastructure Planning and Processes to Better Account for Potential Impacts, GAO-14-446. Washington, D.C.: May 30, 2014.

Improving the Management of IT Acquisitions and Operations

Why Area Is High Risk

Although the executive branch has undertaken numerous initiatives to better manage the more than $80 billion that is annually invested in information technology (IT), federal IT investments too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. We have previously testified that the federal government has spent billions of dollars on failed IT investments. These investments often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies have not consistently applied best practices that are critical to successfully acquiring IT. In this regard, we have identified nine critical factors underlying successful major acquisitions, such as program officials actively engaging with stakeholders and staff having the necessary knowledge and skills.

Nonetheless, agencies continue to have IT projects that perform poorly. Such projects have often used a “big bang” approach—that is, projects are broadly scoped and aim to deliver functionality several years after initiation. According to the Defense Science Board, this approach is often too long, ineffective, and unaccommodating of the rapid evolution of IT. Further, it is inconsistent with Office of Management and Budget (OMB) guidance directing that IT investments deliver functionality in 6-month increments. In August 2016, we reported that approximately half of the software projects across selected agencies were following this guidance.

Federal IT projects have also failed due to a lack of oversight and governance. Executive-level governance and oversight across the government has often been ineffective, specifically from chief information officers (CIO). However, we have reported that some CIOs’ authority is limited in that not all CIOs have the authority to review and approve the entire agency IT portfolio.

Recognizing the severity of issues related to the government-wide management of IT, in December 2014, Congress enacted IT acquisition reform provisions (commonly referred to as the Federal Information Technology Acquisition Reform Act or FITARA) as part of the Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015. Among other things, the law requires action to: (1) consolidate federal data centers, (2) enhance transparency and improve risk management, (3) enhance agency CIO authority, (4) review IT investment portfolios, (5) expand training and use of IT acquisition cadres, (6) purchase software government-wide, and (7) maximize the benefit of federal strategic sourcing.

What GAO Found

OMB and federal agencies’ efforts to improve the management of IT acquisitions and operations have resulted in meeting one of the five criteria for removal from our High-Risk List—leadership commitment— and partially meeting the remaining four criteria—capacity, action plan, monitoring, and demonstrated progress. Specifically, OMB, in its leadership role in addressing this high-risk area, has demonstrated its commitment by issuing guidance for agencies implementing FITARA, optimizing federal data centers, and acquiring and managing software licenses. investments by fully implementing the CIO authorities described in FITARA and ensuring that program staff have the necessary knowledge and skills to acquire IT. Further work is also needed to establish action plans to modernize or replace obsolete IT investments. Regarding monitoring of IT investments, agencies need to improve how their CIOs assess investment risk and how they report incremental development status. Finally, additional demonstrated progress is needed by OMB and agencies to (1) address our open recommendations related to IT acquisitions and operations, (2) deliver functionality every 12 months on major acquisitions, and (3) achieve planned IT portfolio and data center consolidation savings.

What Remains to Be Done

To help address the management of IT investments, OMB and federal agencies should continue to expeditiously implement the requirements of FITARA. While OMB’s June 2015 FITARA implementation guidance provides a solid foundation for implementing the law and addresses the actions agencies are to take in regard to several initiatives that we have identified as high risk, OMB will need to provide consistent oversight to ensure that agency actions are completed and the desired results are achieved. Doing so should continue to improve the transparency and management of IT acquisitions and operations, as well as increase the authority of CIOs to provide needed direction and oversight.

Beyond implementing FITARA and OMB’s guidance to improve the capacity to address our high-risk area, selected agencies will also need to implement our recent recommendations related to improving their IT workforce planning practices. When fully implemented, these key practices should better position agencies to efficiently make decisions that cross lines of expertise and improve their ability to assess and address gaps in knowledge and skills that are critical to the success of major IT acquisitions.

Further, agencies will need to establish action plans to modernize or replace obsolete IT investments. By establishing such plans, agencies can reduce the risk of continuing to maintain investments that have outlived their effectiveness and are consuming resources that outweigh their benefits.

To improve how they monitor the acquisition and operations of IT investments, federal agencies will need to implement our recommendations to address weaknesses in their reporting of investment risk and incremental development implementation on the IT Dashboard. Doing so will provide OMB and agencies with increased transparency and oversight of the government’s billions of dollars in IT investments.

Finally, initial progress has been made in addressing this high-risk area, including implementation of 46 percent of our prior recommendations. However, the remaining recommendations include 17 priority recommendations to agencies to, among other things, report all data center consolidation cost savings to OMB, address weaknesses in their management of software licenses, and improve their implementation of PortfolioStat. OMB and agencies need to take additional actions to (1) implement at least 80 percent of our recommendations related to the management of IT acquisitions and operations, (2) ensure that a minimum of 80 percent of the government’s major acquisitions deliver functionality every 12 months, and (3) achieve at least 80 percent of the over $6 billion in planned PortfolioStat savings and 80 percent of the more than $5 billion in savings planned for data center consolidation. It will be important for OMB and agencies to continue to make demonstrated progress against these metrics in order to more effectively and efficiently invest in IT, reduce the risk of major acquisitions, and achieve additional cost savings.

Additional Details on What GAO Found

Leadership Commitment

OMB and the Federal CIO have demonstrated leadership commitment. Specifically, OMB’s June 2015 guidance for implementing FITARA addresses actions for agencies to take in several IT management areas we have identified as high risk, such as reviewing of poorly performing investments, reporting on investment risk, consolidating data centers, managing agencies’ IT portfolios, and purchasing government-wide software licenses. For example, OMB’s guidance reiterates the requirement for agencies to hold TechStat sessions—face-to-face meetings between OMB and agency leadership to terminate or turn around IT investments that are failing or are not producing results—and also requires agencies to report quarterly on the root causes of performance issues, to develop corrective action plans, and to establish a timeline for implementing the corrective actions.

OMB also released more specific guidance on acquiring and managing software licenses and operating federal data centers—two areas that we identified in our 2015 high-risk report as needing attention. Specifically, in June 2016, OMB issued guidance that requires agencies to maintain and analyze an agency-wide inventory of software licenses to ensure compliance with software licensing agreements, consolidate redundant applications, and identify other cost savings opportunities. Regarding federal data centers, in August 2016, OMB issued a memorandum that established the Data Center Optimization Initiative, noting that this new initiative would supersede the Federal Data Center Consolidation Initiative started in 2010. Among other things, OMB’s guidance requires agencies to develop and report on data center strategies to consolidate inefficient infrastructure, optimize existing facilities, improve security posture, save money, and transition to more efficient infrastructure. OMB’s memorandum also establishes metrics for data center optimization and targets to be achieved by the end of fiscal year 2018.

In addition, the Federal CIO and OMB senior staff members have routinely met with us over the last 2 years to discuss their plans and progress in addressing this high-risk area. According to these officials, and as indicated through its actions, OMB is committed to demonstrating sustained progress in addressing this high-risk area. Going forward, it will be important for OMB to maintain its current level of top leadership support and commitment to ensure that agencies continue to successfully execute OMB’s guidance on implementing FITARA and related IT initiatives.

Capacity

OMB and federal agencies partially met the criterion for having the capacity to improve the management of IT acquisitions and operations. Specifically, OMB’s June 2015 guidance addresses how agencies are to implement FITARA’s provisions related to enhancing the authority of federal CIOs. Among other things, OMB provided direction on enabling the CIOs’ role to integrate IT with the capabilities they support wherever IT may affect functions, missions, or operations; strengthening agency CIOs’ accountability for IT cost, schedule, performance, and security; and strengthening the relationship between agency CIOs and bureau CIOs.

Further, OMB’s guidance includes several actions that agencies are to take to establish a basic set of roles and responsibilities (referred to as the “common baseline”) for CIOs and other senior agency officials that are needed to implement the authorities described in the law. For example, agencies are to conduct a self-assessment to identify where they conform to the common baseline and where they deviate. OMB guidance also requires agencies to annually update their self-assessment and report their progress reaching FITARA implementation milestones. Agencies’ first updates were due by April 30, 2016, and additional updates are due on an annual basis thereafter. As of December 2016, 19 of 24 major federal agencies had made their FITARA milestone status information publicly available, as required by OMB; however, all 19 agencies had milestones that were still in progress or not yet started.

In addition, another area where agencies can improve their capacity to acquire IT investments is in assessing IT workforce skills gaps.

Specifically, in November 2016, we reported that five selected agencies had not consistently applied key workforce planning steps and activities that help to ensure that program staff members have the knowledge and skills critical to successfully acquire IT investments. For example, four agencies had not demonstrated an established IT workforce planning process. The weaknesses identified were due, in part, to agencies lacking comprehensive policies that required such activities, or failing to apply the policies to IT workforce planning. We concluded that, until these weaknesses are addressed, the agencies risk not adequately assessing and addressing gaps in knowledge and skills that are critical to the success of major acquisitions. Accordingly, we recommended that the five selected agencies address the IT workforce planning practices that we identified as having weaknesses.

Action Plan

OMB and federal agencies have partially met the criterion for establishing an action plan to address this high-risk area. In addition to requiring agencies to conduct self-assessments, OMB’s June 2015 FITARA implementation guidance required agencies to submit a plan describing the changes they will make to ensure that common baseline responsibilities are implemented. These plans are to address the areas of IT management that we have identified as high risk, such as reviewing poorly performing investments, managing agencies’ IT portfolios, and implementing incremental development. For example, according to OMB’s June 2015 guidance, agencies’ plans are required to define IT processes and policies which ensure that the CIO certifies that IT investments are adequately implementing incremental development. consistently meet OMB’s FITARA implementation deadlines going forward. Further, effectively implementing these plans will be critical to ensuring that agencies are able to effectively manage their IT investments and that CIOs have the authorities required under FITARA. We have ongoing work reviewing agency self-assessments and FITARA implementation plans, including the extent to which agencies have defined the role of the CIO in accordance with federal law and guidance.

Significant work also remains for federal agencies to establish action plans to modernize or replace obsolete IT investments. Specifically, in May 2016, we reported that many agencies were using systems which had components that were, in some cases, at least 50 years old. For example, we determined that the Department of Defense (DOD) was using 8-inch floppy disks in a legacy system that coordinates the operational functions of the nation’s nuclear forces. In addition, the Department of the Treasury was using assembly language code—a computer language initially used in the 1950s and typically tied to the hardware for which it was developed. Table 5 provides examples of legacy systems across the federal government that agencies report are 30 years old or older and use obsolete software or hardware, and identifies those that do not have specific plans with time frames to modernize or replace these investments.

To address this issue, we recommended that 12 agencies identify and plan to modernize or replace legacy systems, including establishing time frames, activities to be performed, and functions to be replaced or enhanced. Most agencies agreed with our recommendations or had no comment.

Monitoring

OMB and federal agencies have partially met the criterion for monitoring efforts to address this high-risk area. Specifically, OMB took action to improve its use of TechStat sessions, which are intended to increase accountability and transparency and to improve investment performance. We previously reported that the number of TechStats that OMB and selected agencies had performed represented only a small percentage (33 percent) of the number of IT investments with a medium- or high-risk CIO rating. OMB’s June 2015 FITARA implementation guidance strengthened the TechStat process by requiring agencies to hold a TechStat session on any investment that has a high-risk CIO rating for 3 consecutive months, beginning on July 1, 2015. As a result, OMB and agencies will be able to more quickly intervene to turn around, halt, or terminate troubled IT projects. government-wide and agency-specific progress towards meeting applicable optimization targets, and cumulative cost savings and cost avoidance realized.

OMB’s efforts to expand the IT Dashboard should continue to increase transparency into government-wide and agency-specific progress on this important IT initiative.

However, significant work still remains for federal agencies to improve their monitoring of IT investments through their CIO risk assessments on the IT Dashboard. Specifically, in June 2016, we reported that our assessments of the risk ratings showed more risk than did the associated CIO ratings. In particular, of the 95 investments reviewed, our assessments matched the CIO ratings 22 times, showed more risk 60 times, and showed less risk 13 times. Figure 10 summarizes how our assessments compared to the select investments’ CIO ratings. in IT are not receiving the appropriate levels of oversight. Accordingly, we made 25 recommendations to 15 agencies to improve the quality and frequency of their CIO ratings. Most agencies agreed with our recommendations or had no comment.

Another area of concern regarding the monitoring of IT acquisitions is agencies’ reported use of incremental development. In August 2016, we reported on 7 selected agencies’ software development projects and determined that the percentage delivering functionality every 6 months was reported at 45 percent for fiscal year 2015 and planned for 54 percent in fiscal year 2016. However, significant differences existed between the delivery rates that the agencies reported to us and what they reported on the IT Dashboard. For example, the percentage of software projects delivering every 6 months that was reported to us by the Department of Commerce was about a 42 percentage point decrease from what was reported on the IT Dashboard. In contrast, DOD reported to us a 55 percentage point increase from what was reported on the IT Dashboard. Figure 11 compares what the 7 agencies reported on the IT Dashboard and what numbers they reported to us.

Improving the Management of IT Acquisitions and Operations The Department of Defense did not provide requested information in time to verify the information reported for a sample of projects.

We reported that the significant differences in delivery rates were due, in part, to agencies having different interpretations of OMB’s guidance on reporting software development projects and because the information reported to us was generally more current than the information reported on the IT Dashboard. We concluded that, until the inconsistences in the information reported to us versus the information provided on the IT Dashboard are addressed, the seven agencies we reviewed are at risk that OMB and key stakeholders may make decisions regarding agency investments without the most current and accurate information. Accordingly, we made 12 recommendations to 8 agencies to improve their reporting of incremental data on the IT Dashboard, among other things. Most agencies agreed with our recommendations or did not comment.

Demonstrated Progress

OMB and federal agencies partially met the criterion for demonstrating progress in improving the management of IT acquisitions and operations. In our 2015 high-risk report, we noted that OMB and agencies would need to demonstrate government-wide progress in the following key areas:

OMB and agencies should, within 4 years, implement at least 80 percent of our recommendations related to managing IT acquisitions and operations.

Agencies should ensure that a minimum of 80 percent of the government’s major acquisitions deliver functionality every 12 months.

Agencies should achieve no less than 80 percent of the over $6 billion in planned IT portfolio savings and 80 percent of the more than $5 billion in savings planned for data center consolidation.

Between fiscal years 2010 and 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations, including many to improve the implementation of the recent initiatives and other government-wide, cross-cutting efforts. As of December 2016, about 46 percent of these recommendations had been fully implemented. This is an additional 23 percent compared to the percentage we reported in our 2015 high-risk report. For example, in August 2016, the National Aeronautics and Space Administration (NASA) addressed our priority recommendation to report its data center consolidation cost savings and avoidances—totaling approximately $42 million between fiscal years 2012 through 2016—to OMB. In fiscal year 2016, we made 202 new recommendations, thus further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations. Table 6 summarizes OMB’s and agencies’ implementation of our recommendations. Following the table, figure 12 summarizes OMB’s and agencies’ implementation of our recommendations against the 80 percent target. functions. In November 2013, we reported that agencies continued to identify duplicative spending as part of PortfolioStat; however, weaknesses existed in agencies’ implementation of the initiative, such as limitations in the CIOs’ authority. In April 2015, we reported that, although agencies had achieved approximately $1.1 billion in PortfolioStat savings, inconsistencies in OMB’s and agencies’ reporting made it difficult to reliably measure progress in achieving savings. In total, our 2 reports made 69 recommendations to improve OMB and agencies’ implementation of PortfolioStat; and as of December 2016, 7 of our recommendations had been implemented.

In addition, while agencies have made progress on efforts to ensure that the government’s major acquisitions deliver functionality every 12 months, additional work is needed. Specifically, in August 2016, we determined that 7 selected agencies reported delivering functionality at least every 12 months on 77 percent of their projects for fiscal year 2015. However, as previously stated, there were also inconsistencies with the selected agencies’ reporting of their incremental development status and we made recommendations to the agencies to address these issues. It will be critical for agencies to continue to improve their use of incremental development in order to reduce the risk that their projects will not meet cost, schedule, and performance goals and improve their reporting to better ensure that project decision making is based on current and accurate information. operational IT investments. Regarding the $6 billion in planned PortfolioStat savings identified in our 2015 high-risk report, agencies reported achieving approximately $1.4 billion in savings from fiscal years 2012 through 2015, or approximately 24 percent of planned PortfolioStat savings. Further, in March 2016, we reported that agencies had achieved an estimated $2.8 billion in cost savings and avoidances related to their data center consolidation efforts from fiscal years 2011 to 2015. This is approximately 51 percent of the $5.3 billion planned savings identified in our 2015 high-risk report.

Benefits Achieved by Implementing Our Recommendations

In July 2016, Congress enacted the MEGABYTE Act of 2016, which contained provisions to improve the management of software licenses. The act requires OMB to direct agency CIOs to, among other things, establish a comprehensive inventory of software license agreements and analyze software usage and other data to make cost-effective decisions.

GAO Contact

For additional information about this high-risk area, contact David A. Powner at (202) 512-9286 or pownerd@gao.gov or Carol Harris at (202) 512-4456 or harrisc@gao.gov.

Related GAO Products

IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; Selected Departments Need to Assess Skill Gaps. GAO-17-8. Washington, D.C.: November 30, 2016.

Information Technology: Agencies Need to Improve Their Application Inventories to Achieve Additional Savings. GAO-16-511. Washington, D.C.: September 29, 2016.

Information Technology Reform: Agencies Need to Increase Their Use of Incremental Development Practices. GAO-16-469. Washington, D.C.: August 16, 2016.

Digital Service Programs: Assessing Results and Coordinating with Chief Information Officers Can Improve Delivery of Federal Projects. GAO-16-602. Washington, D.C.: August 15, 2016.

Information Technology: Better Management of Interdependencies between Programs Supporting 2020 Census Is Needed. GAO-16-623. Washington, D.C.: August 9, 2016.

IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their Major Investments. GAO-16-494. Washington, D.C.: June 2, 2016.

Information Technology: Federal Agencies Need to Address Aging Legacy Systems, GAO-16-468. Washington, D.C.: May 25, 2016.

DOD Major Automated Information Systems: Improvements Can Be Made in Reporting Critical Changes and Clarifying Leadership Responsibility. GAO-16-336. Washington, D.C.: March 30, 2016.

Data Center Consolidation: Agencies Making Progress, but Planned Savings Goals Need to Be Established . GAO-16-323. Washington, D.C.: March 3, 2016.

Information Technology Reform: Billions of Dollars in Savings Have Been Realized, but Agencies Need to Complete Reinvestment Plans. GAO-15-617. Washington, D.C.: September 15, 2015.

Improving Federal Management of Programs that Serve Tribes and Their Members

Why Area Is High Risk

For nearly a decade, we, along with inspectors general, special commissions, and others, have reported that federal agencies have ineffectively administered Indian education and health care programs and inefficiently fulfilled their responsibilities for managing the development of Indian energy resources. In particular, we have found numerous challenges facing the Department of the Interior’s (Interior) Bureau of Indian Education (BIE) and Bureau of Indian Affairs (BIA)—both under the Office of the Assistant Secretary for Indian Affairs (Indian Affairs)—and the Department of Health and Human Services’ (HHS) Indian Health Service (IHS), in administering education and health care services, which put the health and safety of American Indians served by these programs at risk. These challenges included poor conditions at BIE school facilities that endangered students and inadequate oversight of health care that hindered IHS’s ability to ensure quality care to Indian communities. In addition, we have reported that BIA mismanages Indian energy resources held in trust and thereby limits opportunities for tribes and their members to use those resources to create economic benefits and improve the well- being of their communities.

Congress recently noted, “through treaties, statutes, and historical relations with Indian tribes, the United States has undertaken a unique trust responsibility to protect and support Indian tribes and Indians.” In light of this unique trust responsibility and concerns about the federal government ineffectively administering Indian education and health care programs and mismanaging Indian energy resources, we are adding these programs as a high-risk issue because they uniquely affect tribal nations and their members.

What GAO Found

Federal agencies have ineffectively administered and implemented Indian education and health care programs and mismanaged Indian energy resources in the following broad areas: (1) oversight of federal activities; (2) collaboration and communication; (3) federal workforce planning; (4) equipment, technology, and infrastructure; and (5) federal agencies’ data. Although federal agencies have taken some actions to address the 41 recommendations we made related to Indian programs, there are currently 39 that have yet to be fully resolved.

What Remains to Be Done

We plan to continue monitoring federal efforts to address the 39 recommendations that have yet to be fully resolved. To this end, we have ongoing work focusing on accountability for safe schools and school construction and tribal control of energy delivery, management, and resource development.

Education

In the past 3 years, we issued 3 reports on challenges with Indian Affairs’ management of BIE schools in which we made 13 recommendations. Eleven recommendations below remain open.

To help ensure that BIE schools provide safe and healthy facilities for students and staff, we made 4 recommendations which remain open, including that Indian Affairs ensure the inspection information it collects on BIE schools is complete and accurate; develop a plan to build schools’ capacity to promptly address safety and health deficiencies; and consistently monitor whether BIE schools have established required safety committees.

To help ensure that BIE conducts more effective oversight of school spending, we made 4 recommendations which remain open, including that Indian Affairs develop a workforce plan to ensure that BIE has the staff to effectively oversee school spending; put in place written procedures and a risk-based approach to guide BIE in overseeing school spending; and improve information sharing to support the oversight of BIE school spending.

To help ensure that Indian Affairs improves how it manages Indian education, we made 5 recommendations. Three recommendations remain open, including that Indian Affairs develop a strategic plan for BIE that includes goals and performance measures for how its offices are fulfilling their responsibilities to provide BIE with support; revise Indian Affairs’ strategic workforce plan to ensure that BIA regional offices have an appropriate number of staff with the right skills to support BIE schools in their regions; and develop and implement decision-making procedures for BIE to improve accountability for BIE schools.

Health Care

IHS beneficiaries through the Patient Protection and Affordable Care Act (PPACA) have on PRC funds, we recommend that IHS concurrently develop potential options to streamline requirements for program eligibility.

To help ensure successful outreach efforts regarding PPACA coverage expansions, we recommend that IHS realign current resources and personnel to increase capacity to deal with enrollment in Medicaid and the exchanges and prepare for increased billing to these payers.

If payments for physician and other nonhospital services are capped, we recommend that IHS monitor patient access to these services.

To help ensure a more equitable allocation of funds per capita across areas, we recommended that Congress consider requiring IHS to develop and use a new method for allocating PRC funds. To make IHS’s allocation of PRC program funds more equitable, we recommended that IHS develop (1) written policies and procedures to require area offices to notify IHS when changes are made to the allocation of funds to PRC programs; (2) use actual counts of PRC users in any formula allocating PRC funds that relies on the number of active users; and (3) use variations in levels of available hospital services, rather than just the existence of a qualifying hospital, in any formula for allocating PRC funds that contain a hospital access component.

To develop more accurate data for estimating the funds needed for the PRC program and improve IHS oversight, we recommended that IHS develop a written policy documenting how it evaluates need for the PRC program, and disseminate it to area offices so they understand how unfunded services data are used to estimate overall program needs. We also recommend that IHS develop written guidance for PRC programs outlining a process to use when funds are depleted but recipients continue to need services.

Energy

In the past 2 years, we issued 3 reports on developing Indian energy resources in which we made 14 recommendations to BIA. All recommendations remain open.

To help ensure BIA can verify ownership in a timely manner and identify resources available for development, we made 2 recommendations, including that Interior take steps to improve its geographic information system mapping capabilities.

To help ensure BIA’s review process is efficient and transparent, we made 2 recommendations, including that Interior take steps to develop a documented process to track review and response times for energy-related documents that must be approved before tribes can develop energy resources.

To help improve clarity of tribal energy resource agreement regulations, we recommended BIA provide additional guidance to tribes on provisions that tribes have identified to Interior as unclear.

To help ensure that BIA’s effort to streamline the review and approval process for revenue-sharing agreements achieves its objectives, we made 3 recommendations, including that Interior establish time frames for the review and approval of Indian revenue-sharing agreements for oil and gas, and establish a system for tracking and monitoring the review and approval process to determine whether time frames are met.

To help improve efficiencies in the federal regulatory process, we made 4 recommendations, including that BIA take steps to coordinate with other regulatory agencies so the Indian Energy Service Center can serve as a single point of contact or lead agency to navigate the regulatory process.

To help ensure that it has a workforce with the right skills, appropriately aligned to meet the agency’s goals and tribal priorities, we made 2 recommendations, including that BIA establish a documented process for assessing BIA’s workforce composition at agency offices.

Congressional Actions Needed

It is critical that Congress maintain its focus on improving the effectiveness with which federal agencies meet their responsibilities to serve tribes and their members. Since 2013, we testified at 6 hearings to address significant weaknesses we found in the federal management of programs that serve tribes and their members. Sustained congressional attention to these issues will highlight the challenges discussed here and could facilitate federal actions to improve Indian education and health care programs and the development of Indian energy resources.

Additional Details on What GAO Found

Indian Education

Indian Affairs, through BIE, is responsible for providing quality education opportunities to Indian students and oversees 185 elementary and secondary schools that serve approximately 41,000 students on or near Indian reservations in 23 states, often in rural areas and small towns. About two-thirds of these schools are operated by tribes, primarily through federal grants, and about one-third are operated directly by BIE. BIE’s Indian education programs originate from the federal government’s trust responsibility to Indian tribes, a responsibility established in federal statutes, treaties, court decisions, and executive actions. It is the policy of the United States to fulfill this trust responsibility for educating Indian children by working with tribes to ensure that education programs are of the highest quality and that children are provided a safe and healthy environment in which to learn.

Students attending BIE schools generally must be members of federally recognized Indian tribes, or descendants of members of such tribes, and reside on or near federal Indian reservations. All BIE schools—both tribally- and BIE-operated—receive almost all of their operational funding from federal sources, namely, Interior and the Department of Education, totaling about $1.2 billion in 2016. Indian Affairs considers many BIE schools to be in poor condition.

BIE is primarily responsible for its schools’ educational functions, while their administrative functions—such as safety, facilities, and property management—are divided mainly between two other Indian Affairs’ offices, BIA and the Office of the Deputy Assistant Secretary of Management. However, frequent turnover of leadership in these offices has hampered efforts to improve Indian education over the years. For example, in September 2013, we reported that from 2000 through 2013 there were repeated changes in the tenure of acting and permanent assistant secretaries of Indian Affairs as well as acting and permanent directors of BIE. Since that time, leadership turnover has continued in these offices. For example, in March 2016, the previous BIE director was removed for violating federal hiring practices. ensure that its regional offices annually inspect the safety and health of all BIE school campuses, as required, or that the information it collects through inspections is complete and accurate, and we recommended that it take such actions. Specifically, we found that Indian Affairs did not conduct annual inspections at about 1 in 3 BIE schools from fiscal years 2012 through 2015. Further, 4 out of 10 regions did not conduct any inspections during this period. We also found that Indian Affairs did not systematically evaluate the thoroughness of the school safety inspections it conducted or monitor the extent to which inspection procedures varied within and across regions. Without Indian Affairs monitoring whether safety inspectors in each of its regions are consistently following appropriate procedures and guidance, inspections in different regions may continue to vary in completeness and miss important safety and health deficiencies at schools that could pose dangers to students and staff. In September 2016, Indian Affairs provided documentation that it had conducted fiscal year 2016 annual safety inspections at all BIE schools, but it did not include evidence that it had taken steps to ensure that its inspection information was complete and accurate. As of January 2017, we had not received further updates from Indian Affairs. We will continue to monitor its efforts in this area.

In a February 2015 testimony, we reported that Indian Affairs did not consistently oversee some BIE school construction projects. For example, we found that at 1 BIE school Indian Affairs managed a $3.5 million project to replace roofs, but the new roofs had leaked continually since they were installed, causing mold and ceiling damage in classrooms, according to agency documents. At another school, Indian Affairs funded construction of a $1.5 million building for school bus maintenance and bus storage, but the size of the building did not allow a large school bus to fit on the lift when the exterior door was closed. documentation demonstrating it has developed a system for overseeing Department of Education formula grants provided to BIE schools to provide services for children with special needs and to expand and improve educational programs for students from low-income families. However, Indian Affairs was unable to provide documentation showing that it has developed written procedures to oversee funds BIE schools receive from their largest funding source— Interior’s Indian School Equalization Program. Further, as of late September 2016, BIE still had not hired additional staff to oversee school spending, among other duties.

Indian Affairs also reported that it developed a risk-based approach to oversee BIE school expenditures, but we found it has not taken steps to fully implement this approach. Specifically, Interior reported that its risk- based approach was to post schools’ single audits on a website to enable officials responsible for fiscal monitoring to be able to target those at greatest risk of misusing federal funds. However, in reviewing the site, we found that audits for fewer than half of the schools had been posted on the site during each of the past 2 fiscal years. Access to all or at least the vast majority of these audits is critical for Indian Affairs to be able to conduct risk-based fiscal monitoring activities.

Limited federal workforce planning. We have found limited workforce planning in several key areas related to BIE schools. In a February 2015 testimony, we noted that the capacity of Indian Affairs and BIE school staff to address school facility needs is limited due to gaps in expertise, steady declines in staffing levels, and limited institutional knowledge. that the agency develop a comprehensive workforce plan to ensure that BIE has an adequate number of staff with the requisite knowledge and skills to effectively oversee BIE school expenditures. Interior agreed to implement this recommendation, but as of January 2017, it had not provided documentation that it had done so.

In a September 2013 report, we found that Indian Affairs could not ensure that staffing levels at Indian Affairs’ regional offices were adjusted to meet the needs of BIE schools in regions with varying numbers of schools, ranging from 2 to 65, because it had not updated its strategic workforce plan. We recommended that Indian Affairs revise its strategic workforce plan to ensure that its employees providing administrative support to BIE are placed in the appropriate offices to ensure that regions with a large number of schools have sufficient support. Indian Affairs agreed to implement this recommendation. In September 2016, Interior provided us with a revised workforce plan for Indian Affairs. However, this plan did not include information about the workforce needs related to the Indian Affairs offices that provide administrative support to BIE and its schools and therefore did not address the recommendation. As of January 2017, we had not received further updates from Indian Affairs. We will continue to monitor its efforts in this area.

Outdated and deteriorating equipment, technology, and infrastructure. Aging BIE school facilities and equipment contribute to degraded and unsafe conditions for students and staff. In a March 2016 report, we found at one school 7 boilers that failed inspection because of multiple high-risk safety deficiencies, including elevated levels of carbon monoxide and a natural gas leak. Four of the boilers were located in a student dormitory, and 3 were located in classroom buildings. All but one of the boilers were about 50 years old. While the poor condition of the boilers posed an imminent danger to the safety of students and staff, most of the boilers were not repaired until about 8 months after failing their inspection, prolonging safety risks to students and staff.

In a February 2015 testimony, we reported that BIE schools face a variety of challenges with their facilities, such as aging buildings and problems that result from years of deferred maintenance. For example, at one school built in 1959 we observed extensive cracks in concrete block walls and supports, which a BIA official said resulted from a shifting foundation. report, we found that Indian Affairs lacks sound information on safety and health conditions of all BIE schools. Specifically, we found that its nationwide information on safety and health deficiencies at schools is not complete and accurate because of key weaknesses in its inspection program. Without inspection information that is complete and accurate, Indian Affairs cannot effectively determine the magnitude and severity of safety and health deficiencies at schools. As a result, it cannot ensure BIE school facilities are safe for students and staff and currently meet safety and health requirements. We recommended that Indian Affairs take steps to ensure that the inspection information it collects on BIE schools is complete and accurate, among other things. As of January 2017, the agency had not provided documentation that it had done so.

In a February 2015 testimony, we reported that issues with the quality of data on BIE school conditions—such as inconsistent data entry by schools and insufficient quality controls—makes it difficult to determine the actual number of schools in poor condition and undermines Indian Affairs’ ability to effectively track and address problems at school facilities.

Indian Health Care

The Indian Health Service (IHS), an agency within HHS, is charged with providing health care to approximately 2.2 million Indians. In fiscal year 2016, IHS allocated about $1.9 billion for health services provided by federally and tribally operated hospitals, health centers, and health stations. Federally operated facilities provide mostly primary and emergency care, in addition to some ancillary or specialty services. The federally operated system consists of 26 hospitals, 56 health centers, and 32 health stations. IHS hospitals range in size from 4 to 133 beds. exacerbate the severity of a patient’s condition and necessitate more intensive treatment.

PPACA expanded or created new health care coverage options that may benefit Indians, including a state option to expand Medicaid eligibility to individuals with incomes at or below 138 percent of the federal poverty level (FPL), federal premium tax credits for individuals obtaining insurance through health insurance exchanges with incomes between 100 and 400 percent of the FPL, and cost sharing exemptions for Indians who are members of federally recognized tribes with incomes at or below 300 percent of the FPL who purchase insurance through the exchanges. In September 2013, we estimated that PPACA’s new coverage options may allow hundreds of thousands of Indians to obtain health care benefits for which they were not previously eligible, assuming all states expanded their Medicaid programs. We reported that, if Indians enroll in one of these options and choose to receive care through IHS, increased revenue from third party payers such as Medicaid could free up IHS resources and help alleviate pressure on the IHS budget.

Inadequate oversight of federal activities. IHS provides inadequate oversight of health care, both of its federally operated facilities and through the PRC program. In January 2017, we reported that IHS provided limited and inconsistent oversight of the quality of care provided in its federally operated facilities. As a result, the agency cannot ensure that patients receive quality care. IHS has recently finalized a quality framework designed to address these deficiencies and improve its oversight. We recommended that, as part of implementing the quality framework, IHS ensure that agency-wide standards for the quality of care provided in its federally operated facilities are developed, and that facility performance in meeting these standards is systematically monitored over time. HHS agreed with our recommendation and cited steps it already has underway to improve the quality of care in IHS’s federally-operated facilities. HHS described the development of the IHS Quality Framework and Implementation Plan released in November 2016. However, as of January 2017, IHS has not developed agency-wide standards for the quality of care provided in its federally operated facilities. weeks for an initial exam with a family medicine physician, and new patients in internal medicine may wait 3 to 4 months for an initial exam.

IHS has delegated this responsibility to its area offices and has not conducted any systematic, agency-wide oversight of the timeliness of primary care. Without these standards, IHS cannot know whether it is providing sufficient primary care to meet the needs of its patients. We recommended that IHS develop and communicate specific agency-wide standards for patient wait times in federally operated facilities, monitor patient wait times, and take corrective actions when standards are not met. HHS stated that it agreed with the need to improve patient wait times at IHS federally-operated facilities to ensure that primary care is available and accessible to Indians. HHS described its plan to establish an Office of Quality Health Care at IHS Headquarters to provide for national policy and oversight of critical quality improvement strategies and ensure their success and accountability. As of January 2017, IHS has not established the Office of Quality Health Care, and has not developed agency-wide standards for patient wait times in federally operated facilities. specified allocation formula that may vary across areas. Neither bill became law.

Ineffective collaboration and limited communication. In a June 2012 report, we found that IHS does not require its area offices to inform IHS headquarters if they distribute program increase funds to local PRC programs using different criteria than the PRC allocation formula suggested by headquarters. As a result, IHS may be unaware of additional funding variation across areas. We recommended that IHS develop written policies and procedures to require area offices to notify IHS when they diverge from the formula for allocating funds to PRC programs. HHS concurred with this recommendation and noted that guidance requiring area offices to report these changes to IHS headquarters would be added to the PRC manual, but did not specify a date for doing so. As of January 2017, IHS has not added this guidance to the manual.

Limited federal workforce planning. In a March 2016 report, we reported that IHS officials told us that an insufficient workforce was the biggest impediment to ensuring patients could access timely primary care. According to IHS’s 2016 budget justification, there were over 1,550 vacancies for health care professionals throughout the IHS health care system including: physicians, dentists, nurses, pharmacists, physician assistants, and nurse practitioners. According to IHS officials, staffing vacancies have created obstacles for facilities working to provide primary care.

In September 2013, we found that IHS did not have an effective plan in place to ensure that sufficient staff would be in place to assist with increased enrollment and third party billing under expanded Medicaid or the exchanges beginning in 2014 under PPACA. Without a plan, IHS may not be able to ensure that a sufficient number of staff are available to assist with enrollment and to process increased third-party payments. We recommended that IHS realign current resources and personnel to increase capacity to assist with these efforts. HHS neither agreed nor disagreed with this recommendation. As of January 2017, IHS has not implemented this recommendation. facility, and some PRC program officials noted that their number of staff was below these standards, contributing to delays in determining eligibility for the program and processing payments to providers. We recommended that IHS use available PRC funds to pay for PRC program staff. HHS disagreed with this recommendation, stating its intent to use PRC funds to pay only for services, not staff, since PRC funding was not sufficient to pay for all needed services. We acknowledged the difficult challenges and choices faced by PRC programs when program funds are not available to pay for all needed services, but maintained that without using funds to pay for staff, some PRC programs would continue to have staffing levels below IHS’s staffing standards model, which contributes to delays in administering the program. As of January 2017, IHS has not implemented this recommendation.

Outdated and deteriorating equipment, technology, and infrastructure. In March 2016, we reported that IHS officials told us that access to timely primary care at some health care facilities serving Indian communities is hindered by outdated medical and telecommunications equipment, such as analog mammography machines and telephones with an insufficient number of lines for scheduling patient appointments.

Incomplete and inaccurate data. In a June 2012 report, we found that IHS officials do not believe that its PRC program data are complete or that areas collect these data in the same manner. Without accurate data, IHS cannot know if the proportion of actual PRC users is consistent across areas. We made three recommendations to improve the accuracy of the PRC data for future allocations, including using actual counts of PRC users, using variation in levels of available hospital services in the funding formula, and, as mentioned above, requiring area offices to notify headquarters when they diverge from the formula for allocating funds to PRC programs. HHS did not concur with our recommendation to use actual counts of PRC users, rather than all IHS users, in any formula for allocating PRC funds that relies on the number of active users, stating that IHS’s combined count of all users is intended to reflect the health care needs of PRC users. HHS concurred with our recommendation that IHS use variations in levels of available hospital services to allocate PRC funds. As of January 2017, IHS has not implemented these recommendations. that IHS take steps to improve its ability to measure timeliness by modifying its claims data system to distinguish between two types of referrals and establish separate timeframe targets for each type. HHS concurred with this recommendation, but as of January 2017, IHS has not implemented it.

Indian Energy Resources

Developing energy resources is vital for the livelihood and long-term economic wellbeing of some Indian tribes and their members. More specifically, energy development provides opportunities to improve poor living conditions and decrease high levels of poverty. Tribes and their members determine how to use Indian energy resources to meet the needs of the community. However, if the resources are held in trust or restricted status, BIA—through its 12 regional offices, 85 agency offices, and other supporting offices—generally must review and approve leases, permits, and other documents required to develop the resources. In 2014, in response to tribal requests for increased coordination and efficient management of their resources from the numerous federal regulatory agencies involved with Indian energy development, Interior took initial steps to form a new office, the Indian Energy Service Center (Service Center)—with BIA as the lead agency. According to Interior’s fiscal year 2016 budget justification, the Service Center is intended to, among other things, help expedite the leasing and permitting processes associated with Indian energy development. we reviewed identified that BIA’s review and approval process can be lengthy and increase development costs and project development times, resulting in missed development opportunities, lost revenue, and jeopardized viability of projects. For example, according to a tribal official, BIA took as long as 8 years to review some of its energy-related documents. In the meantime, the tribe estimates it lost $95 million in revenues it could have earned from tribal permitting fees, oil and gas severance taxes, and royalties. In another example, one lease for a proposed utility-scale wind project took BIA more than 3 years to review and approve. According to a tribal official, the long review time has contributed to uncertainty about the continued viability of the project because data used to support the economic feasibility and environmental impact of the project became too old to accurately reflect current conditions. We recommended that Interior direct BIA to develop a documented process to track its review and response times. In response, Interior stated it would try to implement a tracking and monitoring mechanism by the end of fiscal year 2017 for oil and gas leases. However, it did not indicate whether it intends to track and monitor its review of other energy-related documents that must be approved before tribes can develop resources. Without comprehensively tracking and monitoring its review process, BIA cannot ensure that documents are moving forward in a timely manner, and lengthy review times may continue to contribute to lost revenue and missed development opportunities for Indian tribes.

In a June 2016 report, we found that BIA took steps to improve its process for reviewing revenue-sharing agreements, but still had not established a systematic mechanism for monitoring or tracking. With respect to revenue sharing agreements, we recommended, among other things, that BIA develop a systematic mechanism for tracking these agreements through the review and approval process. Interior concurred with these recommendations and stated that BIA will develop such a mechanism and in the meantime use a centralized tracking spreadsheet. serve as a single point of contact for permitting requirements. Without serving in these capacities, the Service Center will be limited in its ability to improve efficiencies in the federal regulatory process. We also found that in forming the Service Center, BIA did not involve key stakeholders, such as the Department of Energy—an agency with significant energy expertise—and BIA employees from agency offices. By not involving key stakeholders, BIA has missed an opportunity to incorporate their expertise into its efforts. We recommended that BIA include other regulatory agencies in the Service Center so that it can act as a single point of contact or a lead agency to coordinate and navigate the regulatory process. We also recommended BIA establish formal agreements with key stakeholders, such as DOE, that identify the advisory or support role of the office, and establish a process for seeking and obtaining input from key stakeholders, such as BIA employees, on the Service Center activities. Interior agreed with our recommendations and described plans to address them.

In 2005, Congress provided an option for tribes to enter into an agreement with the Secretary of the Interior that allows the tribe, at its discretion, to enter into leases, business agreements, and rights-of-way agreements for energy resource development on tribal lands without review and approval by the Secretary. However, in a June 2015 report, we found that uncertainties about Interior’s regulations for implementing this option have contributed to deter a tribe from pursuing an agreement. We recommended that Interior provide clarifying guidance. In August 2015, Interior stated the agency is considering further guidance. As of December 2016, Interior had not provided additional guidance.

Limited federal workforce planning. In November 2016, we found BIA had high vacancy rates at some agency offices and that the agency had not conducted key workforce planning activities, such as identifying the key workforce skills needed to achieve agency goals, and assessing any skill gaps. These workforce issues contribute to BIA’s management shortcomings that have hindered Indian energy development. Until BIA undertakes necessary workforce planning activities, it cannot ensure that it has a workforce with the right skills, appropriately aligned to meet the agency’s goals and tribal priorities. We recommended that BIA assess critical skills and competencies needed to fulfill its responsibilities related to energy development and identify potential gaps. We also recommended BIA establish a documented process for assessing BIA’s workforce composition at agency offices taking into account BIA’s mission, goals, and tribal priorities. Interior agreed with our recommendations and stated it is taking steps to implement them.

Outdated and deteriorating equipment, technology, and infrastructure. In June 2015, we found that BIA does not have the necessary geographic information system (GIS) mapping data for identifying who owns and uses resources, such as existing leases. Interior guidance states that efficient management of oil and gas resources relies, in part, on GIS mapping technology because it allows managers to easily identify resources available for lease and where leases are in effect. According to a BIA official, without GIS data, the process of identifying transactions, such as leases and access agreements for Indian land and resources, can take significant time and staff resources to search paper records stored in multiple locations. We recommended BIA should take steps to improve its GIS capabilities to ensure it can verify ownership in a timely manner. Interior stated it will enhance mapping capabilities by developing a national dataset composed of all Indian land tracts and boundaries in the next 4 years.

Incomplete and inaccurate data. In June 2015, we found that BIA did not have the data it needs to verify who owns some Indian oil and gas resources or identify where leases are in effect. In some cases, BIA cannot verify ownership because federal cadastral surveys—the means by which land is defined, divided, traced, and recorded—cannot be found or are outdated. The ability to account for Indian resources would assist BIA in fulfilling its federal trust responsibility, and determining ownership is a necessary step for BIA to approve leases and other energy-related documents. We recommended that Interior direct BIA to identify land survey needs. Interior stated it will develop a data collection tool to identify the extent of its survey needs in fiscal year 2016. As of December 2016, Interior had not provided information on the status of its efforts to develop a data collection tool.

GAO Contact

For additional information about this high-risk area related to our Indian Education work, contact Melissa Emrey-Arras at (617) 788-0534 or EmreyArrasM@gao.gov. For additional information about this high-risk area related to our Indian Health work, contact Kathleen King at (202) 512-7114 or KingK@gao.gov. For additional information about this high- risk area related to our Indian Energy work, contact Frank Rusco at (202) 512-3841 or RuscoF@gao.gov.

Related GAO Products

Education

Indian Affairs: Key Actions Needed to Ensure Safety and Health at Indian School Facilities. GAO-16-313. Washington, D.C.: March 10, 2016.

Indian Affairs: Preliminary Results Show Continued Challenges to the Oversight and Support of Education Facilities. GAO-15-389T. Washington, D.C.: February 27, 2015.

Indian Affairs: Bureau of Indian Education Needs to Improve Oversight of School Spending. GAO-15-121. Washington, D.C.: November 13, 2014.

Indian Affairs: Better Management and Accountability Needed to Improve Indian Education. GAO-13-774. Washington, D.C.: September 24, 2013.

Health Care

Indian Health Service: Actions Needed to Improve Oversight of Quality of Care. GAO-17-181. Washington, D.C.: January 9, 2017.

Indian Health Service: Actions Needed to Improve Oversight of Patient Wait Times. GAO-16-333. Washington, D.C.: March 29, 2016.

Indian Health Service: Opportunities May Exist to Improve the Contract Health Services Program. GAO-14-57. Washington, D.C.: December 11, 2013.

Indian Health Service: Most American Indians and Alaska Natives Potentially Eligible for Expanded Health Coverage, but Action Needed to Increase Enrollment. GAO-13-553. Washington, D.C.: September 5, 2013.

Indian Health Service: Capping Payment Rates for Nonhospital Services Could Save Millions of Dollars for Contract Health Services. GAO-13-272. Washington, D.C.: April 11, 2013.

Indian Health Service: Action Needed to Ensure Equitable Allocation of Resources for the Contract Health Services Program. GAO-12-446. Washington, D.C.: June 15, 2012.

Indian Health Service: Increased Oversight Needed to Ensure Accuracy of Data for Estimating Contract Health Service Need. GAO-11-767. Washington, D.C.: September 23, 2011.

Energy

Indian Energy Development: Additional Actions by Federal Agencies Are Needed to Overcome Factors Hindering Development. GAO-17-43. Washington, D.C.: November 10, 2016.

Indian Energy Development: Interior Could Do More to Improve Its Process for Approving Revenue-Sharing Agreements. GAO-16-553. Washington, D.C.: June 13, 2016.

Indian Energy Development: Poor Management by BIA Has Hindered Energy Development on Indian Lands. GAO-15-502. Washington, D.C.: June 8, 2015.

2020 Decennial Census

Why Area Is High Risk

One of the most important functions of the U.S. Census Bureau (Bureau) is conducting the decennial census of the U.S. population, which is mandated by the Constitution and provides vital data for the nation. This information is used to apportion the seats of the U.S. House of Representatives; realign the boundaries of the legislative districts of each state; allocate billions of dollars in federal financial assistance; and provide social, demographic, and economic profiles of the nation’s people to guide policy decisions at each level of government. A complete count of the nation’s population is an enormous challenge as the Bureau seeks to control the cost of the census while it implements several new innovations and manages the processes of acquiring and developing new and modified information technology (IT) systems supporting them. Over the past 3 years, we have made 30 recommendations to help the Bureau design and implement a more cost-effective census for 2020; however, only 6 of them had been fully implemented as of January 2017.

The cost of the census, in terms of cost for counting each housing unit, has been escalating over the last several decennials. The 2010 Census was the costliest U.S. Census in history at about $12.3 billion, and was about 31 percent more costly than the $9.4 billion 2000 Census (in 2020 dollars). The average cost for counting a housing unit increased from about $16 in 1970 to around $92 in 2010 (in 2020 constant dollars). Meanwhile, the return of census questionnaires by mail (the primary mode of data collection) declined over this period from 78 percent in 1970 to 63 percent in 2010. Declining mail response rates—a key indicator of a cost-effective census—are significant and lead to higher costs. This is because the Bureau sends enumerators to each non-responding household to obtain census data. As a result, non-response follow-up (NRFU) is the Bureau’s largest and most costly field operation. In many ways, the Bureau has had to invest substantially more resources each decade to match the results of prior enumerations.

What Remains to Be Done

The Bureau plans to implement several new innovations in its design of the 2020 Census. In response to our recommendations regarding past decennial efforts and other assessments, the Bureau has fundamentally reexamined its approach for conducting the 2020 Census. Its plan for 2020 includes four broad innovation areas that it believes will save it over $5 billion (2020 constant dollars) when compared to what it estimates conducting the census with traditional methods would cost. The Bureau’s innovations include (1) using the Internet as a self-response option, which the Bureau has never done on a large scale before; (2) verifying most addresses using “in-office” procedures and on-screen imagery rather than street-by-street field canvassing; (3) re-engineering data collection methods such as by relying on an automated case management system; and (4) in certain instances, replacing enumerator collection of data with administrative records (information already provided to federal and state governments as they administer other programs). These innovations show promise for a more cost-effective head count. However, they also introduce new risks, in part, because they include new procedures and technology that have not been used extensively in earlier decennials, if at all.

The Bureau is also managing the acquisition and development of new and modified IT systems, which add complexity to the design of the census. To help control census costs, the Bureau plans to significantly change the methods and technology it uses to count the population, such as offering an option for households to respond to the survey via the Internet or phone, providing mobile devices for field enumerators to collect survey data from households, and automating the management of field operations. This redesign relies on acquiring and developing many new and modified IT systems, which could add complexity to the design.

These cost risks, new innovations, and the acquisition and development of IT systems for the 2020 Census, along with other challenges we have identified in recent years, raise serious concerns about the Bureau’s ability to conduct a cost-effective enumeration. Based on these concerns, we have concluded that the 2020 Census is a high-risk area and have added it to the High-Risk List in 2017.

To help the Bureau mitigate the risks associated with its fundamentally new and complex innovations for the 2020 Census, the commitment of top leadership is needed to ensure the Bureau’s management, culture, and business practices align with a cost-effective enumeration. For example, the Bureau needs to continue strategic workforce planning efforts to ensure it has the skills and competencies needed to support planning and executing the census. It must also rigorously test individual census-taking activities to provide information on their feasibility and performance, their potential for achieving desired results, and the extent to which they are able to function together under full operational conditions. We have recommended that the Bureau also ensure that its scheduling adheres to leading practices and be able to support a quantitative schedule risk assessment, such as by having all activities associated with the levels of resources and effort needed to complete them. The Bureau has stated that it has begun maturing project schedules to ensure that the logical relationships are in place and plans to conduct a quantitative risk assessment. We will continue to monitor the Bureau’s efforts.

The Bureau must also improve its ability to manage, develop, and secure its IT systems. For example, the Bureau needs to prioritize its IT decisions and determine what information it needs in order to make those decisions. In addition, the Bureau needs to make key IT decisions for the 2020 Census in order to ensure they have enough time to have the production systems in place to support the end-to-end system test. To this end, we recommended the Bureau ensure that the methodologies for answering the Internet response rate and IT infrastructure research questions are determined and documented in time to inform key design decisions. Further, given the numerous and critical dependencies between the Census Enterprise Data Collection and Processing (CEDCaP) program—a large and complex modernization program within the IT Directorate—and 2020 Census programs, their parallel implementation tracks, and the 2020 Census’s immovable deadline, we recommended that the Bureau establish a comprehensive and integrated list of all interdependent risks facing the two programs, and clearly identify roles and responsibilities for managing this list. The Bureau stated that it plans to take actions to address our recommendations.

It is also critical for the Bureau to have better oversight and control over its cost estimation process and we have recommended that the Bureau ensure its cost estimate is consistent with our leading practices. For example, the Bureau will need to, among other practices, document all cost-influencing assumptions; describe estimating methodologies used for each cost element; ensure that variances between planned and actual cost are documented, explained, and reviewed; and include a comprehensive sensitivity analysis, so that it can better estimate costs. We also recommended that the Bureau implement and institutionalize processes or methods for ensuring control over how risk and uncertainty are accounted for and communicated within its cost estimation process. The Bureau agreed with our recommendations, and we are currently conducting a follow-up audit of the Bureau’s most recent cost estimate and will determine whether the Bureau has implemented them.

Sustained congressional oversight will be essential as well. In 2015 and 2016, congressional committees held five hearings focusing on the progress of the Bureau’s preparations for the decennial. Going forward, active oversight will be needed to ensure these efforts stay on track, the Bureau has needed resources, and Bureau officials are held accountable for implementing the enumeration as planned.

We will continue monitoring the Bureau’s efforts to conduct a cost- effective enumeration. To this end, we have ongoing work focusing on such topics as the Bureau’s updated life-cycle cost estimate and the readiness of IT systems for the 2018 End-to-End Test, which is essentially a dress rehearsal for the decennial.

Additional Details on What GAO Found

Challenges Implementing Innovations

The Bureau is planning many previously unused innovations for the 2020 Census: The decennial census is an inherently challenging undertaking, requiring many moving parts to come together in a short time and be completed according to a prescribed schedule. To help control costs and maintain accuracy, the Bureau is introducing significant change to how it conducts the decennial census in 2020. Its planned innovations include (1) making greater use of local data, imagery, and other office procedures to build its address list; (2) improving self- response by encouraging respondents to use the Internet and telephone; (3) using administrative records to reduce field work; and (4) reengineering field operations using technology to reduce manual effort and improve productivity. While the census is under way, the tolerance for any breakdowns is quite small. As a result, given the new four innovation areas for the 2020 Census, it will be imperative that the Bureau have systems and operations in place for the 2018 End-to-End Test.

Using administrative records is promising but introduces challenges: Although administrative records—information already provided to the government as it administers other programs—have been discussed and used for the decennial census since the 1970s, the Bureau plans a more significant role for them to reduce the amount of data collection fieldwork, which has the potential to help significantly limit the cost increases of the 2020 Census. The Bureau has estimated that using these records could save up to $1.4 billion compared to traditional census methods. In 2015, we found that while the Bureau has already demonstrated the feasibility of using administrative records, it still faces challenges with using them for the 2020 Census. For example, although the Bureau has no control over the accuracy of data provided to it by other agencies, it is responsible for ensuring that data it uses for 2020 Census are of sufficient quality for their planned uses.

Another challenge we identified is the extent to which the public will accept government agencies sharing personal data for the purposes of the census. Related concerns involve trust in the government and perceptions about burden on respondents as well the social benefits of agencies sharing data. Moreover, in addition to using administrative records to reduce fieldwork, the Bureau is considering several additional opportunities to leverage administrative records to help improve the cost and quality of the 2020 Census. It will be important for the Bureau to set deadlines for deciding which records it will use and for which purpose to help the Bureau monitor its progress and prioritize which activities—or records—to continue pursuing, or to abandon, if time becomes a constraint.

The Bureau needs to identify and analyze root causes of non- interviews during testing: When households do not respond to the census and when the Bureau does not obtain information about the household while knocking on doors during its NRFU operation, the Bureau may have to impute attributes of the household based on the demographic characteristics of surrounding housing units as well as on administrative records. We reported in 2016 that during the Bureau’s 2016 Census Site Test, the Bureau experienced about 20 and 30 percent of its test workload as non-interviews at its two test sites in Harris County, Texas, and Los Angeles County, California, respectively. According to the Bureau, non-interviews are cases where no data or insufficient data are collected, either because enumerators make six attempted visits without success (the maximum number the Bureau allows), or are not completed due to, for example, language barriers or dangerous situations. Identifying root causes of problems is something we look for when determining progress within a high-risk area. Accordingly, while the 2016 Census Test non-interview rate is not necessarily a precursor to the 2020 non-interview rate, because of its relationship to the cost and quality of the census, it will be important for the Bureau to better understand the factors contributing to it.

Bureau cancelled field tests for 2017: The Bureau plans to conduct additional research through 2018 in order to further refine the design of the 2020 Census, but recently had to alter its approach. On October 18, 2016, the Bureau decided to stop two field test operations planned for fiscal year 2017 in order to mitigate risks from funding uncertainty. Specifically, the Bureau said it would stop all planned field activity, including local outreach and hiring, at its test sites in Puerto Rico, North and South Dakota, and Washington State. The Bureau will not carry out planned field tests of its mail-out strategy and follow up for non-response in Puerto Rico or its door-to-door enumeration. The Bureau also cancelled plans to update its address list in the Indian lands and surrounding areas in the three states.

However, the Bureau will continue with other planned testing in fiscal year 2017, such as those focusing on systems readiness and Internet response. Further, the Bureau said it would consider incorporating the cancelled field activities elements within the 2018 End-to-End Test. The Bureau maintains that stopping the 2017 Field Test will help prioritize readiness for the 2018 End-to-End Test, and mitigate risk. Nevertheless, as we reported in November 2016, it also represents a lost opportunity to test, refine, and integrate operations and systems, and it puts more pressure on the 2018 Test to demonstrate that enumeration activities will function as needed for 2020.

Critical IT Uncertainties

The Bureau needs to strengthen the management and oversight of all IT programs, systems, and contractors supporting the decennial: The redesign of the 2020 Census relies on many new and modified IT systems. In addition to those systems that are being managed and developed within the 2020 Census Directorate, the 2020 program is also heavily dependent upon 11 systems that are being delivered by the CEDCaP program—a large and complex modernization program within the IT Directorate. Importantly, as a result of the Bureau’s challenges in key IT internal controls and its rapidly approaching deadline, we identified CEDCaP as an IT investment in need of attention in the February 2015 high-risk report. In addition, in August 2016, we reported that the 2020 program and CEDCaP program lacked effective processes for managing their schedule, risk, and requirements interdependencies.

For example, among tens of thousands of schedule activities, the two programs were expected to manually identify activities that are dependent on each other, and rather than establishing one integrated dependency schedule, the programs maintained two separate dependency schedules. We reported that this contributed to misaligning milestones between the programs. We stated that until the two programs establish schedules that are completely aligned, develop an integrated list of all interdependent risks, and finalize processes for managing requirements, both programs are at risk of not delivering their programs as expected.

The Bureau is also relying on contractor support in many key areas, including technically integrating all of the key systems and infrastructure, and developing many of the key data collection systems. Specifically, in August 2016, the Bureau hired a contractor to technically integrate the 2020 Census systems and infrastructure, to include evaluating the systems and infrastructure, developing the infrastructure (e.g., cloud or data center) to meet the Bureau’s scalability and performance needs, integrating all of the systems, and supporting testing activities.

In addition, the Bureau is relying on contractors to develop a number of key systems and infrastructure; these activities include (1) developing the IT platform that will be used to collect data from a majority of respondents—by using the Internet, telephone, and NRFU activities; (2) procuring the mobile devices and cellular service to be used for NRFU; and (3) developing the IT infrastructure in the field offices. A greater reliance on contractors for these key components of the 2020 Census requires the Bureau to focus on sound management and oversight of the key contracts, projects, and systems.

Key IT decisions need to be prioritized and made in time for full end- to-end testing in 2017: We have issued a series of reports and testimonies that have discussed the Bureau’s challenges in prioritizing and making IT decisions. In April 2014, we reported that the Bureau had not prioritized key IT research and testing needed for its 2020 Census design decisions. In February 2015, we reported that the Bureau had not determined how key IT research questions would be answered—such as the expected rate of respondents using its Internet response option or the IT infrastructure that would be needed to support this option.

Further, we testified, in November 2015, that key IT decisions needed to be made soon because the Bureau was less than 2 years away from preparing for end-to-end testing of all systems and operations, and there was limited time to implement them. We emphasized that the Bureau had deferred key IT-related decisions, and that it was running out of time to develop, acquire, and implement the systems it will need to deliver the redesign.

In October 2016, Bureau officials stated that they had 16 IT-related and 32 partially IT-related decisions left to make, including the uses of cloud- based solutions, the tools and test materials to be used during integration testing, and the expected scale of the system workload for those respondents who do not use the Bureau-provided Census ID. It will be important to make these decisions in enough time to develop solutions before the End-to-End Test begins in August 2017.

Information security risks and challenges need to be addressed to secure the Bureau’s systems and data: In August 2016, we described the significant challenges that the Bureau faces in securing systems and data, such as developing policies and procedures to minimize the threat of phishing aimed at stealing personal information and ensuring that individuals gain only limited and appropriate access to 2020 Census data. Because many of the systems to be used in the 2018 End-to-End Test are not yet fully developed, the Bureau has not finalized all of the controls to be implemented, completed an assessment of those controls, developed plans to remediate any control weaknesses, and determined whether there is time to fully remediate any weaknesses before the system test.

Unreliable 2020 Cost Estimate

Estimation does not conform to best practices: We reviewed the Bureau’s October 2015 estimated comprehensive life-cycle cost for the 2020 Census and reported in 2016 that it did not conform to best practices, and, as a result, the estimate was unreliable. Cost estimates that appropriately account for risks facing an agency can help an agency manage large, complex activities like the 2020 Census, as well as help Congress make funding decisions and provide oversight. Cost estimates are also necessary to inform decisions to fund one program over another, to develop annual budget requests, to determine what resources are needed, and to develop baselines for measuring performance.

We found that although the Bureau had taken significant steps to improve its capacity to carry out an effective cost estimate, its estimate for the 2020 Census partially met the characteristics of two best practices (comprehensive and accurate) and minimally met the other two (well- documented and credible), where all four need to be substantially met in order for an estimate to be deemed high-quality.

According to best practices, to be comprehensive an estimate has to have enough detail to ensure that cost elements are neither omitted nor double-counted, and all cost-influencing assumptions are detailed in the estimate’s documentation, among other things. While Bureau officials were able to provide us with several documents that included projections and assumptions that were used in the cost estimate, we found the estimate to be partially comprehensive because it is unclear if all life-cycle costs are included in the estimate or if the cost estimate completely defines the program.

Credible cost estimates clearly identify limitations due to uncertainty or bias surrounding the data or assumptions, according to best practices. We found the estimate minimally met best practices for this characteristic in part because the Bureau carried out its risk and uncertainty analysis only for about $4.6 billion (37 percent) of the $12.5 billion total estimated life-cycle cost, excluding, for example, consideration of uncertainty over what the decennial census’s estimated part will be of the total cost of CEDCaP.

Accurate estimates are unbiased and contain few mathematical mistakes. We found the estimate partially met best practices for this characteristic, in part because we could not independently verify the calculations the Bureau used within its cost model, which the Bureau did not have documented or explained outside its limited access cost estimation software.

Finally, the Bureau’s cost-estimate was not well-documented. Improving cost estimation practices will increase the reliability of the Bureau’s cost estimate, which will, among other things, help improve decision making, budget formulation, progress measurement, and accountability for results.

The Bureau’s cost estimate had other shortcomings as well. For example, in 2016 we found that the Bureau’s cost estimation team did not record how and why it changed assumptions that were provided to it, and the Bureau lacked written guidance and procedures for the cost estimation team to follow. Moreover, key risks were not accounted for in the cost estimate although this is an important best practice.

GAO Contact

For additional information about this high-risk area, contact Robert Goldenkoff at (202) 512-2757 or GoldenkoffR@gao.gov; or David Powner at (202) 512-9286 or PownerD@gao.gov.

Related GAO Products

2020 Census: Additional Actions Could Strengthen Field Data Collection Efforts. GAO-17-191. Washington, D.C.: January 26, 2017.

Information Technology: Better Management of Interdependencies between Programs Supporting 2020 Census Is Needed. GAO-16-623. Washington, D.C.: August 9, 2016. 2020 Census: Census Bureau Needs to Improve Its Life-Cycle Cost Estimating Process. GAO-16-628. Washington, D.C.: June 30, 2016. 2020 Census: Additional Actions Would Help the Bureau Realize Potential Administrative Records Cost Savings. GAO-16-48. Washington, D.C.: October 20, 2015. 2020 Census: Key Challenges Need to Be Addressed to Successfully Enable Internet Response. GAO-15-225. Washington, D.C.: February 5, 2015. 2020 Census: Census Bureau Can Improve Use of Leading Practices When Choosing Address and Mapping Sources. GAO-15-21. Washington, D.C.: October 2, 2014. 2020 Census: Bureau Needs to Improve Scheduling Practices to Enhance Ability to Meet Address List Development Deadlines. GAO-14-59. Washington, D.C.: November 21, 2013. 2020 Census: Additional Steps Are Needed to Build on Early Planning. GAO-12-626. Washington, D.C.: May 17, 2012.

Decennial Census: Additional Actions Could Improve the Census Bureau’s Ability to Control Costs for the 2020 Census. GAO-12-80. Washington, D.C.: January 24, 2012. 2010 Census: Census Bureau Has Made Progress on Schedule and Operational Control Tools, but Needs to Prioritize Remaining System Requirements. GAO-10-59. Washington, D.C.: November 13, 2009.

U.S. Government’s Environmental Liability

Why Area Is High Risk

The federal government’s environmental liability has been growing for the past 20 years and is likely to continue to increase. For fiscal year 2016, the federal government’s estimated environmental liability was $447 billion—up from $212 billion for fiscal year 1997. However, this estimate does not reflect all of the future cleanup responsibilities federal agencies may face. Because of the lack of complete information and the often inconsistent approach to making cleanup decisions, federal agencies cannot always address their environmental liabilities in ways that maximize the reduction of health and safety risks to the public and the environment in a cost effective manner.

The federal government is financially liable for cleaning up areas where federal activities have contaminated the environment. Various federal laws, agreements with states, and court decisions require the federal government to clean up environmental hazards at federal sites and facilities—such as nuclear weapons production facilities and military installations. Such sites are contaminated by many types of waste. numerous site-specific factors, stakeholder agreements, and legal provisions.

We have also found that some agencies do not take a holistic, risk- informed approach to environmental cleanup that aligns limited funds with the greatest risks to human health and the environment. Since 1994, we have made at least 28 recommendations related to addressing the federal government’s environmental liability. These include 22 recommendations to the Department of Energy (DOE) or the Department of Defense (DOD), 1 recommendation to the Office of Management and Budget to consult with Congress on agencies’ environmental cleanup costs, 1 recommendation to the Department of Agriculture (USDA), and 4 recommendations to Congress to change the law governing cleanup activities. Of these, 13 recommendations remain unimplemented. If implemented, these steps would improve the completeness and reliability of the estimated costs of future cleanup responsibilities and lead to more risk-based management of the cleanup work.

What Remains to Be Done

Future progress in addressing the U.S. government’s environmental liabilities depends, among other things, on how effectively federal departments and agencies set priorities, under increasingly restrictive budgets, that maximize the risk reduction and cost-effectiveness of cleanup approaches. As a first step, some departments and agencies may need to improve the completeness of information about long-term cleanup responsibilities and their associated costs so that decision makers, including Congress, can consider the full scope of the federal government’s cleanup obligations. As a next step, certain departments, such as DOE, may need to change how they establish cleanup priorities. For example, DOE’s current practice of negotiating agreements with individual sites without considering other sites’ agreements or available resources may not ensure that limited resources will be allocated to reducing the greatest environmental risks, and costs will be minimized.

We have recommended actions to federal agencies that, if implemented, would improve the completeness and reliability of the estimated costs of future cleanup responsibilities and lead to more risk-based management of the cleanup work.

Completeness of Environmental Liability Estimates

In 1994, we recommended that Congress amend certain legislation to require agencies to report annually on progress in implementing plans for completing site inventories, estimates of the total costs to clean up their potential hazardous waste sites, and agencies’ progress toward completing their site inventories and on their latest estimates of total cleanup costs. We believe these recommendations are as relevant, if not more so, today.

In 2015, we recommended that the USDA develop plans and procedures for completing their inventories of potentially contaminated sites. USDA disagreed with this recommendation. However, we continue to believe that USDA’s inventory of contaminated and potentially contaminated sites—in particular, abandoned mines, primarily on Forest Service land—is insufficient for effectively managing USDA’s overall cleanup program. Interior is also faced with an incomplete inventory of abandoned mines that they are working to improve.

Reliability of Environmental Liability Estimates

In 2006, we recommended that DOD develop, document, and implement a program for financial management review, assessment, and monitoring of the processes for estimating and reporting environmental liabilities. This recommendation has not been implemented.

Risk-Based Decision- Making

We have found in the past that DOE’s cleanup strategy is not risk- based and should be re-evaluated. DOE’s decisions are often driven by local stakeholders and certain requirements in federal facilities agreements and consent decrees. In 1995, we recommended that DOE set national priorities for cleaning up its contaminated sites using data gathered during ongoing risk evaluations. This recommendation has not been implemented.

In 2003, we recommended that DOE ask Congress to clarify its authority for designating certain waste with relatively low levels of radioactivity as waste incidental to reprocessing, and therefore not managed as high-level waste. In 2004, DOE received this specific authority from Congress for the Savannah River and Idaho Sites, thereby allowing DOE to save billions of dollars in waste treatment costs. The law, however, excluded the Hanford Site.

More recently, in 2015 we found that DOE is not comprehensively integrating risks posed by National Nuclear Security Administration’s (NNSA) nonoperational contaminated facilities with EM’s portfolio of cleanup work. By not integrating nonoperational facilities from NNSA, EM is not providing Congress with complete information about EM’s current and future cleanup obligations as Congress deliberates annually about appropriating funds for cleanup activities. We recommended that DOE integrate its lists of facilities prioritized for disposition with all NNSA facilities that meet EM’s transfer requirements, and that EM should include this integrated list as part of the Congressional Budget Justification for DOE. DOE neither agreed nor disagreed with this recommendation.

Additional Details on What GAO Found

Of the federal government’s estimated $447 billion environmental liability—up from $212 billion for fiscal year 1997—DOE is responsible for by far the largest share of the liability and DOD is responsible for the second largest share. The rest of the federal government makes up the remaining 3 percent of the liability with agencies such as the National Aeronautics and Space Administration (NASA) and the Departments of Transportation, Veterans Affairs, USDA, and Interior holding large liabilities (see figure 13).

Department of Energy

DOE was responsible for over 80 percent ($372 billion) of the U.S. government’s fiscal year 2016 reported environmental liability, mostly related to nuclear waste cleanup. DOE’s total reported environmental liability has generally increased since fiscal year 2000 (see figure 14). According to audit documentation related to DOE’s fiscal year 2016 financial statements, 50 percent of the DOE’s environmental liability resides at two cleanup sites: the Hanford Site in Washington State and the Savannah River Site in South Carolina. program —and delays and scope changes for major construction projects at the Hanford and Savannah River sites.

We testified in February 2016 that DOE’s estimated liability does not include billions in expected costs. According to government accounting standards, environmental liability estimates include costs that are probable and reasonably estimable, meaning that costs that cannot yet be reasonably estimated are not included in total environmental liability. Examples of costs that DOE cannot yet estimate include the following:

DOE has not yet developed a cleanup plan or cost estimate for the Nevada National Security Site and, as a result, the cost of future cleanup of this site was not included in DOE’s fiscal year 2015 reported environmental liability. The nearly 1,400-square-mile site has been used for hundreds of nuclear weapons tests since 1951. These activities have resulted in more than 45 million cubic feet of radioactive waste at the site. According to DOE’s financial statement, since DOE is not yet required to establish a plan to clean up the site, the costs for this work are excluded from DOE’s annually reported environmental liability.

DOE’s reported environmental liability includes an estimate for the cost of a permanent nuclear waste repository, but these estimates are highly uncertain and likely to increase. In response to the termination of the Yucca Mountain repository program, DOE proposed separate repositories for defense high-level and commercial waste in March 2015. In January 2017, we reported that the cost estimate for DOE’s new approach excluded the costs and time frames for key activities.

As a result, the full cost of these activities is likely more than what is reflected in DOE’s environmental liability.

There are several possible causes for the large and growing amount of money that DOE will need to meet its cleanup responsibilities. First, as our and other organizations’ reports issued over the last 2 decades have found, DOE’s environmental cleanup decisions are not risk-based and its risk-based decision making is sometimes impeded by selection of cleanup remedies that are not appropriately tailored to the risks presented, and inconsistencies in the regulatory approaches followed at different sites. We and others have pointed out that DOE needs to take a nation-wide, risk-based approach to cleaning up these sites, which could reduce costs while also reducing environmental risks more quickly. Examples include the following: In 1995, we found that DOE’s cleanup strategy had been shaped by site-specific environmental agreements whose priorities and requirements had not always been consistent with technical or fiscal realities and that, under severe budgetary constraints, using many separately-negotiated agreements is not well suited to setting priorities among sites. We recommended that DOE set national priorities for cleaning up its contaminated sites. DOE responded at that time that because of limitations on the science of risk assessment, it had no intention of developing national, risk-based priorities for its cleanup work. In a later report, we found that DOE’s compliance agreements did not provide a means of prioritizing among sites and, therefore, DOE had not developed a comprehensive, relative ranking of the risks that it faces across its sites. DOE has been unsuccessful in its attempts to develop such a methodology in the past and, as a result, DOE has no systematic way to make cleanup decisions among sites based on risk. the waste’s origins rather than on its actual radiological risks. The Academy concluded that by working with regulators, public authorities, and local citizens to implement risk-informed practices, waste cleanup efforts can be done more cost-effectively. The report also suggested that statutory changes were likely needed. In 2011, the Academy also reported that DOE could realize significant benefits by providing more realistic safety- and risk-informed analyses.

In 2015, a review organized by the Consortium for Risk Evaluation with Stakeholder Participation reported that DOE is not optimally using available resources to reduce risk. According to the report, factors such as inconsistent regulatory approaches and certain requirements in federal facility agreements cause disproportionate resources to be directed at lower priority risks. The report called for a more systematic effort to assess and rank risks within and among sites, including through headquarters guidance to sites, and to allocate federal taxpayer monies to remedy the highest priority risks through the most efficient means.

Second, DOE’s cleanup approach is based primarily on a series of compliance agreements and consent orders between DOE, the Environmental Protection Agency (EPA), and state regulators. According to one DOE official, 40 such agreements establish the requirements for DOE’s cleanup work. We have reported in the past that these agreements include thousands of associated milestones. Some of the 40 agreements were made decades ago and may be based on outdated information about the effectiveness of certain cleanup technologies.

Third, DOE may have insufficient controls in place to accurately account for its environmental liabilities. In January 2017, the DOE Inspector General reported a significant deficiency in internal control related to the reconciliation of environmental liabilities.

Department of Defense

its sites. In July 2010, we reported that DOD spent almost $30 billion from 1986 to 2008 across its environmental cleanup and restoration activities at its installations. More recently, in its July 2016 annual report to Congress on environmental cleanup, DOD reported spending an average of about $1.8 billion each year for its environmental cleanup activities from fiscal years 2011 to 2016.

DOD’s inability to estimate with assurance key components of its environmental liabilities was a material weakness. We reported in January 2017 that this weakness still exists. Examples of uncertainties in DOD reported environmental liabilities include the following:

DOD’s current environmental liability estimate does not include additional costs that will likely be needed for DOD to complete the cleanup for BRAC activities. We reported in January 2017 that DOD estimates it will need about $3.4 billion in addition to the $11.5 billion it has already spent to manage and complete environmental cleanup of BRAC installations. We also found that DOD’s annual report on its environmental cleanup program does not include significant costs associated with cleanup of contaminants at its installations, including those closed under BRAC.

DOD’s estimate does not include the total costs associated with cleaning up weapons sites. According to DOD’s fiscal year 2015 Agency Financial Report (AFR), DOD is unable to estimate and report a liability for the environmental restoration that is needed to clean up buried chemical munitions and agents at certain sites, among other things, because the extent of the buried chemical munitions and agents is unknown.

DOD may also incur costs not currently included in its environmental liability estimate for restoration initiatives in conjunction with returning overseas DOD facilities to host nations. According to DOD’s fiscal year 2015 AFR, DOD is unable to provide a reasonable estimate because the extent of required restoration is unknown.

Other Federal Agencies

The remainder of the U.S. government’s estimated environmental liability (about $12 billion in fiscal year 2016) was managed by numerous departments and agencies and, similar to the DOE and DOD portions, is likely to increase. Federal agencies with large reported environmental liabilities in fiscal year 2016 included NASA, USDA, and the Departments of Transportation, Veterans Affairs, and Interior. Since 2000, the reported environmental liability for these agencies has also increased (see figure 17). which the federal government will pay cleanup costs may depend on whether or not financially viable responsible parties, including current and former mine owners and operators, can be identified. Additionally, neither department has a complete inventory of its cleanup responsibilities. For example,

USDA: For fiscal year 2016, USDA reported an environmental liability of $196 million. As of April 2014, USDA had identified 1,491 contaminated sites but this list is incomplete as many more potentially contaminated sites, including abandoned mines, have not yet been identified. In 2015, we found that USDA does not have a reliable, centralized site inventory or plans and procedures for completing one, in particular for abandoned mines. For example, in fiscal year 2013, USDA reported $3 million for the Forest Service’s environmental liability. In 2015, we found that this figure did not include any cleanup costs for abandoned mines. The Forest Service estimates that there could be from 27,000 to 39,000 abandoned mines on its lands— approximately 20 percent of which may pose some level of risk to human health or the environment—and the federal government may have to pay for cleanup of some of these mines. USDA’s Forest Service has not developed a complete, consistent, or usable inventory of abandoned mines and had no plans and procedures for developing such an inventory. Without a reliable inventory, USDA cannot effectively estimate its ultimate cost to cleanup these sites.

Interior: For fiscal year 2016, Interior reported an environmental liability of about $830 million. We found in 2015 that Interior had an inventory of 4,722 sites, including 85 abandoned mines, with confirmed or likely contamination. However, Interior may have future cleanup responsibilities and, as a result, ultimate cleanup costs may exceed the currently reported environmental liability. Specifically, Interior’s Bureau of Land Management (BLM) has identified over 30,000 abandoned mines—some of which will the federal government may have to pay to clean up—that have not yet been assessed for contamination. Furthermore, this inventory is not complete as BLM estimated that there are at least 100,000 abandoned mines that have not yet been inventoried. While cost estimates for addressing these mines are not currently included in Interior’s liability, information for certain types of mines indicates that the ultimate cost of Interior’s future cleanup responsibilities are greater than what is reflected in the reported environmental liability. BLM is working to improve the completeness and accuracy of its inventory.

GAO Contact

For additional information about this high-risk area, contact David Trimble, Director, Natural Resources and Environment, 202-512-3841 or trimbled@gao.gov.

Related GAO Products

Military Base Realignments and Closures: DOD Has Improved Environmental Cleanup Reporting but Should Obtain and Share More Information. GAO-17-151. Washington, D.C.: January 19, 2017.

Department of Energy: Observations on Efforts by NNSA and the Office of Environmental Management to Manage and Oversee the Nuclear Security Enterprise. GAO-16-422T. Washington, D.C.: February 23, 2016.

DOE Facilities: Better Prioritization and Life Cycle Cost Analysis Would Improve Disposition Planning. GAO-15-272. Washington, D.C.: March 19, 2015.

Hazardous Waste: Agencies Should Take Steps to Improve Information on USDA’s and Interior’s Potentially Contaminated Sites. GAO-15-35. Washington, D.C.: January 16, 2015.

DOD Financial Management: Effect of Continuing Weaknesses on Management and Operations and Status of Key Challenges. GAO-14-576T. Washington, D.C.: May 13, 2014.

Uranium Mining: Opportunities Exist to Improve Oversight of Financial Assurances. GAO-12-544. Washington, D.C.: May 17, 2012.

Superfund: Interagency Agreements and Improved Project Management Needed to Achieve Cleanup Progress at Key Defense Installations. GAO-10-348. Washington, D.C.: July 15, 2010.

Military Base Closures: Opportunities Exist to Improve Environmental Cleanup Cost Reporting and to Expedite Transfer of Unneeded Property. GAO-07-166. Washington, D.C.: January 30, 2007.

Environmental Liabilities: Long-Term Fiscal Planning Hampered by Control Weaknesses and Uncertainties in the Federal Government’s Estimates. GAO-06-427. Washington, D.C.: March 31, 2006.

Nuclear Waste: Challenges to Achieving Potential Savings in DOE’s High-Level Waste Cleanup Program. GAO-03-593. Washington, D.C.: June 17, 2003.

Long-Term Commitments: Improving the Budgetary Focus on Environmental Liabilities. GAO-03-219. Washington, D.C.: January 24, 2003.

Environmental Liabilities: Cleanup Costs From Certain DOD Operations Are Not Being Reported. GAO-02-117. Washington, D.C.: December 14, 2001.

Environmental Liabilities: DOD Training Range Cleanup Cost Estimates Are Likely Understated. GAO-01-479. Washington, D.C.: April 11, 2001.

Department of Energy: National Priorities Needed for Meeting Environmental Agreements. GAO/RCED-95-1. Washington, D.C.: March 3, 1995.

Federal Facilities: Agencies Slow to Define the Scope and Cost of Hazardous Waste Site Cleanups. GAO/RCED-94-73. Washington, D.C.: April 15, 1994.

DOD Supply Chain Management

Why Area Is High Risk

The Department of Defense (DOD) manages about 4.9 million secondary inventory items, such as spare parts, with a reported value of $91.7 billion as of September 2015. Effective and efficient supply chain management is critical for supporting the readiness and capabilities of the force and for helping to ensure that DOD avoids spending resources on unneeded inventory that could be better applied to other defense and national priorities. However, DOD has experienced weaknesses in the management of its supply chain, particularly in the following areas: Inventory management. DOD’s inventory management practices and procedures have been ineffective and inefficient. DOD has experienced high levels of inventory that were in excess of requirements and weaknesses in accurately forecasting the demand for inventory items.

Materiel distribution. DOD has faced challenges in delivering supplies and equipment, including not meeting delivery standards and timelines for cargo shipments as well as not maintaining complete delivery data for surface shipments.

Asset visibility. DOD has had weaknesses in maintaining visibility of supplies, such as problems with inadequate radio-frequency identification information to track all cargo movements.

We added supply chain management to the High-Risk List in 1990. In our February 2015 update, we reported that DOD had made moderate progress in addressing weaknesses in supply chain management, but had not resolved several long-standing problems. For example, DOD had not developed a corrective action plan to address materiel distribution weaknesses or performance metrics based on reliable data to assess performance across the entire distribution pipeline. With respect to asset visibility, DOD had not fully developed performance measures that will effectively ensure that the department’s initiatives improve asset visibility.

What GAO Found

Since our February 2015 high-risk update, DOD has made progress in addressing all three dimensions of its supply chain management: inventory management, materiel distribution, and asset visibility. For inventory management, DOD has met all five high-risk criteria. For this reason, we are removing inventory management from the supply chain management high-risk area. For materiel distribution, DOD has continued to demonstrate leadership commitment and capacity and has developed a corrective action plan to guide and direct the department’s efforts to improve materiel distribution support to the warfighter. However, work remains to fully meet the monitoring and demonstrated progress high-risk criteria. For asset visibility, DOD has continued to meet the leadership commitment criteria and has met the capacity and corrective action plan criteria—the latter in fiscal year 2015 by updating and implementing the Strategy for Improving DOD Asset Visibility (Strategy). However, additional actions are needed to fully meet the remaining two criteria— monitoring and demonstrated progress. In a December 2016 letter from the Under Secretary of Defense for Acquisition, Technology, and Logistics to the Chairman of the Committee on Oversight and Government Reform, U.S. House of Representatives, the department generally agreed with our assessment of progress made and outlined ongoing and planned actions to address the remaining issues.

What Remains to Be Done

Materiel Distribution

In October 2014, we provided DOD with a letter that outlined six actions and outcomes that we believe it should address in order to mitigate or resolve long-standing weaknesses in materiel distribution and address the criteria for removal from the High-Risk List. Based on discussions with DOD officials and recent efforts across the department as of November 2016, we believe that DOD has addressed three of the six actions and outcomes. Specifically, DOD has addressed the actions and outcomes associated with the action plan criterion by developing the Materiel Distribution Improvement Plan (Improvement Plan) that contains implementation goals and timelines that will guide its effort to identify gaps and root causes with respect to the performance of the entire distribution pipeline. However, DOD still needs to address the three remaining actions and outcomes from the October 2014 letter that are related to monitoring and demonstrating progress. Additionally, based on our review of DOD’s efforts to improve materiel distribution, we are adding an additional action focused on ensuring DOD refines and updates its actions in the Improvement Plan based on interim progress and results, which results in four remaining actions and outcomes that need to be addressed for removal of materiel distribution from the High- Risk List. Going forward, DOD needs to show measureable and sustained positive outcomes addressing the remaining four actions and outcomes.

Monitoring

make progress in developing its suite of distribution performance metrics, improving the quality of data underlying those metrics, and sharing metrics information among stakeholders; integrate distribution metrics data, including cost data, from the combatant commands and other DOD components, as appropriate, on the performance of all legs of the distribution system, including the tactical leg; and refine existing actions in the Improvement Plan or incorporate additional actions based on interim progress and results, and update the Improvement Plan accordingly.

Demonstrated Progress

demonstrate that the actions implemented under its Improvement Plan improve its capability to comprehensively measure distribution performance, identify distribution problems and root causes, and identify and implement solutions.

Asset Visibility

Our October 2014 letter to DOD outlined seven actions and outcomes that we believe it should address in order to mitigate or resolve long- standing weaknesses in asset visibility and address the criteria for removal from the High-Risk List. Based on discussions with DOD officials and recent efforts across the department as of January 2017, we believe that DOD has addressed five of the seven actions and outcomes. Specifically, DOD has addressed the actions and outcomes associated with the capacity and action plan criteria by the department providing additional direction to the components on formulating cost estimates and the components implementing that direction in developing its cost estimates for the asset visibility initiatives.

Additionally, DOD linked the goals and objectives of the Strategy with the specific initiatives intended to implement the Strategy, established a mechanism for periodically assessing the initiatives, and implemented numerous initiatives. Based on our review of DOD’s efforts to improve asset visibility, we are adding an additional action aimed at improving the monitoring of the individual improvement initiatives, which results in three remaining actions and outcomes that need to be addressed for removal of asset visibility from the High-Risk List. Going forward, DOD needs to show measureable and sustained positive outcomes in addressing these remaining three actions and outcomes.

Monitoring

assess, and refine as appropriate, performance measures by, for example, incorporating the attributes (e.g., clear, quantifiable, objective, and reliable) of successful performance measures; and take steps to incorporate into after-action reports information relating to performance measures for the asset visibility initiatives.

Demonstrated Progress

DOD should demonstrate sustained progress in having implemented the initiatives that result in measurable outcomes and progress towards realizing the goals and objectives in the Strategy.

Additional Details on What GAO Found

Inventory Management

Senior officials, such as the Deputy Assistant Secretary of Defense for Supply Chain Integration (DASD(SCI)), have continued to demonstrate commitment and top leadership support for addressing the department’s inventory management challenges. These officials have taken actions, such as establishing a performance management framework to monitor and implement its corrective action plan since 2010 and revising inventory management policy and guidance, to institutionalize this commitment to help ensure the long-term success of the department’s efforts. In addition, senior DOD officials have met with us to discuss the department’s plans and progress in addressing inventory management challenges, and we have provided feedback on the department’s efforts.

Capacity

DOD has continued to demonstrate that it has the capacity—personnel and resources—to strengthen inventory management. DOD has continued to use structured working groups, which include representatives from each of the military services and the Defense Logistics Agency (DLA), to address inventory management weaknesses. Furthermore, DOD has dedicated financial resources to evaluating aspects of inventory management that need improvement, such as commissioning studies designed to improve forecasting for spare parts.

Action Plan

DOD has continued to implement its corrective action plan, established in fiscal year 2010, that had actions and goals scheduled through fiscal year 2016, and has developed a follow-on improvement plan to guide efforts through 2020. As noted in our February 2015 update, DOD established overarching goals to reduce “on-order excess inventory” (i.e., items that have already been purchased but may be excess due to changes in requirements) and “on-hand excess inventory” (i.e., items that have been categorized for potential reuse or disposal). Additionally, DOD’s actions in its original and follow-up plans address key root causes of weaknesses in its inventory management, such as excess inventory and demand forecasting for spare parts. Since our February 2015 update, DOD has continued to implement actions associated with the plan across a number of areas of inventory management, such as demand forecasting, and has developed and begun implementing a follow-on improvement plan with actions and milestones intended to guide the department’s improvement efforts through 2020.

Monitoring

DOD has continued to use a performance management framework, including metrics and milestones, to track the implementation and effectiveness of the areas of inventory management included in the corrective action plan. The DASD(SCI) oversees implementing the corrective action plan and monitors performance on the associated metrics through progress review meetings with representatives from the military services and DLA. The meetings are held about monthly.

Demonstrated Progress

Since fiscal year 2010, DOD has demonstrated sustained progress sufficient to remove the inventory management area from the supply chain management high-risk category. Specifically, DOD has demonstrated progress in the following four key areas of inventory management, and used our findings and implemented our recommendations to improve the department’s management of inventory:

Reducing excess inventory: Since fiscal year 2009, DOD has reduced the percentage and value of its on-order excess inventory— items already purchased that may be excess due to subsequent changes in requirements—and its on-hand excess inventory—items categorized for potential reuse or disposal. DOD’s data show that the proportion of on-order excess inventory to the total amount of on- order inventory decreased from 9.5 percent at the end of fiscal year 2009 to 7.0 percent at the end of fiscal year 2015, the most recent fiscal year for which data is available. During these years, the value of on-order excess inventory also decreased from $1.3 billion to $701 million. DOD’s data show that the proportion of on-hand excess inventory to the total amount of on-hand inventory dropped from 9.4 percent at the end of fiscal year 2009 to 7.3 percent at the end of fiscal year 2015. The value of on-hand excess inventory also decreased during these years from $8.8 billion to $6.8 billion. DOD plans to continue to monitor the amount of excess inventory in its follow-on improvement plan.

Revising policy and guidance: DOD has made key revisions to its inventory management policy and guidance. Based on analysis conducted as part of its corrective action plan, the department updated its main supply chain management policy in February 2014. The update strengthened its guidance for on-order excess inventory, the management of “retention stock” (i.e., inventory calculated to be more economical to keep than to dispose of and repurchase because it will likely be needed in the future or inventory retained to support specific contingencies), and demand forecasting. DOD subsequently continued to update aspects of the guidance, such as adding requirements associated with overseeing contractor-managed inventory in August 2015. DOD also developed and implemented, in March 2016, a guide that standardizes inventory management metrics across the services and DLA. Lastly, DOD developed and began implementing plans to update its policy and guidance as it continues to oversee inventory management through its follow-on improvement plan.

Addressing demand forecasting weaknesses: As we noted in our February 2015 update, DOD has taken actions to improve the accuracy of its demand forecasting for spare parts in an effort to address a key root cause of both excess inventory and parts shortages. First, in fiscal years 2010 through 2014, DOD reviewed its demand forecasting methods, which led to a number of changes in DOD’s guidance to the services and DLA aimed at improving the accuracy of demand forecasting.

Second, DOD established department-wide forecasting accuracy metrics in 2013. Its key metric helped department officials determine that their forecast accuracy has improved from 46.7 percent in fiscal year 2013 to 57.4 percent in fiscal year 2015, the latest fiscal year for which complete data are available. As of August 2016, since our February 2015 update, DOD has been working to establish procedures, including statistical techniques, for setting appropriate targets to continue to guide improvement in the accuracy of forecasting the demand for spare parts.

Third, DOD and DLA, in fiscal year 2013, modified approaches for setting inventory levels for over 495,000 consumable items with low or highly variable demand, and continue to monitor the effect of these changes through a suite of performance metrics. The Air Force also is in the process of implementing a similar method for setting levels for reparable items with low demand and is refining an approach for reparable items with variable demand and conducting additional analysis before deciding to implement it.

Fourth, DOD has made progress improving its collaborative forecasting (i.e., using customer input to forecast demand versus relying solely on statistical forecasting methods) for spare parts. Specifically, we found in June 2016 that DLA partnered with the services to improve collaborative forecasting efforts through an analytical, results-oriented approach, such as regularly monitoring key performance metrics. The approach is tailored for each service, and DOD identified in its follow-on improvement plan that it will analyze these different approaches and assess areas for improvement in an effort to further reduce excess inventory and shortages. DLA also designed an additional metric for its collaborative forecasting program to more accurately assess and manage the program and plans to fully implement the metric by July 2017. DOD also is in the process of designing and adopting metrics to assess the accuracy of inventory planning factors, such as the accuracy of part lists that are used to determine the type and quantity of parts to buy for depot maintenance activities, and plans to implement these metrics by the end of fiscal year 2018.

Enhancing the management and oversight of retention stock: DOD has continued to take actions to improve the management of retention stock across the department. For example, since fiscal year 2009, DOD has monitored the amount of its retention stock relative to on-hand inventory, reviewed and updated its policy and guidance for retention stock, and taken steps to ensure retention stock is managed consistently across the department. Further, in response to our June 2014 recommendation for the DLA Director to dispose of retention stock based on the results of an economic analysis, the Director changed DLA’s on-hand inventory reduction goal, which was leading DLA to dispose of items that the department’s guidance and DLA’s analysis showed were more economical to keep. With respect to “contingency retention stock” (i.e., items retained to support specific contingencies, such as disaster relief or civil emergencies), the department independently assessed its management in March 2011 and implemented resulting recommendations, such as establishing categories and tracking the reasons for retaining contingency retention stock.

Lastly, DOD has used our findings and implemented our recommendations to improve how it manages inventory. Since May 2006, we have made 63 recommendations aimed at improving the efficiency and effectiveness of the department’s inventory management. As of January 2017, DOD has implemented 42 of those recommendations and was in the process of taking actions to implement an additional 13 recommendations, which are focused generally on re-assessing inventory goals, improving collaborative forecasting, and making changes to information technology systems used to manage inventory. The remaining eight recommendations were made in fiscal years 2007 and 2009 and focused on improving the management of acquisition lead times for spare parts and oversight of Army and Navy inventory management, respectively. However, these recommendations are no longer relevant given the department’s efforts since 2010.

Materiel Distribution

Leadership Commitment

Senior leaders have continued to demonstrate commitment and support for addressing the department’s materiel distribution challenges. In April 2015, DOD established a distribution working group to draft a plan of actions and milestones for improving materiel distribution. The working group is co-chaired by the Office of the Deputy Assistant Secretary of Defense for Supply Chain Integration and the U.S. Transportation Command (USTRANSCOM). Other stakeholders include the Office of the Deputy Assistant Secretary of Defense for Transportation Policy, the military services, the Joint Staff, and DLA. As a result of the working group’s efforts, DOD completed its Materiel Distribution Improvement Plan (Improvement Plan), and the Acting Assistant Secretary of Defense for Logistics and Materiel Readiness signed it in September 2016.

According to the Improvement Plan, the Supply Chain Executive Steering Committee will receive regular updates on the progress of the Improvement Plan’s implementation. The steering committee is chaired by the Deputy Assistant Secretary for Supply Chain Integration and includes senior-level supply chain stakeholders from across DOD. Under its charter, the steering committee oversees implementation of initiatives designed to improve logistics.

Capacity

DOD has continued to demonstrate that it has the capacity—personnel and resources—to improve materiel distribution. Key organizations in DOD’s global distribution system and its associated governance structure are USTRANSCOM, its military components, and DLA. Although the Improvement Plan does not quantify the level of resources required to accomplish corrective actions, it recognizes that some additional resources will likely be needed. With regard to developing a new distribution cost metric, for example, the Improvement Plan states that the metric would require a majority of its data inputs from two principal stakeholders—DLA and USTRANSCOM —and that many inputs can be pulled from existing data sources. However, there are likely other sources of information that must be identified or developed, some of which will require additional resources or processes to capture and validate relevant information that is not currently gathered.

According to the Improvement Plan, the distribution governance structure is expected to provide the resources and staff to complete each recommended action in the Improvement Plan and close any identified performance gaps within the time frame specified. The governance structure includes senior DOD officials. At the top of this structure is the Distribution Process Owner Executive Board, which is chaired by the Commander, USTRANSCOM, and whose members are at the 3-Star or Senior Executive Service (SES) equivalent level. The next most senior body, the Distribution Oversight Council, is chaired by the Deputy Commander, USTRANSCOM, and has members at the 1- and 2-Star and SES equivalent level. The Council is tasked with ensuring that high- priority initiatives and enterprise improvements are pursued, commensurate with authorized resources.

Action Plan

Since our February 2015 high-risk update, DOD has taken steps that meet our high-risk criteria for developing a corrective action plan to address the department’s materiel distribution challenges. The Acting Assistant Secretary of Defense for Logistics and Materiel Readiness signed the Improvement Plan in September 2016. According to the Acting Assistant Secretary, the Improvement Plan will guide and direct the department’s efforts to improve materiel distribution support to the warfighter by detailing specific goals and actions to better measure the end-to-end distribution process, ensure the accuracy of underlying data used to measure that process, and strengthen and integrate distribution policies and the governance structure.

The Improvement Plan lists 18 actions divided among 3 lines of effort: (1) metrics and performance, (2) data accuracy, and (3) policy and governance. The intent of these lines of effort and actions is to improve DOD’s capability for measuring the performance of its materiel distribution system, enabling continuous process improvement. According to the Improvement Plan, DOD “must be able to measure performance with certainty across the enterprise before it can affect meaningful improvements in the distribution function.” In addition, the Acting Assistant Secretary of Defense for Logistics and Materiel Readiness states in the Improvement Plan that a robust policy and governance structure ensures that DOD can form, implement, and monitor corrective actions that address root causes and close distribution performance gaps once they are identified.

The Improvement Plan provides time frames for completing each of the 18 actions. It calls for 11 of the actions to be completed within 1 year of the Improvement Plan’s approval, 4 additional actions to be completed within 2 years of the Improvement Plan’s approval, and the remaining 3 actions to be completed within 3 years of the Improvement Plan’s approval. Going forward, DOD’s Distribution Steering Group will assume responsibility for executing the Improvement Plan. The Distribution Steering Group, part of the distribution governance structure, is co- chaired by staff within USTRANSCOM and DLA.

Monitoring

DOD has partially met this criterion. Through its Improvement Plan, DOD aims to improve its capability to measure the performance of the distribution system by developing a suite of distribution performance metrics, improving the quality of data underlying those metrics, and sharing metrics information among stakeholders. While DOD has numerous distribution metrics in place, a team within the Distribution Working Group determined that five metrics should be included in its new suite of metrics. The selected metrics are aimed at addressing various attributes of the distribution system: responsiveness, reliability, information visibility, and efficiency/cost.

The Improvement Plan’s focus on these efforts has the potential, if implemented, to improve DOD’s ability to monitor various performance attributes of its distribution system. However, the Improvement Plan acknowledges that work remains to be done to investigate expanding the use of certain performance metrics, develop other metrics, improve data quality, and change policies to provide greater transparency of performance data and conduct routine reviews of performance metrics.

DOD’s Improvement Plan refers to measuring performance for all legs of the distribution system, including the tactical leg. Specifically, one of the goals in the Improvement Plan is for greater transparency of service, agency, and combatant command distribution performance data, including cost data. The Improvement Plan identifies where a policy change could be made to capture and provide such data. However, the Improvement Plan does not specify the nature of data to be collected from the DOD components or how the data would be integrated with other metrics to measure the performance of all legs of the distribution system, including the tactical leg, and allow DOD to comprehensively monitor and oversee the materiel distribution system.

Demonstrated Progress

DOD began implementing its Improvement Plan in 2016. However, it is too early to assess whether implementing its Improvement Plan will result in the necessary demonstrated progress. However, the Improvement Plan is a key step toward meeting this criterion. Specifically, as discussed above, the Improvement Plan is aimed at improving the department’s capability to comprehensively measure distribution performance. With a performance measurement system in place, DOD will be better positioned to identify distribution problems, along with root causes and solutions.

DOD has identified next steps for implementing its Improvement Plan. According to the DASD(SCI), the Distribution Working Group (which developed the Improvement Plan) will formulate an approach to completing the Improvement Plan’s actions. The Distribution Steering Group will assume responsibility for executing and overseeing the Improvement Plan.

We have previously noted that DOD has made progress in addressing its materiel distribution challenges. For example, DOD was able to improve delivery times for some customers and use available assets more. These efforts, according to DOD officials, resulted in $1 billion in cost avoidances through April 2013. In its Improvement Plan, DOD highlighted initiatives it has taken to improve distribution and noted that efforts to improve asset visibility also benefit materiel distribution. However, challenges remain in addressing materiel distribution weaknesses. As we reported in 2015, current materiel distribution metrics used by the department do not provide decision makers with a complete representation of performance across the entire global distribution pipeline. Further, although joint doctrine has set efficient and effective distribution “from the factory to the foxhole” as a priority, these metrics do not always include performance for the final destination. In addition, DOD may not have sufficiently reliable data to accurately determine the extent to which it has met the standards it has established for distribution performance. DOD’s Improvement Plan is focused on these issues, but it will be important for the department to demonstrate progress in measuring the entire pipeline and ensuring the reliability of its data and measures as implementation of the Improvement Plan evolves.

Asset Visibility

Leadership Commitment

Senior leaders at the department have continued to demonstrate commitment to addressing the department’s asset visibility challenges as evidenced, in part, by DOD issuing, in January 2014 and October 2015, its Strategies for Improving DOD Asset Visibility. The Office of the Deputy Assistant Secretary of Defense for Supply Chain Integration oversees department-wide how the Strategy is developed, coordinated, approved, and implemented, and reviews the implementation of the initiatives. Also, senior leadership commitment is evident in its involvement in efforts to improve asset visibility through groups such as the Supply Chain Executive Steering Committee—senior-level officials responsible for overseeing asset visibility improvement efforts—and the Asset Visibility Working Group; which includes representatives from the components and other government agencies, as needed; identifies opportunities for improvement; and monitors the implementation of initiatives. Sustained leadership commitment will be critical moving forward as the department continues to implement its Strategies intended to improve asset visibility and associated asset visibility initiatives.

Capacity

DOD now meets this criterion. As we previously reported in February 2013 and continued to report in February 2015 resources and investments should be discussed in a comprehensive strategic plan, to include the costs to execute the plan and the sources and types of resources and investments—including skills, human capital, technology, information and other resources—required to meet established goals and objectives. DOD has demonstrated that it has the capacity—personnel and resources—to improve asset visibility. For example, as we previously noted the department had established the Asset Visibility Working Group that is responsible for identifying opportunities for improvement; and monitoring the implementation of initiatives. The Working Group includes representatives from OSD and the components—Joint Staff, DLA, USTRANSCOM, and each of the military services. Furthermore, DOD’s 2015 Strategy calls for the components to consider items such as manpower, materiel, and sustainment costs when documenting cost estimates for the initiatives in the Strategy, as we recommended in January 2015. However, in December 2015 we found that the 2015 Strategy included three initiatives that did not include cost estimates. DOD has taken steps to address this weakness.

Specifically, in December 2016, a DOD official provided an abstract from the draft update to the 2015 Strategy that provides additional direction on how to explain and document cases where the funding for the initiatives is embedded within overall program funding. The draft update notes that there may be instances where asset visibility improvements are embedded within a larger program, making it impossible or cost prohibitive to isolate the cost associated with the specific asset visibility improvements. In these cases, the plan outlining the initiative will indicate that cost information is not available and why. However, if at some point during implementation some or all costs are identified, the information about the initiative will be updated to reflect as such. According to Office of the Secretary of Defense (OSD) officials, DOD plans to issue the update to the 2015 Strategy in 2017, but a release date has not been determined.

Action Plan

DOD now meets this criterion. The National Defense Authorization Act for Fiscal Year 2014 (NDAA) required DOD to submit to Congress a comprehensive strategy and implementation plans for improving asset tracking and in-transit visibility. The 2014 NDAA, among other things, called for DOD to include in its strategy and plans elements such as goals and objectives for implementing the strategy. The NDAA also included a provision that we assess the extent to which DOD’s strategy and accompanying implementation plans include the statutory elements. In January 2014, DOD issued its 2014 Strategy and accompanying implementation plans, which outline initiatives intended to improve asset visibility. DOD updated its 2014 Strategy and plans in October 2015.

We previously reported in February 2013 and continued to report in February 2015 that while the 2014 Strategy and implementation plans serve as a corrective-action plan, there was not a clear link between the initiatives and the Strategy’s goals and objectives. We recommended that DOD clearly specify the linkage between the goals and objectives in the Strategy and the initiatives intended to implement the Strategy. DOD implemented our recommendation and updated its 2015 Strategy, which includes matrixes that link each of DOD’s ongoing initiatives intended to implement the Strategy to the Strategy’s overarching goals and objectives. DOD also added eight new initiatives to its 2015 Strategy and linked each of these efforts to the Strategy’s overarching goals and objectives.

Monitoring

DOD partially meets this criterion. As we previously reported in 2013 and continued to report in February 2015, DOD lacked a formal, central mechanism to monitor the status of improvements or fully track the resources allocated to them. We also reported that, while DOD’s draft strategy included overarching goals and objectives that address the overall results desired from implementing the strategy, it only partially addressed, among other factors, performance measures, which are necessary for DOD to monitor progress. Since February 2015, DOD has taken some steps to better monitor its improvement efforts. As noted in the 2015 Strategy, DOD described a process that tasks the Asset Visibility Working Group—a team that oversees the development and execution of DOD’s Strategy—to, among other things, review the performance of the component’s initiatives during implementation on a quarterly basis. According to OSD officials, they plan to issue an update to the 2015 Strategy, but the release date for this update has not been determined.

The Working Group uses status reports from the DOD components that include information on progress made toward implementation milestones, resources, and funding. DOD also identified performance measures for its asset visibility initiatives. However, the measures for the eight initiatives we reviewed were generally not clear, quantifiable, objective, and reliable. Measures with these attributes can help managers better monitor progress, including determining how well they are achieving their goals and identifying areas for improvement, if needed. Additionally, while the Asset Visibility Working Group has closed initiatives, the Working Group generally did not have information related to performance measures to assess the progress of these initiatives.

As a result, DOD is unable to consistently monitor progress in achieving the Strategies’ goals and objectives. In December 2016, a DOD official provided an abstract from the draft update to the 2015 Strategy that noted that detailed metrics data will be collected and reviewed at the level appropriate for the initiative. High-level summary metrics information will be provided to the Working Group in updates to the plan outlining the initiatives. The extent this planned change will affect the development of clear, quantifiable, objective, and reliable performance measures remains to be determined.

Demonstrated Progress

DOD partially meets this criterion. While DOD has made progress developing and implementing the 2014 and 2015 Strategies, the performance measures associated with the eight initiatives we reviewed cannot be used to demonstrate results. DOD reports it has closed or will no longer review the status of 20 of the 27 initiatives from the 2014 and 2015 Strategies and continues to monitor the remaining seven initiatives. Additionally, in October 2016, DOD officials stated that they plan to add 10 new initiatives in its update to the 2015 Strategy, which will be released in 2017, but OSD officials have not determined a date.

However, DOD has not taken steps to consistently incorporate information in after-action reports on initiatives’ performance measures to demonstrate the extent to which progress has been made toward achieving its goals for improving asset visibility. Without clear and quantifiable performance measures and information to support that progress has been made, DOD may not be able to demonstrate that implementing these initiatives resulted in measurable outcomes and progress towards achieving the goals and objectives in the Strategy. Also, DOD will be limited in its ability to demonstrate sustained progress in implementing corrective actions and resolving the high-risk area.

Benefits Achieved by Implementing Our Recommendations

Inventory Management:

DOD Developed Metrics Guidance and Uses the Metrics to Monitor the Efficiency and Effectiveness of Its Inventory Management: In 2012, we found that DOD was developing metrics to assess the effectiveness and efficiency of its inventory management, but that it had not determined if it would incorporate these metrics into guidance. We noted that without guidance specifying standardized definitions, methodologies, and procedures for data collection procedures, DOD’s efforts to employ metrics to monitor and evaluate inventory management performance may be hampered.

To ensure sustained management attention consistent with results- oriented management practices, we recommended that the Secretary of Defense direct the Assistant Secretary of Defense for Logistics and Materiel Readiness to (1) develop and implement guidance that establishes a comprehensive, standardized set of department-wide inventory management metrics, including standardized definitions and procedures for measuring and reporting the metrics, and (2) employ these metrics in periodically monitoring the effectiveness and efficiency of its inventory management practices. Based on our recommendations, the Assistant Secretary of Defense for Logistics and Materiel Readiness developed and issued the Supply Chain Metrics Guide in March 2016. This guide identifies a comprehensive, standardized set of inventory management metrics and identifies each metric’s application, definition, business value, data requirements, computational rules, goals and trends analysis, and connections to other related metrics.

DOD’s metric guidance provided the necessary information to ensure that metrics across the services and the DLA are standardized and can be used to manage the department’s inventory. Also, the DASD(SCI) uses these metrics to regularly monitor the department’s inventory management practices and outcomes. These actions will allow the department to monitor the effectiveness and efficiency of its inventory management practices across the services and the DLA.

The Army Established On-Order Excess Inventory Goals to Guide Performance Improvement: In our April 2015 report on the military services’ inventory management, we found that the Army had not established goals for reducing on-order excess inventory. To improve management and minimize the amount of on-order excess inventory, we recommended that the Secretary of the Army direct the Commander, Army Materiel Command, to develop life-cycle management command-specific goals for the reduction of on-order excess inventory and monitor these goals. Based on our recommendation, in April 2015, the Army established on-order excess inventory goals for its life-cycle management commands and began monitoring its performance against those goals. These actions will provide the Army the ability to better oversee on-order excess inventory and maximize the amount of on-order excess inventory it reduces.

The Navy Established Management Reviews to Improve Oversight of On-Order Excess Inventory: In our April 2015 report on the military services’ inventory management, we found that the Navy did not use management reviews of potential on-order excess inventory based on dollar thresholds, as required by DOD guidance, resulting in a lack of oversight of on-order excess inventory. To help ensure the Navy adequately oversees on-order excess termination decisions, we recommended the Secretary of the Navy direct the Commander, Naval Supply Systems Command, to incorporate graduated management reviews based on dollar value thresholds into its current on-order excess inventory termination practices. Based on our recommendation, as of September 2015, the Navy began management reviews based on dollar value thresholds. This action will provide the Navy the ability to better oversee on-order excess inventory, thereby preventing unneeded inventory from being procured.

DLA Revised Its Fiscal Year 2014 On-Hand Inventory Goal: In our June 2014 report on DLA inventory management, we found that DLA, in order to meet its on-hand inventory goal in fiscal year 2013, disposed of $855 million in inventory that its own economic analyses determined should be kept due to the risk DLA will need to buy the same items again in the future. To ensure that DLA does not dispose of inventory that is more economic to keep, in accordance with DOD guidance, we recommended that the Secretary of Defense direct the Director, DLA, to reassess and, if determined appropriate, revise DLA’s inventory reduction goals and schedule to achieve them in a way that minimizes risks and costs of having to buy items again in the long term. Based on our recommendation, in July 2014, DLA re- examined and documented its on-hand inventory reduction goal for fiscal year 2014. As a result of the review, DLA revised its on-hand inventory goal for fiscal year 2014 from $10 billion to about $10.9 billion. Adjusting its goals will result in DLA needing to dispose of less inventory to meet the goals, which reduces the risk DLA may have to buy the same inventory in the future.

DLA Incorporated On-Order Excess Inventory Metrics into Senior Management Performance Briefings: In our June 2014 report on DLA inventory management, we found that DLA senior management did not regularly review on-order excess inventory performance and that performance across DLA’s aviation, land, and maritime supply chains varied. To improve management and minimize the amount of on-order excess inventory, we recommended the Secretary of Defense direct the Director, DLA, to regularly monitor progress reducing on-order excess inventory through DLA’s senior management performance briefings. Based on our recommendation, in July 2014, DLA began including on-order excess inventory metrics in DLA’s Agency Performance Review, which is reviewed quarterly by the DLA Director and monthly by DLA headquarters senior logistics operations managers. As a result of these actions, senior management will oversee on-order excess inventory performance and guide continued improvement managing its on-order inventory.

DLA Established and Monitors Supply Chain-Specific On-Order Excess Inventory Goals: In our June 2014 report on DLA inventory management, we found that DLA had not established supply chain- specific goals for on-order excess inventory and that performance across DLA’s aviation, land, and maritime supply chains varied. To improve management and minimize the amount of on-order excess inventory, we recommended the Secretary of Defense direct the Director, DLA, to establish and regularly monitor supply chain-specific on-order excess goals that support DLA minimizing its investment in inventory that is not needed to meet requirements and achieving the DOD goal of 4 percent of the total value of on-order inventory by the end of fiscal year 2016.

Based on our recommendation, DLA established supply chain-specific goals of 6 percent in July 2014 that were aligned with DOD goals for fiscal year 2014. In July 2014, DLA also began monitoring supply chain-specific on-order excess inventory performance against DOD’s established department wide goals as part of its monthly Agency Performance Reviews. These actions will provide DLA the ability to guide continued improvement in reducing on-order excess inventory as well as monitor supply chain-specific performance against DOD’s goals.

DLA Is Tracking and Reviewing On-Order Excess Inventory Performance Data: In our June 2014 report on DLA inventory management, we found that DLA had not consistently tracked and reported data to thoroughly measure its efforts to reduce on-order excess inventory. To improve management and minimize the amount of on-order excess inventory, we recommended the Secretary of Defense direct the Director, DLA, to track and regularly review performance data, such as the amount of on-order excess inventory reviewed, modified, or cancelled, and the reasons for not modifying or cancelling, in its inventory management processes. Based on our recommendation, as of June 2016, DLA implemented a monthly report process that reviews performance cancelling of on-order excess inventory as well as the reasons for decisions to retain or cancel on-order excess contracts. As part of this review process, DLA reports bi-annually on the status of its on-order excess inventory, specifically the reasons for retaining on-order excess contracts. These actions will provide DLA the ability to better oversee on-order excess inventory, including tracking and monitoring the reasons for retaining on-order excess inventory.

Asset Visibility:

DOD Made Clear the Linkage between Its Goals and Objectives and Its Asset Visibility Initiatives: In our January 2015 report on DOD’s efforts to improve asset visibility, we found that DOD’s 2014 Strategy included goals and objectives, but these goals and objectives were not linked with the initiatives. We recommended that DOD clearly specify the linkage between the goals and objectives in the Strategy and the initiatives intended to implement the Strategy. In October 2015, DOD issued its 2015 update to its Strategy, which included graphics showing a summary of the initiatives and their alignment to the Strategy’s goals and objectives. As a result of making apparent the alignment between its goals and objectives in the 2015 Strategy and the initiatives intended to implement them, DOD should be better positioned to assess progress toward realizing its goals and objectives.

DOD Included the Elements Considered in Its Cost Estimates for Asset Visibility Initiatives: In our January 2015 report on DOD’s efforts to improve asset visibility, we found that DOD’s Strategy did not specify the specific elements included in its cost estimates, such as human capital, information, and other resources required to meet the goals and objectives. That is, the components provided cost estimates in the plans outlining the initiatives, but generally at an aggregate level without details of the elements included.

We recommended DOD include this information in subsequent updates to its Strategy. As a result, in its 2015 update to its Strategy, DOD provided direction instructing the components to include cost estimates in their plans outlining the initiatives and to include at least the categories of manpower, materiel, and sustainment in these estimates of cost. As a result of updating its Strategy to require the components to include information on the specific elements included in cost estimates, DOD gains insights on the elements considered in developing the cost estimates and the level of detailed cost information it needs to make well-informed decisions about asset visibility.

GAO Contact

For additional information about this high-risk area, contact Zina Merritt at (202) 512-5257 or merrittz@gao.gov or Cary Russell at (202) 512-5431 or russellc@gao.gov.

Related GAO Products

Defense Inventory: Further Analysis and Enhanced Metrics Could Improve Service Supply and Depot Operations. GAO-16-450. Washington, D.C.: June 9, 2016.

Defense Logistics: DOD Has Addressed Most Reporting Requirements and Continues to Refine its Asset Visibility Strategy. GAO-16-88. Washington, D.C.: December 22, 2015.

Defense Inventory: Services Generally Have Reduced Excess Inventory, but Additional Actions Are Needed. GAO-15-350. Washington, D.C.: April 20, 2015.

Defense Logistics: Improvements Needed to Accurately Assess the Performance of DOD’s Materiel Distribution Pipeline. GAO-15-226. Washington, D.C.: February 26, 2015.

Defense Logistics: DOD Has a Strategy and Has Taken Steps to Improve Its Asset Visibility, but Further Actions Are Needed. GAO-15-148. Washington, D.C.: January 27, 2015.

Defense Inventory: Actions Needed to Improve the Defense Logistics Agency’s Inventory Management. GAO-14-495. Washington, D.C.: June 19, 2014.

DOD Weapon Systems Acquisition

Why Area Is High Risk

In March 2016, we reported that the Department of Defense (DOD) expects to invest $1.4 trillion (fiscal year 2016 dollars) to develop and procure its portfolio of 79 major defense acquisition programs. Congress and DOD have long sought to improve how major weapon systems are acquired, yet many DOD programs fall short of cost, schedule, and performance expectations, meaning DOD pays more than anticipated, can buy less than expected, and, in some cases, delivers less capability to the warfighter. With the prospect of slowly-growing or flat defense budgets for years to come, DOD must get better returns on its weapon system investments and find ways to deliver capability to the warfighter on time and within budget.

What GAO Found

Top leadership at DOD is committed to improving the way DOD acquires weapon systems. Since we added this area to our High-Risk List in 1990, DOD has made progress in addressing challenges, such as through the Better Buying Power initiatives outlined by the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics since 2010. Although DOD lacks a comprehensive action plan for fully addressing this high-risk area and its root causes, the Better Buying Power initiatives are a step in the right direction, as DOD has prescribed a number of concrete changes. DOD has partially met the criteria for monitoring by issuing a series of annual performance reports on the portfolio of major defense acquisition programs. In 2016, DOD issued the fourth report in this series. Continuing and expanding this series of reports should help DOD measure its progress over time.

DOD has partially met the criteria for capacity by, for example, updating some policies to enable better outcomes and assessing the acquisition workforce. However, we remain concerned about whether DOD will fully implement its proposed reforms or continue to track progress in meeting workforce goals, as DOD has, in the past, failed to convert policy into practice. DOD has partially met the criteria for demonstrating progress as it relates to the cost and schedules of its weapon programs. Although we reported in March 2016 on the progress many DOD programs are making in reducing their cost, as demonstrated by improvements when measured against cost-growth targets, individual weapon programs are still not conforming to best practices for acquisition, or implementing key acquisition reforms and initiatives that could prevent long-term cost and schedule growth.

Our work reveals that, while there is still cost and schedule growth in major defense acquisition programs, DOD is making progress in decreasing the amount of cost growth realized in the portfolio as a whole. In March 2016, we reported that the total acquisition cost of DOD’s fiscal year 2015 portfolio of 79 programs decreased by $2.5 billion from the previous year. The decrease, however, was due primarily to reductions in a few programs. The majority of individual programs, 42 of the 79, increased in cost.

In terms of schedule, the time it took to deliver initial capabilities to the warfighter increased, on average, an additional 2.4 months. Our analysis also showed evidence that DOD made progress in improving efficiencies in its programs from 2014 to 2015. When we account for increased costs attributable to increased program quantity, 38 programs improved their buying power—that is, the amount of goods procured for dollars spent.

DOD’s major acquisition programs also showed some improvement when measured against the three cost-growth targets we have used to measure DOD’s progress in the weapon system acquisition high-risk area since 2011. Most notably, 72 percent of programs meet the threshold for less than 10 percent growth over the past 5 years, and 76 percent meet the threshold for less than 2 percent growth in the past year, both an improvement over past assessments (see figure 18).

In addition, Congress has been working to reform the process for acquiring weapon systems for several years. In the National Defense Authorization Acts (NDAA) for just the past 5 years, for example, Congress has enacted the following reforms, among others: In the 2013 NDAA, Congress introduced measures to control costs on acquisition programs by requiring DOD to limit the use of cost-type contracts for production, and to open programs to competition at the subcontract level.

In the 2014 NDAA, Congress expanded requirements for cost reporting by requiring DOD to include additional cost and schedule estimates in its annual reports to Congress.

In the 2016 NDAA, Congress made numerous reforms to the acquisition process including requiring more close involvement of the service chiefs; requiring DOD to report on efforts to streamline the requirements, acquisition, and budgeting processes; stipulating the use and contents of an acquisition strategy; and reducing the number of certifications required for programs at milestone reviews.

In the 2017 NDAA, Congress enacted reforms to require modular open system approaches in major programs, further ensure the achievement and reporting of program goals, modify requirements for independent cost estimates, and reorganize the acquisition authority within the Office of the Secretary of Defense.

What Remains to Be Done

At this point, DOD needs to build on existing reforms—not necessarily revisiting the process itself but augmenting it by tackling incentives. Based on our extensive body of work in weapon systems acquisition, DOD could examine best practices to integrate critical requirements, resources, and acquisition decision-making processes; attract, train, and retain acquisition staff and managers so that they are both empowered and accountable for program outcomes; use funding decisions at the start of new programs to reinforce desirable principles such as well-informed acquisition strategies; identify significant risks up front and resource them; explore ways to align budget decisions and program decisions more investigate tools, such as limits on system development time, to improve program outcomes.

Further, we have open priority recommendations related to four acquisition programs that would benefit from greater attention given the size of DOD’s investments in them and their cost, schedule, and performance challenges, including the following: In April 2015, we made one priority recommendation for the F-35 Joint Strike Fighter program, that DOD analyze the affordability of the program’s current procurement plan that reflects various assumptions about future technical progress and funding availability. DOD stated that it would analyze affordability as part of an internal deliberative process culminating in the services’ annual budget request.

We made one priority recommendation for the Littoral Combat Ship program in July 2014. This recommendation stated that the program should successfully complete key tests—such as shock, anti-air warfare self-defense testing, or final survivability assessments— before contracting for additional ships. The Navy’s recent decision to restructure the program alters the timing of our recommendation, but does not change our intent to ensure that the Navy does not continue to commit to additional ships until it demonstrates that it has attained some level of knowledge in key areas, such as ship survivability.

In September 2013, we made three priority recommendations for the lead ship in the Ford-class aircraft carrier fleet, designated as CVN 78. DOD should explore capability trade-offs, update the Ford-class program’s test and evaluation master plan to allot sufficient time for testing, and adjust the post-delivery test schedule to ensure that system integration testing is completed prior to operational testing. DOD has made progress in implementing these recommendations by, for example, completing a cost-benefit analysis to determine the acquisition strategy for the follow-on ship. DOD, however, failed to fully explore capability trade-offs, and it remains to be seen whether additional time has been allotted to complete testing, as an updated test and evaluation master plan has not been approved.

We made two priority recommendations in April 2013 for the Missile Defense Agency and its programs. We recommended that the agency both stabilize its acquisition baselines to enable meaningful comparisons over time and make its cost estimates more comprehensive by including military services’ operation and support costs. While DOD generally concurred with our recommendations, the Missile Defense Agency’s baselines continue to change, and agency decision makers still have not been informed of full program costs.

Finally, Congress has an important role to play in advancing weapon system acquisition reform overall, particularly in what it sanctions via funding approvals. Programs that propose optimistic or rushed acquisition strategies represent opportunities for Congress to either maintain or change the defense acquisition culture—a prevailing set of incentives that encourages decisions to go forward with programs before they are ready, and a willingness to accept cost growth and schedule delays as the likely byproduct of such decisions. When programs that do not follow acquisition best practices are denied funding approval, those risky acquisition strategies, in effect, lack congressional sanction.

Additional Details on What GAO Found

Leadership Commitment

DOD has met the criterion for leadership commitment. DOD continues to demonstrate a strong commitment, at the highest levels, to improving the management of its weapon system acquisitions. Over the past 6 years, the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics has implemented a series of efforts for acquisition reform through its Better Buying Power initiative. In January 2015, DOD updated its acquisition instruction, furthering this commitment as it incorporates many of the Better Buying Power initiatives, as well as acquisition reforms from the Weapon Systems Acquisition Reform Act of 2009 and other legislation. These actions are consistent with our past findings and recommendations.

If these initiatives are to have a lasting, positive effect, however, decision makers need to be held accountable for implementing them. Our recent work shows there is much ground yet to cover.

Capacity

DOD has partially met the criterion for capacity. Across the portfolio, DOD has unevenly implemented knowledge-based acquisition practices that might prevent or mitigate cost growth. When we assessed DOD weapon programs in March 2016, we found that while DOD continues to show progress in following a knowledge-based approach to reduce risk, it has significant room for improvement. While programs that have recently passed through major decision points have demonstrated best practices—such as planning to constrain development times and achieving design stability—key practices like demonstrating technology maturity or controlling manufacturing processes are still not being fully implemented. Of the 17 programs we assessed that had recently passed through one of three key decision points in the acquisition process, only 3 had implemented all of the applicable knowledge-based practices applicable for that decision point. The remaining programs will carry technology, design, and production risks, which increase cost and schedule risks, into subsequent phases of the acquisition process. In March 2016, we also reported that implementation of the Better Buying Power and acquisition reform initiatives varied across programs. While 91 percent of programs successfully implemented “should-cost” initiatives and reported significant cost savings, only 67 percent had established affordability constraints.

In addition, DOD has not completely implemented the direction to improve competition. Of the 12 future programs we assessed in our March 2016 report on selected weapon programs, half did not plan to conduct competitive prototyping before the start of development, and many current programs did not have acquisition strategies to ensure competition through the end of production. Eight current programs reported that they will not take actions to promote any competitive measures before or after development start.

A significant element of capacity is whether the agency has the workforce in place to resolve risks. DOD has made some progress in managing its acquisition workforce. Specifically, in October 2016, DOD issued its updated acquisition workforce strategic plan which, among other things, assessed the current capability of the workforce and identified risks that DOD needed to manage to meet future needs. DOD acknowledged, however, that it will need to develop and implement metrics to track progress towards meeting the four strategic goals identified in its October 2016 strategic workforce plan. Further, the workforce plan does not establish specific career field goals or targets, which will hinder efforts to ensure DOD has the right people with the right skills to meet future needs.

Action Plan

DOD has partially met the criterion for an action plan as it lacks a comprehensive action plan for fully addressing this high-risk area and its root causes, but addresses some of these issues in its Better Buying Power initiatives. Better Buying Power outlines some steps DOD can take across its acquisition portfolio to achieve better results. These initiatives include measures such as setting and enforcing affordability constraints, instituting a long-term investment plan for portfolios of weapon systems, implementing “should cost” management to control contract costs, and eliminating redundancies within portfolios. The initiatives also emphasize the need to adequately grow and train the acquisition workforce.

Monitoring

DOD has partially met the criterion for monitoring progress. In December 2008, we, DOD, and the Office of Management and Budget discussed a set of cost growth metrics and goals to evaluate DOD’s progress on improving program performance for purposes of our high-risk report. These metrics were designed to capture total cost-growth performance over 1- and 5-year periods as well as from the original program estimate on a percentage basis, as opposed to dollar amount to control for the differences in the amount of funding among programs. DOD no longer supports the use of these metrics. We continue to believe that the current metrics have value.

DOD has made some progress in its efforts to assess the root causes of poor weapon system acquisition outcomes, and monitor the effectiveness of its actions to improve how it manages weapon systems acquisition. In 2016, DOD issued the fourth in what is promised to be an annual series of performance reports on its portfolio of major defense acquisition programs. The report examines a wide range of acquisition-related information, such as contract type, contractor incentives, and the effects of statutes and policies to determine if there is any statistical correlation between these factors and good or poor acquisition outcomes. The report is a good step, but DOD needs to continue to refine and enhance this reporting. In addition, the department or Congress should formalize a requirement for the report to ensure it continues despite changes in leadership.

Demonstrated Progress

DOD has partially met the criterion for demonstrating progress. As we reported in March 2016, many DOD programs are making progress reducing costs, as demonstrated by improvements when measured against cost-growth targets. However, individual weapon programs are still not conforming to best practices for acquisition or implementing key acquisition reforms and initiatives that could prevent long-term cost and schedule growth.

Benefits Achieved by Implementing Our Recommendations

Over the past 4 fiscal years, our analyses of DOD’s weapon system acquisitions have resulted in nearly $30 billion in financial savings. We have reported on the F-35 Joint Strike Fighter (JSF) program, DOD’s most expensive aircraft acquisition, for over a decade. A recurring theme in this body of work has been the program’s very aggressive and risky acquisition strategy, particularly the substantial concurrency, or overlap, among development, testing, and production activities. We repeatedly cautioned against procuring large quantities of aircraft before the system design was stable, performance verified through testing, and the manufacturing process capable of efficiently building aircraft at the planned production rates.

We made numerous recommendations aimed at reducing annual procurements, delaying plans to accelerate production, and focusing more time and resources on system development and testing. We amplified this message in annual “Quick Look” reports, congressional testimonies, and numerous budget justification reviews. Defense officials acknowledged the concurrency in the JSF acquisition strategy, but stated that the risks were manageable.

DOD’s position started to change, however, after years of cost growth and schedule delays. Consistent with our findings and recommendations, DOD decreased near-term procurement quantities by 103 aircraft for fiscal years 2013 and 2014 at a budgeted savings of about $9 billion, and by 187 aircraft for fiscal years 2015 through 2017 at a budgeted savings of about $12 billion. Congressional defense committees have depended on our work to provide accurate and realistic information to inform the ongoing debate on the F-35, and both congressional leaders and top DOD officials have noted that we were right about concurrency and the need to decrease annual aircraft purchases.

In addition, as part of our annual work on the Ballistic Missile Defense System and assessments of defense-wide funding requests for research, development, test and evaluation, and procurement, we reported to Congress several times from March 2011 to April 2013 on the high acquisition risks and lack of analysis supporting the Precision Tracking Space System (PTSS). PTSS was designed as a satellite system to track ballistic missiles. We found that the program had developed an optimistic acquisition approach, including elevated levels of concurrency, and faced significant design challenges. This approach would have precluded demonstrations that the laboratory satellite design worked as intended before the Missile Defense Agency committed to industry-built satellites. DOD canceled the PTSS program in 2013 because of concerns with the program’s high-risk acquisition strategy and technical challenges that we raised, saving approximately $2.7 billion in planned funding for fiscal years 2014 through 2018.

GAO Contact

For additional information about this high-risk area, contact Michael J. Sullivan, Director, Acquisition and Sourcing Management at (202) 512- 4841 or sullivanm@gao.gov .

Related GAO Products

F-35 Joint Strike Fighter: Continued Oversight Needed as Program Plans to Begin Development of New Capabilities.GAO-16-390. Washington, D.C.: April 14, 2016.

KC-46 Tanker Aircraft: Challenging Testing and Delivery Schedules Lie Ahead. GAO-16-346. Washington, D.C.: April 8, 2016.

Defense Acquisitions: Assessments of Selected Weapon Programs. GAO-16-329SP. Washington, D.C.: March 31, 2016.

Defense Advanced Research Projects Agency: Key Factors Drive Transition of Technologies, but Better Training and Data Dissemination Can Increase Success. GAO-16-5. Washington, D.C.: November 18, 2015.

Ford Class Aircraft Carrier: Poor Outcomes Are the Predictable Consequences of the Prevalent Acquisition Culture. GAO-16-84T. Washington, D.C.: October 1, 2015.

GPS: Actions Needed to Address Ground System Development Problems and User Equipment Production Readiness. GAO-15-657. Washington, D.C.: September 9, 2015.

Weapon System Acquisitions: Opportunities Exist to Improve the Department of Defense’s Portfolio Management. GAO-15-466. Washington, D.C.: August 27, 2015.

Defense Acquisition Process: Military Service Chiefs’ Concerns Reflect Need to Better Define Requirements before Programs Start. GAO-15-469. Washington, D.C.: June 11, 2015.

Defense Acquisitions: Better Approach Needed to Account for Number, Cost, and Performance of Non-Major Programs. GAO-15-188. Washington, D.C.: March 2, 2015.

Acquisition Reform: DOD Should Streamline Its Decision-Making Process for Weapon Systems to Reduce Inefficiencies. GAO-15-192. Washington, D.C.: February 24, 2015.

F-35 Joint Strike Fighter: Assessment Needed to Address Affordability Challenges. GAO-15-364. Washington, D.C.: April 14, 2015.

Littoral Combat Ship: Additional Testing and Improved Weight Management Needed Prior to Further Investments. GAO-14-749. Washington, D.C.: July 30, 2014.

Ford-Class Carriers: Lead Ship Testing and Reliability Shortfalls Will Limit Initial Fleet Capabilities. GAO-13-396. Washington, D.C.: September 5, 2013.

Missile Defense: Opportunity to Refocus on Strengthening Acquisition Management. GAO-13-432. Washington, D.C.: April 26, 2013.

DOD Financial Management

Why Area Is High Risk

Since 2015, the Department of Defense’s (DOD) progress in improving its financial management processes and operations has been mixed. Without reliable, useful, and timely financial information, DOD is severely hindered in making sound decisions affecting the department’s operations.

DOD financial management was first added to our High-Risk List in 1995. Long-standing, uncorrected deficiencies with DOD’s financial management systems, business processes, financial manager qualifications, and material internal control and financial reporting weaknesses continue to negatively affect DOD’s ability to manage the department and make sound decisions on mission and operations. Having sound financial management practices and reliable, useful, and timely financial and performance information is important to help ensure accountability over DOD’s extensive resources and efficiently and economically manage the department’s assets and budgets. This is particularly important because DOD’s reported discretionary spending makes up about half of the federal government’s reported discretionary spending, and its reported assets represent more than 70 percent of the federal government’s reported physical assets. However, DOD remains one of the few federal entities that cannot demonstrate its ability to accurately account for and reliably report its spending or assets. DOD’s financial management problems remain one of three major impediments preventing us from expressing an opinion on the consolidated financial statements of the federal government.

The effects of DOD’s financial management problems extend beyond financial reporting. Long-standing internal control deficiencies have adversely affected the economy, efficiency, and effectiveness of operations. For example, as we have reported, DOD’s financial management problems have contributed to (1) inconsistent and sometimes unreliable reports to Congress on weapon system operating and support costs, limiting the visibility that Congress needs to effectively oversee weapon system programs; and (2) an impaired ability to make cost-effective choices, such as deciding whether to outsource specific activities or how to improve efficiency through technology. DOD’s efforts to improve its financial management have been impaired by its decentralized environment; cultural resistance to change; lack of skilled financial management staff; lack of effective processes, systems, and controls; incomplete corrective action plans (CAP); and ineffective monitoring and reporting.

Effective financial management is also fundamental to achieving DOD’s broader business transformation goals. However, given DOD’s decentralized environment and hundreds of nonstandard financial management business processes and systems, DOD anticipates it will take several years of effort before it will reach these goals. Current budget constraints and fiscal pressures make the reliability of DOD’s financial information and its ability to maintain effective accountability for its resources increasingly important to the federal government’s ability to make sound decisions about allocating resources.

The Army, Navy, and Air Force underwent audits of their respective Schedules of Budgetary Activity (Budgetary Schedules) for fiscal years 2015 and 2016. However, all three of the independent public accountants (IPA) that performed these audits issued disclaimers, meaning that the IPAs were not able to complete their work or issue an opinion because they lacked sufficient evidence to support the amounts presented. These IPAs also identified material weaknesses in internal control at the three military services and collectively issued hundreds of findings and recommendations. As of the end of fiscal year 2016, 700 IPA findings and recommendations related to the three military services’ fiscal years 2015 and 2016 Budgetary Schedules remained open. These weaknesses included the military services’ inability to, among other things, reasonably assure that the Budgetary Schedules reflected all of the relevant financial transactions that occurred and that documentation was available to support such transactions.

The results of these audits illustrate the significant amount of work that remains for DOD to have reliable, useful, and timely financial management and performance information for decision making on its mission and operations. In addition, DOD officials reported in the November 2016 Financial Improvement and Audit Readiness (FIAR) Plan Status Report that the department anticipates receiving disclaimers of opinion on its full financial statements for several years but emphasized that being subject to audit will help the department make progress.

What GAO Found

Since 2015, DOD’s progress in improving its financial management processes and operations has been mixed. DOD has made partial progress toward demonstrating leadership commitment and developing capacity and action plans. For example, DOD continues its efforts to address its financial management challenges through (1) updating the FIAR Guidance related to service providers, financial reporting of property, and seven critical capabilities for full audit readiness; (2) implementing training programs to build a skilled financial management workforce; and (3) developing a number of action plans. However, DOD continues to face challenges in monitoring corrective actions and demonstrating progress.

In furtherance of financial management reform, Congress took the following actions during fiscal years 2013 through 2016:

The National Defense Authorization Act (NDAA) for Fiscal Year 2013 established certain requirements for the FIAR Plan, including actions to be taken to ensure that DOD’s Schedule of Budgetary Resources is validated as ready for audit not later than September 30, 2014, and an assessment of readiness for the SBR audit.

The NDAA for Fiscal Year 2014 mandated an audit of DOD’s fiscal year 2018 full financial statements, and that the results be submitted to Congress not later than March 31, 2019.

Further, the NDAA for Fiscal Year 2016 had several relevant financial management provisions that, among other things required coordination with the Federal Accounting Standards Advisory Board to establish accounting standards to value large and unordinary general property, plant, and equipment items no later than September 30, 2017; required the Secretary of Defense to report to Congress, ranking the military departments and defense agencies in order of how advanced they are in achieving auditable financial statements; provided for DOD Office of Inspector General (OIG) involvement in each DOD component’s annual audit, including obtaining an audit of each component by an independent external auditor, participating in selecting the auditors, and monitoring the audits; required the financial audit reports issued by the independent external auditors to be submitted to the Under Secretary of Defense (Comptroller), Controller of the Office of Management and Budget’s (OMB) Office of Federal Financial Management, and appropriate congressional committees; and authorized the Secretary of Defense to carry out a pilot program allowing financial management personnel to temporarily exchange between DOD and contractors.

Congressional oversight committees have continued to press for increased progress at DOD through hearings.

What Remains to Be Done

Leadership

DOD needs to assure the sustained involvement of leadership at all levels of the department in addressing financial management reform and business transformation. DOD leadership has stated that it is committed to achieving effective financial management controls to support financial accountability and reliable and timely information for day-to-day management decision making, and auditable financial statements. However, DOD reported in its November 2016 FIAR Plan Status Report that because some remediation actions and major system and process changes will not be fully completed, it expects the fiscal year 2018 full financial statements audit to result in significant audit findings and a disclaimer of opinion. In addition, DOD reported that it anticipates receiving disclaimers of opinion on its financial statements for several years. DOD leadership needs to reasonably assure that DOD components adhere to the processes in the FIAR Plan and the accompanying FIAR Guidance so that components have effective leadership, processes, systems, and controls in place to sustainably improve DOD’s financial management operations and audit readiness. Sustained leadership commitment is critical to DOD’s success in achieving financial accountability and in providing reliable information for day-to-day management decision making as well as financial audit readiness.

Capacity

DOD needs to continue building a workforce with the level of training and experience needed to support and sustain sound financial management. DOD needs to address the availability of financial management staff in light of the mandatory workforce reductions at headquarters. In addition, to continue building a skilled and knowledgeable workforce, DOD needs to assure that its financial management certification program continues developing and refreshing required competencies, periodically assessing the workforce’s capabilities, identifying competency gaps, and closing those gaps.

DOD needs to continue to develop and deploy enterprise resource planning (ERP) systems as a critical component of DOD’s financial improvement and audit readiness strategy. DOD also will need to strengthen automated controls or design manual workarounds for the remaining legacy systems to satisfy audit requirements and improve data used for day-to-day decision making. The DOD OIG has reported that DOD continues to have schedule delays in effectively implementing its ERPs. These delays in implementing ERP systems increase the risk that DOD will not have reliable information for making important decisions on mission and operations or meet its goal of being validated as ready for an audit of its full financial statements by September 30, 2017.

DOD needs to address identified deficiencies in service providers’ systems, processes, and controls that affect the reliability of financial data and information used in the related business processes. In addition, each of the components needs to resolve integration issues with DOD service providers. Further, the military services need to work with Defense Finance and Accounting Service (DFAS) management to address suspense accounts and support for adjustments made by journal vouchers.

Action Plan

DOD needs to assure that military services enhance their policies and procedures for developing CAPs and improve processes for identifying, tracking, and remediating financial management related audit findings and recommendations. Improving remediation processes over these deficiencies will be more important in light of the hundreds of findings and recommendations resulting from the fiscal year 2015 and 2016 Budgetary Schedule audits.

DOD needs to effectively implement its FIAR Plan and FIAR Guidance to focus on strengthening processes, controls, and systems to improve the accuracy, reliability, and reporting for the Budgetary Schedule and the SBR and assess the existence, completeness, and valuation of mission- critical assets. It also needs to fully define, in the FIAR Guidance, actions needed to resolve long-standing department and component financial management weaknesses. In taking such actions, DOD should not lose sight of the ultimate goal of implementing lasting and sustainable financial management reform which provides reliable, useful, and timely information for decision making as a routine part of financial management operations. Auditable financial statements would be a natural byproduct of the department’s success.

Monitoring

To effectively monitor its components as they implement the FIAR Guidance and assess and test controls and remediate control deficiencies, DOD needs to establish a process for assuring that financial improvement plans have been effectively implemented. DOD management will need to monitor and assess the progress that the department is making. Additionally, the FIAR Directorate should validate that the military services and other components have achieved the seven critical capabilities. According to the April 2016 FIAR Guidance, these seven critical capabilities are related to DOD’s ability to: (1) produce a universe of transactions; (2) reconcile its Fund Balance with Treasury (FBWT) (i.e., balance its checkbook); (3) provide supporting documentation for material adjustments to its financial records; (4) validate the existence, completeness, and rights of its assets; (5) establish processes to manage and value its assets correctly; (6) establish an auditable process for estimating and recording its environmental and disposal liabilities; and (7) implement critical information technology controls for its financial systems.

DOD should take the following actions: assure that the Navy fully implements the FIAR Guidance for FBWT in the areas of analyzing processes, prioritizing, assessing and testing internal controls, and evaluating supporting documentation to support audit readiness; require the military services to improve their policies and procedures for monitoring their CAPs for financial management related findings and recommendations; improve its process for monitoring the military services’ audit remediation efforts by preparing a consolidated CAP management summary that provides a comprehensive picture of the status of corrective actions throughout the department; and expand the FIAR Plan Status Report so that Congress and other decision makers will have more sufficient information to assess DOD’s current audit readiness status and the improvements that still need to be made.

In addition, with regard to our open priority recommendations, DOD should monitor actions components are taking to direct DFAS to complete actions in response to our recommendations for implementing the requirements in the FIAR Guidance in the areas of planning, testing, and corrective actions; improve DOD processes to identify, estimate, reduce, recover, and report on improper payments to assure these processes fully comply with OMB guidance, the Improper Payments Information Act of 2002, as amended, and the Improper Payments Elimination and Recovery Act of 2010, and reconsider the status of three recommendations made by the House Armed Services Committee Panel on Defense Financial Management and Auditability Reform that the department determined to be met but that we determined to be partially met; these recommendations related to: attesting to audit readiness in each of the FIAR Plan Status including FIAR-related goals in Senior Executive Service performance plans and rewarding and evaluating performance over time based on these goals; and reviewing audit readiness assertions before component senior executive committees.

Demonstrated Progress

Improving the department’s financial management operations—and thereby providing DOD management and the Congress with more accurate and more reliable information on the results of its business operations—will not be an easy task. Key challenges remain, such as allocating the department’s workforce and budget among competing priorities, achieving the critical capabilities detailed in the FIAR Guidance, and executing CAPs to effectively remediate findings and recommendations from IPAs, the DOD OIG, and us.

According to its November 2016 FIAR Plan Status Report, DOD is continuing to work toward undergoing a full financial statement audit for fiscal year 2018; however, it expects to receive disclaimers of opinion on its financial statements for a number of years. This is why it is important for DOD and the military services to improve their processes for identifying, tracking, remediating, and monitoring audit findings and recommendations related to financial management. The military services will need to assure that they enhance their policies and procedures for remediating these findings and recommendations and DOD will need to obtain comprehensive information on the status of CAPs throughout the department in order to fully monitor and report on the progress being made to resolve financial management deficiencies. A lack of comprehensive information on the CAPs limits the ability of DOD and Congress to evaluate DOD’s progress toward achieving audit readiness, especially given the short amount of time remaining before DOD is required to undergo an audit of the department-wide financial statements for fiscal year 2018. Being able to show the progress that the department is making in remediating its financial management deficiencies will be useful as the department works toward implementing lasting financial management reform to ensure that it can generate reliable, useful, and timely information for financial reporting as well as for decision making and effective operations.

Additional Details on What GAO Found

Leadership Commitment

DOD continues to partially meet the leadership commitment criterion. Since the last high-risk update in 2015, the commitment of DOD’s senior leadership to improving the department’s financial management has continued to be encouraging. The statements, testimony, and actions of senior leaders have emphasized the importance of effective financial management and audit readiness to DOD’s stewardship over the substantial funding and other resources entrusted to the department.

In response to statutory requirements and targets, DOD leadership directives have set out a strategy and methodology for improving DOD’s financial management through the FIAR Plan Status Reports and FIAR Guidance. DOD’s current FIAR strategy and methodology focuses on four priorities—budgetary information, proprietary accounting and information, mission critical asset information, and valuation—with overall goals of improving the department’s financial management operations, helping provide service members with the resources they need to carry out their mission, and improving stewardship of the resources entrusted to DOD by the taxpayers. DOD Comptroller officials meet regularly with us for a constructive exchange of information on the status of DOD and component actions and to help sustain progress toward the FIAR goals.

The April 2016 FIAR Guidance incorporates recent policy updates related to integrating service providers and financial reporting on existence, completeness, and valuation of property. It also defines seven critical capabilities that reporting entities must address prior to asserting full audit readiness. According to DOD, the approach to achieving full financial statement auditability by September 30, 2017, relies upon each DOD component and service provider addressing the seven critical capabilities in a timely manner; failing to do so will put the entire department’s strategy at risk.

Capacity

DOD continues to partially meet the capacity criterion. DOD faces capacity challenges because (1) its financial management personnel are insufficient in number, qualifications, and expertise; (2) its legacy financial systems data and ERPs lack the necessary standardization and reliability to support generating financial statements and related data; and (3) its service providers’ audit readiness activities are not fully integrated with respective DOD components’ audit readiness activities. DOD continues to identify the need for sufficient numbers of qualified and experienced personnel as a challenge to achieving its goals of financial improvement and audit readiness. In the November 2016 FIAR Plan Status Report, DOD reported that audit readiness resources are expected to decline across the department as audit readiness activities continue to rise. For example, DOD reported that new financial statement audits will increase the work demands on headquarters staff. However, since the department has been mandated to reduce its headquarters workforce by fiscal year 2020, this additional work could exacerbate the demands on the workforce. In addition, the Defense Health Program reported that resources needed to concurrently support audit readiness and financial management operations exceed the capacity of its available resources. Similarly, the Army identified resource constraints and the timing of its fiscal year 2016 Schedule of Budgetary Activity audit as challenges to its ability to remediate audit findings related to its ERP systems. Further, DOD reported in its November 2016 FIAR Plan Status Report that resource needs for financial statement audits will likely increase as the scope of the audits expand and work to correct audit findings increases.

DOD has undertaken efforts to increase the knowledge and skills of its financial management workforce by implementing its financial manager certification program. However, it will take some time before DOD’s financial management staff achieves the level of training and experience needed to support and sustain financial management as envisioned by the FIAR Plan. Further, DOD’s decentralized management environment may have an effect on the ability of its financial management personnel to gain the requisite expertise to develop and implement needed CAPs. Moreover, while DOD has made progress in financial manager training, it lacks the level of expertise needed to lead financial management reform across the department.

DOD faces challenges with its systems’ capacity to generate reliable, auditable financial information because it continues to rely on (1) legacy systems and related processes and controls that feed financial information to component general ledger systems and (2) general ledger systems, including ERP systems, that do not meet federal accounting standards, U.S. Standard General Ledger (USSGL) requirements, federal financial management system requirements, and DOD’s Standard Financial Information Structure. DOD continues to report that relying on legacy systems is a challenge. This is because legacy systems produce data that are not standardized and are therefore difficult to reconcile to the financial statements. Many legacy systems will still be in use when the audit of DOD’s fiscal year 2018 full financial statements must commence. In its May 2016 FIAR Plan Status Report, DOD discussed continuing challenges regarding the large number of business and financial systems and the level of effort and cost of developing and maintaining an audit- ready systems environment.

DOD continues to implement and upgrade various ERP systems to establish an audit-ready systems environment. However, because these systems were not always designed to capture transaction-level information that can be tied to original supporting documents, significant time will be needed to make necessary modifications to assure that they generate reliable financial information. DOD components have varying plans for correcting system deficiencies; for some components, completion dates have either not been determined or extend into fiscal year 2019.

DOD uses service providers to improve efficiency and standardize business operations in various functional areas, including accounting, personnel and payroll, logistics, contracting, and system operations and hosting support. DOD service providers and their business systems are fundamental to reliable accounting and reporting and financial audit readiness. For example, to process and record payments to contractors, DOD components depend on over a dozen systems owned and operated by service providers and on nonstandard business processes that need to link between the components and service providers. This complex level of interdependency increases the difficulty of identifying the systems that need to be modified, upgraded, or eliminated to support financial management improvement and audit readiness and the difficulty of defining critical roles and responsibilities for carrying out such actions.

The FIAR Guidance calls for examinations of DOD service providers’ systems, processes, and controls. The IPAs that conduct these examinations have continued to identify deficiencies in service providers’ systems, processes, and controls that affect the reliability of financial data and information used in the related business processes. Each of the components has identified integration with DOD service providers as a challenge to completing financial improvement initiatives and audit readiness efforts. For example, the Army has expressed concerns about service providers’ abilities to provide timely responses to auditor samples, data requests, and sufficient supporting documentation. In addition, the Marine Corps has expressed concerns about the ability of service providers to provide supporting documentation for existence, completeness, rights, and valuation of Marine Corps assets. Further, the military services have expressed concerns about how DFAS manages suspense accounts and provides supporting documentation for adjustments made by journal vouchers.

Action Plan

DOD continues to partially meet the action plan criterion. While the military services have developed, implemented, and validated many corrective actions, DOD’s limited progress in making needed financial management reform can be attributed to its decentralized management environment and cultural resistance to change, which have significantly impeded the department’s ability to modernize and transform business processes, systems, and controls. Sound financial management practices and reliable, useful, and timely financial information are important to help ensure accountability over DOD’s extensive resources and to efficiently and economically manage the department’s assets and budgets. Under DOD’s nonstandard, decentralized environment, each component is responsible for following steps in OMB’s guidance and DOD’s FIAR Guidance for addressing financial management related findings and recommendations reported by external auditors, including steps to (1) identify and track them, (2) prioritize them, (3) develop CAPs to remediate them, and (4) monitor the implementation status of the CAPs.

However, we found that the remediation processes designed by each military service had deficiencies in one or more of these areas. For example, each military service’s policies and procedures lacked sufficient controls to reasonably assure that they identified and tracked the complete universe of open findings and recommendations related to financial management. Without identifying and tracking the complete universe of unresolved deficiencies, the military services cannot reasonably assure that the deficiencies will be addressed in a timely manner, which can ultimately affect the reliability of financial information and the auditability of their financial statements.

The need to effectively implement financial management remediation processes has become more important in light of (1) the hundreds of findings and recommendations that resulted from the fiscal year 2015 and 2016 Budgetary Schedule audits, (2) future audits that will have a broader scope of work and may therefore identify additional findings and recommendations, and (3) the short period remaining before DOD is required to undergo a full financial statement audit for fiscal year 2018.

DOD components have self-identified completion dates for achieving the seven critical audit readiness capabilities for both their general funds and working capital funds in coordination with their service providers. As reported in DOD’s November 2016 FIAR Plan Status Report, most of DOD’s audit readiness tasks and associated audit readiness milestones have planned completion dates in fiscal year 2017. DOD faces significant challenges, given its limited progress in assuring it can attain the seven critical capabilities and the volume and magnitude of open audit findings and recommendations that still need to be addressed from the fiscal year 2015 and 2016 Budgetary Schedule audits of the Army, Navy, and Air Force.

To date, the efforts of DOD components to implement the FIAR Guidance have not fundamentally transformed systems and operations as necessary to produce reliable, useful, and timely information for day-to- day decision making on mission and operations. Resolving these deficiencies also will be crucial to DOD’s efforts to meet the statutory requirement to undergo a full financial statement audit for fiscal year 2018. However, much work remains to be completed in order for this date to be met. In its November 2016 FIAR Plan Status Report, DOD stated that readiness to undergo an audit does not mean that it expects to receive a positive opinion and that it is important to continue the audit regimen in order to gain valuable information from its early audit efforts, information that will help focus the department’s corrective actions in the most critical areas.

Monitoring

DOD has not met the monitoring criterion. Effective monitoring requires instituting a program to monitor and independently validate the effectiveness and sustainability of corrective measures. However, as we have reported, while the DOD Comptroller has established several elements of a department-wide audit readiness remediation process, the DOD Comptroller does not obtain the complete, detailed information on all corrective action plans (CAP) from the military services related to the department’s critical capabilities necessary to fully monitor and assess DOD’s progress. Specifically, DOD does not prepare a consolidated management summary that would provide a comprehensive, department- wide picture of the status of CAPs needed for audit readiness that includes all of the elements that are recommended by the Implementation Guide for OMB Circular A-123. As a result, reports to external stakeholders, such as Congress, on the status of audit readiness do not provide comprehensive information on progress against the CAPs, limiting the ability of DOD and Congress to evaluate DOD’s progress toward achieving audit readiness, especially given the short amount of time remaining before the statutorily required full financial statement audit for fiscal year 2018. Further, the lack of comprehensive information on the status of CAPs increases DOD’s risk that it will not be able to fully, timely, and efficiently correct its long-standing deficiencies.

In addition, we reported that DOD’s FIAR Plan Status Reports do not provide adequate visibility for Congress and other decision makers regarding the extent to which DOD has addressed certain internal control deficiencies that it refers to as deal-breakers. For example, the status reports do not include information on (1) audit assertions made without correcting internal control deficiencies along with actions and plans to remediate the deficiencies and (2) details of military services’ actions taken and progress made toward correcting the underlying deficiencies for reported deal-breakers. Without greater visibility of the status of DOD’s audit readiness or progress toward reported completion dates in its FIAR Plan Status Report, Congress and other decision makers may not have sufficient information to assess DOD’s current audit readiness status and the improvements that still need to be made.

DOD has not effectively implemented the FIAR Guidance because, in part, it lacks effective monitoring to assess the effectiveness of controls and the remediation of control deficiencies. For example, we reported that the Navy did not fully implement the FIAR Guidance for reconciling its FBWT in the areas of process analysis, prioritization, internal control assessment and testing, and evaluation of supporting documentation to support audit readiness. In addition, each of the IPAs that performed audits of the military services fiscal year 2016 Budgetary Schedules identified deficiencies in monitoring information technology controls for its financial systems.

DOD also has challenges with carrying out its strategy in the FIAR Guidance with regard to its critical capabilities. For example, the DOD OIG reported that the Army could not reconcile approximately $207 billion (68 percent) of its outlays, because the Army and DFAS did not coordinate to reengineer business processes when they implemented a new FBWT reconciliation tool. As a result, the DOD OIG reported that the Army cannot demonstrate an effective FBWT transaction-level reconciliation, which DOD identified as one of the deal-breakers to auditability. Furthermore, the DOD OIG reported that Army and DFAS could not adequately support material amounts of year-end adjustments to the Army General Fund financial data during the fiscal year 2015 financial statement compilation. As a result, the data used to prepare the fiscal year 2015 Army General Fund statements were unreliable and lacked an adequate audit trail. The DOD OIG also reported that DOD and Army managers could not rely on the data in the accounting systems when making management and resource decisions. According to the DOD OIG, until these control deficiencies are corrected, there is a considerable risk that the Army General Fund financial statements will be materially misstated and that the Army will not achieve the goal of being audit ready by September 30, 2017.

Demonstrated Progress

DOD has not met the demonstrated progress criterion, showing limited progress in implementing corrective measures to resolve its long-standing financial management challenges. For example, because of difficulties encountered in preparing for an audit of the multi-year Statement of Budgetary Resources (SBR), DOD decided that, beginning with fiscal year 2015, it would limit the scope of the initial audits for all DOD components to current-year budget activity reported on a Budgetary Schedule. This was intended to be an interim step toward achieving the audit of multiple-year budgetary activity required for an audit of the SBR, with subsequent audits including current-year appropriations as well as prior-year appropriations going back to fiscal year 2015. Consequently, the Budgetary Schedules for the Army, Navy, and Air Force for fiscal year 2015 reflected only current year budget activity. As noted above, all three of the IPAs contracted to audit these fiscal year 2015 Budgetary Schedules issued disclaimers, meaning that the IPAs were unable to express an opinion because they lacked sufficient evidence to support the amounts presented.

The IPAs for the three military services also identified material weaknesses in internal control. These weaknesses included military services’ inability to, among other things, reasonably assure that the Budgetary Schedules reflected all of the relevant financial transactions that occurred and that documentation was available to support such transactions. The IPAs for the three military services also issued disclaimers on the three services’ fiscal year 2016 Budgetary Schedules for reasons similar to those identified in the fiscal year 2015 audits. Further, the results of these audits—with hundreds of open findings and recommendations—show the extent and complexity of improvements needed to provide reliable information for financial reporting as well as for sound decision making on mission and operations.

GAO Contact

For additional information about this high-risk area, contact Asif Khan at (202) 512-9869 or khana@gao.gov.

Related GAO Products

DOD Financial Management: Significant Efforts Still Needed for Remediating Audit Readiness Deficiencies. GAO-17-85. Washington, D.C.: February 9, 2017.

DOD Financial Management: Improvements Needed in the Navy’s Audit Readiness Efforts for Fund Balance with Treasury. GAO-16-47. Washington, D.C.: August 19, 2016.

DOD Financial Management: Greater Visibility Needed to Better Assess Audit Readiness for Property, Plant, and Equipment. GAO-16-383. Washington, D.C.: May 26, 2016.

DOD Financial Management: Improved Documentation Needed to Support the Air Force’s Military Payroll and Meet Audit Readiness Goals. GAO-16-68. Washington, D.C.: December 17, 2015.

DOD Financial Management: Additional Efforts Needed to Improve Audit Readiness of Navy Military Pay and Other Related Activities. GAO-15-658. Washington, D.C.: September 15, 2015.

DOD Financial Management: Continued Actions Needed to Address Congressional Committee Panel Recommendations. GAO-15-463. Washington, D.C.: September 28, 2015.

DOD Financial Management: Actions Are Needed on Audit Issues Related to the Marine Corps’ 2012 Schedule of Budgetary Activity. GAO-15-198. Washington, D.C.: July 30, 2015.

DOD Business Systems Modernization

Why Area Is High Risk

The Department of Defense (DOD) spends billions of dollars each year to acquire modernized systems that are fundamental to achieving its business transformation goals, including systems that address key areas such as personnel, financial management, health care, and logistics. While DOD’s capacity for modernizing its business systems has improved over time, significant challenges remain. These challenges include fully defining and establishing management controls for business systems modernization. Such controls are vital to ensuring that DOD can effectively and efficiently manage an undertaking with the size, complexity, and significance of its business systems modernization, and minimize the associated risks. DOD’s effort to modernize its business systems environment has been designated as high risk since 1995.

What GAO Found

DOD has demonstrated elements of leadership commitment and has made progress in this area by taking steps to manage the modernization of its business systems more effectively and efficiently. For example, the department has begun to implement an improved investment management framework and processes, and has established the capacity to use its federated architecture to identify potentially duplicative investments. However, more needs to be done to leverage DOD’s capacity to identify potentially duplicative investments, and to ensure that, among other things, systems are reviewed at appropriate levels as part of the department’s improved investment management framework.

In addition, DOD’s business systems modernization efforts continue to fall short of cost, schedule, and performance expectations, and the department has not yet established an action plan (or plans) highlighting how it intends to improve its use of its business architecture, improve its business system investment management process, or improve its business system acquisition outcomes. The department can leverage the federal information technology (IT) dashboard as a mechanism for beginning to monitor progress in improving its business system acquisition outcomes. Nevertheless, without an action plan, DOD lacks a baseline against which it can monitor broader progress in its business systems modernization efforts.

Further, the National Defense Authorization Act for Fiscal Year 2017 and its accompanying conference report include provisions that might impact how the department will manage its business systems. Specifically, the act establishes a Chief Management Officer and the accompanying conference report calls for the department to develop a plan by June 2017 to implement a more optimized organizational structure and processes to support information management and cyber operations, including the policy, direction, oversight, and acquisition functions associated with, among other things, business systems. The impact of these provisions on the department’s business systems modernization efforts remains to be seen.

Although more needs to be done to address this high-risk issue, DOD has achieved important benefits by implementing our recommendations. For example, fiscal years 2013 and 2014 saw total financial savings of $970 million due to the department cancelling the Air Force’s Expeditionary Combat Support System because of significant cost and schedule overages discovered as a result of increased oversight.

What Remains to Be Done

DOD must more fully demonstrate leadership commitment and progress in implementing critical IT modernization management controls. For example, the department needs to address the provisions of the conference report accompanying the Fiscal Year 2017 National Defense Authorization Act that call for DOD to develop a plan by June 2017 to implement a more optimized organizational structure and processes to support, among other things, business systems. DOD also needs to ensure that its business system investments are managed with the kind of rigor and discipline embodied in relevant acquisition management guidance and best practices so that each investment will deliver expected benefits and capabilities on time and within budget. In addition, DOD should ensure that its information reported on the Office of Management and Budget’s IT Dashboard is reliable and, over time, demonstrates improved achievement of cost, schedule, and performance expectations. DOD should also demonstrate that it is improving its guidance on incrementally developing IT systems to help ensure a timely delivery of needed capabilities, consistent with the Federal IT Acquisition Reform provisions of the Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for 2015.

In addition, DOD needs to take steps to address key portfolio management practices documented in our IT Investment Management Framework. For example, DOD has not yet defined criteria for reviewing defense business systems at an appropriate DOD level based on factors such as complexity, scope, cost, and risk in support of the certification and approval process. DOD also needs to develop plans defining how it will ensure that it is using its federated business architecture to identify and address potentially duplicative investments within its business systems environment.

Further, DOD should demonstrate that plans exist for addressing these various actions and associated recommendations, and that it is monitoring progress against these plans and demonstrating progress and related outcomes. DOD also needs to ensure that it has the appropriate capacity in place by conducting needed human capital analyses.

Additional Details on What GAO Found

DOD’s Business System Acquisition Management

Leadership Commitment

DOD has partially met the criterion for leadership commitment. For example, the department has taken steps to improve its publicly available investment ratings and encourage incremental development. However, more remains to be accomplished before the department can fully demonstrate leadership commitment. In particular, the department needs to take steps to improve the accuracy of the department’s ratings, improve its use of incremental development, and further define expectations for managing its business system investments.

In March 2014, the department revised its chief information officer ratings process for investments presented on the Federal IT Dashboard to take into account additional information about the risk of its investments, such as investment complexity, execution issues, and external risk assessments, including our reports. Establishing an accurate picture of program risk helps department management better understand which investments would benefit from additional oversight. Nevertheless, we reported in June 2016 that investment risk ratings presented on the Dashboard were not consistent with our assessment of investment risks. Specifically, our assessment of 25 DOD programs, 4 of which were defense business systems, determined that 19 of the programs, including all 4 defense business systems, were at a higher risk level than what was presented on the Dashboard.

Moreover, in January 2015, the department revised Department of Defense Instruction 5000.02: Operation of the Defense Acquisition System, which describes an incremental software development approach for IT investments. According to the instruction, the approach has been adopted for many defense business systems. This is partially consistent with the recommendation from our May 2014 report emphasizing the importance of IT investments delivering capabilities in smaller increments over shorter periods of time. However, the instruction does not provide a time frame for how often functionality is to be delivered. As a result, the instruction does not fully address our recommendation, which calls for DOD to update its incremental development policies to ensure that it complies with Office of Management and Budget guidance. This guidance requires federal agencies to deliver usable system functionality every 6 months.

In addition, the results from our recent related work show that the department has not consistently implemented an incremental development approach for all of its major IT investments. Specifically, in August 2016, we reviewed 14 business system projects associated with seven business system investments and found that, in fiscal year 2016, only 8 projects planned to deliver functionality every 6 months. Moreover, only nine projects planned to deliver functionality every 12 months. Six of the projects that had planned to deliver functionality within 6 months were associated with only one of the seven investments. According to DOD officials, the department allows its program managers to determine the appropriate delivery schedule. The officials also noted that a 6-month schedule would be too expensive to implement given the scale of the projects at the department. Nevertheless, until DOD modifies and implements its incremental development policy, it continues to run the risk of failing to deliver major investments in a cost-effective and efficient manner.

In November 2016, DOD officials from the Offices of the Deputy Chief Management Officer, Under Secretary for Acquisition, Technology, and Logistics, and DOD Chief Information Officer stated that the department had developed a draft DOD Instruction focused on improving business system acquisition. This instruction is to provide guidance in areas such as risk management, requirements management, and incremental development. However, as of December 2016, the department had not completed the instruction. In addition, as previously discussed, the impact of provisions included in the National Defense Authorization Act for Fiscal Year 2017, and its accompanying conference report, on DOD business system acquisition management remains to be seen.

Capacity

DOD has not met the criterion for capacity. In May 2013, we reported that the Office of the Deputy Chief Management Officer, which is responsible for annually reviewing and approving the expenditure of funds associated with DOD business systems, had not conducted a human capital analysis and that no plans existed to analyze and address skill gaps, thus limiting the department’s capacity to lead improvement initiatives in these areas. In August 2016, department officials reported that the office had undergone two reorganizational changes and used skill inventories, needs assessments, and gap analyses as part of a strategic approach to human capital planning. However, DOD has not provided evidence of having performed a needs assessment or a gap analysis. In November 2016, an official from the department’s Office of the Under Secretary of Defense for Acquisition, Technology and Logistics stated that the department planned to take additional steps to address human capital needs after issuing its forthcoming instruction on defense business systems.

Action Plan

DOD has not met the criterion for developing an action plan. In particular, the department lacks a plan (or plans) to monitor efforts to manage its business system investments with the rigor and discipline embodied in relevant acquisition guidance and best practices. In October 2016, the Assistant Deputy Chief Management Officer described steps the department is taking to make improvements in this area, but stated that the department has not developed an action plan to address this high-risk area.

Monitoring

DOD has partially met the criterion for monitoring progress. Specifically, the department can leverage the Federal IT Dashboard with more accurate data as a mechanism for beginning to monitor progress in improving its business system acquisition outcomes. However, without an approved action plan for addressing the DOD Business Systems Modernization high-risk area, the department lacks a means to monitor broader progress in making improvements to its business system acquisition management efforts.

Demonstrated Progress

DOD has partially met the criterion for demonstrating progress. As discussed previously, the department has taken steps to improve business system acquisition management. However, it needs to show continued progress as it takes steps to improve its efforts. For example, in our series of reports on DOD major automated information systems, we reported that the department has had mixed success in addressing key acquisition practices, such as risk and requirements management. We also continue to identify examples of business systems that do not meet performance expectations and experience significant cost overruns and schedule slippages.

For example, in March 2016, we reported that the projected cost of the Air Force system that provides financial capabilities, such as cost accounting and collections, had increased about 9 percent from the program’s first February 2012 estimate (from approximately $1.43 billion up to $1.56 billion). Program officials attributed the cost increase, in part, to program scope growth and the addition of software upgrade enhancements. We also reported that this system experienced a 1-year slippage in its full deployment decision date. Program officials attributed this slippage to findings identified in the system’s initial operational test and evaluation report. In addition, the system did not meet five of its nine key performance indicators. In November 2016, DOD officials stated that the system was not deployed as planned and is currently undergoing a critical change. Accordingly, as of November 2016, updated milestones have not yet been established.

DOD’s Business System Investment Management Process

Leadership Commitment

DOD has partially met the criterion for leadership commitment. Specifically, the department has taken steps to improve its business systems investment management process to include defining and implementing policies and procedures for managing portfolio-level investments consistent with our Information Technology Investment Management Framework, and relevant investment management and business system modernization requirements. For example, in July 2015, we reported that DOD was continuing its efforts to further define and implement its defense business system governance framework, called the Integrated Business Framework.

In this regard, the department had taken steps to align its business system certification and approval process with its planning, programming, budgeting, and execution process. According to the department’s February 2015 certification and approval guidance, organizational execution plans, which are to summarize each component’s business strategy for each functional area (e.g., financial management), are to include information about certification requests for the upcoming fiscal year as well as over the course of the department’s Future Years Defense Program.

In addition, DOD has generally concurred with our recommendations to address improvements to its management of business systems. Nevertheless, the department needs to show continued leadership commitment and progress in addressing our associated recommendations as it takes steps to improve its business system investment management process. These recommendations are aimed at ensuring that business systems receive the appropriate levels of review using a tiered investment review board approach, and that strategies for DOD functional areas include all of the critical elements identified in DOD investment management guidance. These critical elements include performance measures to determine progress toward achieving the goals that incorporate all of the attributes called for in the department’s guidance. Further, as previously discussed, the impact of provisions in the National Defense Authorization Act for Fiscal Year 2017, and its associated conference report, on the department’s business systems investment management process remains to be seen.

Capacity

DOD has partially met the criterion for capacity. Although the department has established an investment review board to oversee its portfolio-based investment management process, much still remains to be accomplished to better define and institutionalize this process. For example, as of December 2016, the department had not yet issued an update to its February 2015 Certification Guidance. Officials from the Offices of the Deputy Chief Management Officer, Under Secretary for Acquisition, Technology and Logistics, and DOD Chief Information Officer stated in November 2016 that the department was developing a DOD Instruction aimed at improving the management of defense business systems. According to the officials, updated guidance on defense business systems, including updated certification guidance, will be issued after the instruction is finalized.

In addition, in May 2013, we reported that the Office of the Deputy Chief Management Officer, which is responsible for annually reviewing and approving the expenditure of funds associated with DOD business systems, had not conducted a human capital analysis and had not developed plans to analyze and address skill gaps, thus limiting the department’s capacity to lead improvement initiatives in these areas. In August 2016, department officials reported that the office had undergone two reorganizational changes and used skill inventories, needs assessments, and gap analyses as part of a strategic approach to human capital planning. However, DOD has not provided evidence of having performed a needs assessment or a gap analysis. Nevertheless, in November 2016, an official from the department’s Office of the Under Secretary for Acquisition, Technology and Logistics stated that the department planned to take additional steps to address human capital needs after issuing its forthcoming instruction on defense business systems.

Action Plan

DOD has not met the criterion for developing an action plan. Specifically, the department has not established an action plan (or plans) for addressing gaps in its business system investment management approach. In October 2016, the Assistant Deputy Chief Management Officer described steps the department is taking to make improvements in this area, but stated that the department has not developed an action plan to address this high-risk area.

Monitoring

DOD has not met the criterion for monitoring progress. Specifically, without an approved action plan for addressing the DOD Business Systems Modernization high-risk area, the department lacks a means to monitor progress in making improvements to its business system investment management process.

Demonstrated Progress

DOD has partially met the criterion for demonstrated progress. As discussed previously, the department has taken steps to improve its business system investment management process. However, the department needs to show continued progress in addressing our associated recommendations as it takes steps to improve its business system investment management process. For example, as discussed, in February 2015, the department took steps to align its business system certification and approval process with its planning, programming, budgeting, and execution process. However, as we reported in July 2015, the department’s February 2015 certification and approval guidance does not specify a process for conducting an assessment or call for the use of actual versus expected performance data and predetermined thresholds.

DOD’s Federated Business Enterprise Architecture

Leadership Commitment

DOD has partially met the criterion for leadership commitment for its federated business enterprise architecture. For example, in May 2014, we reported that the department’s Deputy Chief Management Officer required all business systems to be entered into the architecture compliance tool before they could be certified and approved as part of DOD’s business system investment management process. In addition, the Office of the Deputy Chief Management Officer has initiated an effort to improve how the department leverages the architecture, and the department has identified several associated milestones. However, as of December 2016, the department had not demonstrated that this effort and the associated milestones had obtained final approval from the Assistant Deputy Chief Management Officer. In addition, as previously discussed, the impact of provisions in the National Defense Authorization Act for Fiscal Year 2017, and its accompanying conference report, on the business architecture remains to be seen.

Capacity

DOD has met the criterion for capacity by establishing tools and processes intended to improve the department’s efforts to identify potentially duplicative systems by leveraging the federated business enterprise architecture. For example, in 2014, the department completed efforts to automate its business architecture compliance review process. According to officials, this automation will improve the department’s efforts to identify potentially duplicative systems. In addition, the department’s December 2014 problem statement requirements validation guidance called for an enterprise architecture analysis to be conducted to determine if a capability already exists within the organization or elsewhere across the department. Further, the department’s April 2015 business enterprise architecture compliance guidance reinforced this guidance by stating that programs should be examined for potential duplication and overlap during the problem statement requirements analysis process, which is to occur early in a program’s life cycle.

Action Plan

DOD has not met the criterion for developing an action plan. The department has initiated an effort to improve how it leverages the architecture and identified several associated milestones. However, as of December 2016, the department had not demonstrated that this effort and the associated milestones had been approved by the Assistant Deputy Chief Management Officer.

Monitoring

DOD has not met the criterion for monitoring progress. The department has developed a draft plan to improve how it leverages the architecture and identified several associated milestones. However, as of December 2016, the department had not demonstrated that this effort and the associated milestones had been approved by the Assistant Deputy Chief Management Officer. Without approved plans, DOD lacks a means to monitor progress in leveraging its architecture compliance tool.

Demonstrated Progress

DOD has partially met the criterion for demonstrated progress. For example, the department has established the capacity to identify potentially duplicative investments. DOD has also provided examples of benefits attributed, at least in part, to the department’s business enterprise architecture. For example, according to officials from the Office of the Deputy Chief Management Officer, two proposed new defense business system investments were not approved by DOD due, in part, to architecture reviews that revealed the requested capabilities were already available in existing systems. In addition, in November 2016, the department provided examples of programs that had been assessed for potential duplication and overlap based on their associated business activities. Nevertheless, the department has not yet demonstrated that it is actively and consistently using such assessments of potential duplication and overlap to eliminate duplicative systems. The department’s draft plan for improving how it leverages its business architecture acknowledges this gap and identifies steps the department can take to improve.

Benefits Achieved by Implementing Our Recommendations

In 2013, the department took actions to improve its investment management decision making. For example, the department’s investment management guidance, issued by the Office of the Deputy Chief Management Officer in April 2013, required the precertification authorities to include any open recommendations from us for program weaknesses, as well as a status update on addressing our recommendations as part of the certification requests. These actions help ensure that DOD’s Investment Review Board is provided with identified program weaknesses that can be appropriately considered and thus better inform and justify certification decisions for business systems investments.

In 2014, the department reported all business system certification actions in its annual report to Congress. Specifically, DOD’s 2014 annual report to Congress included, among other things, a list of all certification actions the department took in the previous year on its business systems modernization investments. For example, the report contained an attachment that reported all fiscal year 2014 certification actions, including the amount of funding requested, the amount approved or disapproved, and any conditions placed on funding not certified or conditionally certified.

Additionally, fiscal years 2013 and 2014 saw total financial savings of $970 million due to the department cancelling the Air Force’s Expeditionary Combat Support System because of significant cost and schedule overages discovered as a result of increased oversight.

In 2015, the department demonstrated that it took steps to help ensure that it was appropriately reengineering business processes on defense business systems. In particular, as part of DOD’s fiscal year 2013 certification and approval process, the department placed conditions on certifications for these business systems requiring that a plan be submitted describing how each system would become compliant with business process re-engineering requirements. DOD officials also provided documentation showing that they tracked these conditions. In addition, DOD has reported much higher levels of compliance with business process reengineering requirements in subsequent annual review cycles. For example, for the fiscal year 2014 and 2015 certification cycles, DOD officials reported that only two systems and six systems, respectively, were approved that did not have complete business process reengineering assertions. Moreover, DOD officials provided justifications for why each of these systems did not have complete business process reengineering assertions.

In 2016, the Air Force, Army, and Navy developed a plan for addressing core elements described in our Enterprise Architecture Management Maturity Framework.

GAO Contact

For additional information about this high-risk area, contact Carol C. Harris at (202) 512-4456 or HarrisCC@gao.gov.

Related GAO Products

Information Technology Reform: Agencies Need to Increase Their Use of Incremental Development Practices. GAO-16-469. Washington, D.C.: August 16, 2016.

IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their Major Investments. GAO-16-494. Washington, D.C.: June 2, 2016.

DOD Major Automated Information Systems: Improvements Can Be Made in Reporting Critical Changes and Clarifying Leadership Responsibility. GAO-16-336. Washington, D.C.: March 30, 2016.

DOD Business Systems Modernization: Additional Action Needed to Achieve Intended Outcomes. GAO-15-627. Washington, D.C.: July 16, 2015.

Defense Major Automated Information Systems: Cost and Schedule Commitments Need to be Established Earlier. GAO-15-282. Washington, D.C.: February 26, 2015.

DOD Support Infrastructure Management

Why Area Is High Risk

Since our 2015 high-risk update, the Department of Defense (DOD) has shown some improvement in managing its infrastructure to better achieve reductions and efficiencies, and has partially met each of the five criteria for removal from the High-Risk List. For this update, we are consolidating our evaluation of these two areas based on DOD officials’ assertion that achieving efficiencies in base support is integrated through numerous programs and efforts at the Office of the Secretary of Defense (OSD), military service, and installation levels, and is incorporated in DOD’s overall efforts to efficiently manage its infrastructure. Further, DOD officials stated that the joint basing program is no longer DOD’s primary effort for achieving efficiencies in base support services. For these reasons, we are reframing our evaluation to focus generally on DOD’s efforts to better align DOD’s support infrastructure with the needs of its forces and achieve efficiencies.

DOD manages a global real property portfolio that consists of more than 562,000 facilities—including barracks, commissaries, data centers, office buildings, laboratories, and maintenance depots—located on about 4,800 sites worldwide and covering more than 25 million acres. With a DOD- estimated replacement value of about $880 billion, this infrastructure is critical to maintaining military readiness, and the cost to build and maintain it represents a significant financial commitment.

Since designating this area as high risk in 1997, we have reported on various long-term challenges DOD faces in managing its infrastructure. Specifically, DOD has experienced obstacles reducing excess infrastructure, more efficiently using underutilized facilities, and reducing base support costs, as well as achieving efficiencies by consolidating or eliminating duplicate support services. In our 2015 high-risk update, we categorized the need for improvement into two areas: (1) reducing excess infrastructure, which included disposing of and consolidating facilities under the Base Realignment and Closure (BRAC) process and improving how DOD uses facilities; and (2) achieving efficiencies in base support through joint basing—a program aimed at consolidating support services by combining bases that are in close proximity or adjacent to one another. We reported that DOD retained significant excess capacity relative to its planned force structure; needed to improve the completeness and quality of its information on how it uses facilities to better manage and use them; and had not realized the anticipated cost savings and efficiencies in reducing duplicative support services through its joint basing program.

What GAO Found

As cited previously, since our 2015 high-risk update, DOD has shown some improvement in managing its infrastructure to better achieve reductions and efficiencies, and has partially met each of the five criteria for removal from the High-Risk List. Specifically, DOD has demonstrated leadership by requesting more rounds of BRAC—its primary method for reducing excess infrastructure not needed to support its forces. DOD has also showed some improvement in its leadership commitment, capacity, action plans, monitoring, and progress by increasing the completeness of utilization data, publishing an overarching Real Property Efficiency Plan, communicating and addressing issues on consolidating installation services at the joint bases, and reducing excess infrastructure through the Freeze the Footprint policy. However, DOD needs to take additional steps across all five of our high-risk criteria. For example, DOD has not committed to take action on some of our recommendations related to it implementing any future BRAC rounds, such as improving DOD’s ability to estimate potential liabilities, and savings to achieve desired outcomes. Further, DOD continues to maintain excess capacity in relation to its force structure, including long-standing excess facilities, and needs to ensure accuracy of its real property data to better identify potential areas to reduce and consolidate facilities. DOD also needs to address in its plans any actions geared toward achieving efficiencies in base support services, such as through consolidating services. By acting on our recommendations to strengthen its efforts in each of these areas, DOD will be better positioned to align its support infrastructure with the needs of its forces and achieve efficiencies.

What Remains to Be Done

In April 2016, we provided DOD with a letter that outlined 19 actions and outcomes that we believe it should address in order to correct long- standing weaknesses in its support infrastructure management efforts. Based on discussions with DOD officials and recent efforts across the department, as of January 2017, we believe that DOD has addressed 4 of the 19 actions and outcomes related to capacity, monitoring, and demonstrated progress. Specifically, DOD evaluated the purpose of joint basing and whether its goals are still appropriate, reviewed and prioritized standards to ensure a shared framework for managing base support, provided guidance to the joint bases that directs them to identify opportunities for cost savings and efficiencies, and continued to develop an approach to identify and isolate cost savings resulting from consolidating support services at the joint bases. We also added one action on improving the accuracy and completeness of lease data, which we believe will assist DOD in managing its facilities more efficiently. Going forward, DOD needs to show measureable and sustained progress in addressing the remaining 16 actions and outcomes across each of the 5 criteria for removal from the High-Risk List related to improving implementation of any future BRAC rounds, improving facility utilization data, reducing base support costs, and achieving efficiencies in base support.

In September 2016, we also provided DOD with a letter describing the overall status of DOD’s implementation of our recommendations, and noted specific open recommendations that we believe the department should give high priority to addressing. Included in the letter were 7 open priority recommendations related to improving initial cost estimates, limiting bundling of stand-alone realignments, developing baseline cost data, and establishing reduction targets for any future BRAC, which are also included in the 16 actions that are part of this high-risk update.

DOD needs to take the following 16 actions to satisfy the five high-risk criteria for DOD support infrastructure management: Leadership Commitment: For any future BRAC rounds, DOD needs to commit to improve the process for identifying and entering into Cost of Base Realignment Actions (COBRA) requirements for relocating personnel and equipment, costs for alternatively financed projects, and limiting the practice of bundling multiple stand-alone realignments or closures into single recommendations, or when bundling is appropriate, itemize the costs and savings associated with each major discrete action.

DOD should provide clear direction to the joint bases about goals, time frames, and measures in consolidating base support services.

Capacity: DOD needs to implement guidance on improving utilization data; and, continue to manage the reduction of long-standing excess facilities, such as proactively managing processes to meet historic preservation and environmental requirements and working with host nations to avoid prolonged negotiations over returning excess infrastructure in foreign countries.

Action Plan: DOD needs to include in its plans any actions geared toward reducing duplication or consolidating support services, such as providing measurable goals linked to achieving savings and efficiencies stemming from consolidation at the joint bases.

Monitoring: DOD needs to improve the accuracy and completeness of data, including breaking out the cost and square footage information on multiple properties included in a single lease; in any future BRAC round, commit to improving the fidelity of initial BRAC cost estimates by working with military services and other appropriate stakeholders to fully identify requirements—the cost of military construction, information technology, and relocating personnel and equipment, and alternatively financed projects—and limit bundling multiple stand-alone realignments or closures into single recommendations. When bundling is appropriate, itemize the costs and savings associated with each major discrete action; direct the military departments to develop baseline cost data, including any consolidation resulting from a future BRAC round; and continue to periodically track service-level efforts to reduce excess infrastructure, such as planned service targets to reduce or better use excess space, based on reliable real property data, including information on utilization and leased space.

Demonstrate Progress: DOD needs to establish targets for eliminating excess capacity, consistent with the BRAC selection criteria chosen, for any future BRAC rounds; assess—using better data on the use of space and better monitoring of DOD-level and service-level efforts— whether its goals and efforts need to be reviewed to align space utilization with mission needs; and ensure its plans and programs to achieve reduction goals are implemented and progress monitored, in addition to other actions previously mentioned under the other high-risk criteria.

If Congress authorizes additional BRAC rounds, it may wish to consider amending BRAC legislation to require the Secretary of Defense to formally establish specific goals that the department expects to achieve from a future BRAC process and require DOD to implement our recommendations related to BRAC.

Additional Details on What GAO Found

Leadership Commitment

DOD partially met the criterion for leadership commitment. DOD has demonstrated some top leadership commitment to reducing excess infrastructure and more efficiently managing its infrastructure, but needs to demonstrate further commitment to better managing any future BRAC rounds and providing steps to achieve its joint basing goals, timeframes, and measures in achieving efficiencies in support services. Since 2013, DOD has been successful in reducing excess infrastructure through its past BRAC rounds and has demonstrated leadership in requesting additional BRAC rounds. In addition, since 2013, in coordination with the military services, DOD has developed and implemented more effective and efficient methods to reduce excess infrastructure, such as through more proactively managing DOD’s processes to meet historic preservation and environmental requirements. Additionally, DOD has worked with host nations to avoid prolonged negotiations over returning excess infrastructure in foreign countries.

However, DOD needs to demonstrate additional leadership commitment to ensuring the success of any future BRAC rounds by agreeing to implement key actions we have recommended from reviews of the most recent BRAC round. In March and April 2013, we reported that while the BRAC process was fundamentally sound, the way DOD implemented the 2005 BRAC round at times limited its ability to estimate costs, potential liabilities, and savings to achieve desired outcomes. Specifically, we identified a number of issues with DOD’s process for estimating BRAC costs and savings, which was hindered in many cases by underestimating recommendation-specific requirements that were entered in the COBRA estimation model. For example, the primary reason costs increased for BRAC 2005 was higher-than-anticipated military construction costs—an increase of 86 percent from $13.2 billion originally estimated by the BRAC Commission to $24.5 billion after BRAC implementation ended in 2011. DOD significantly understated initial requirements inputted into COBRA for information technology costs (e.g., realigning supply, storage, and distribution management initially estimated to be $31 million increased to over $190 million).

Also, DOD understated the costs of relocating military personnel positions and equipment, and did not consistently capture all costs associated with alternatively financed projects. We recommended various actions to improve the quality of information that forms the basis for the costs estimates. In written comments to our March 2013 report, DOD officials did not fully concur with these actions, stating that the COBRA model was not meant for the purposes we recommended. However, more recently, they agreed to take additional action to better forecast the initial costs inputted into COBRA related to military construction, information technology, and relocating military personnel positions and equipment, and have already taken some steps to do so, in support of any future BRAC round. Officials did not agree that liabilities from alternatively financed projects need to be consistently captured in the COBRA model, stating that it is difficult to estimate these costs. However, as we stated in the April 2013 report, in cases where the amount of the liability cannot be estimated, modifying the model with a capability to note the existence of a potential liability would provide decision makers with valuable information to inform their deliberations. DOD officials also cautioned that costs can increase during implementation of BRAC recommendations which cannot be easily foreseen, and increases in costs are reported to Congress. We agree that costs can and have increased during the implementation of BRAC recommendations. However, the intent of our recommendations are to improve the information provided to decision makers while they are comparing competing scenarios and making closure and realignment decisions, understanding that ultimate costs may differ from these initial estimates.

Further, DOD bundled multiple BRAC recommendations into single, highly complex recommendations without itemizing costs and savings associated with each separate major action, which limited visibility into the estimated costs and savings for individual closures and realignments and complicated the ability of the Defense Base Closure and Realignment Commission (BRAC Commission) to review the recommendations. We recommended actions to improve the quality of information that forms the basis for the cost estimates by limiting the bundling of recommendations, or if bundling is appropriate, to itemize the costs and savings associated with each major discrete action. In the March 2013 report, DOD did not fully concur with these recommendations, stating that actions are bundled when they relate to a common outcome, and thus need to be viewed comprehensively rather than individually. More recently, officials agreed that when bundling is appropriate during any future BRAC round, they would provide additional details related to costs and savings as needed. We are encouraged by DOD’s agreement that improvements can be made in the quality of the information that supports BRAC cost estimates, and we continue to believe addressing these issues when planning for any future BRAC rounds will help the department improve initial cost estimates and provide a means for better evaluating the proposed closure and realignment recommendations. Improving its planning processes, including the cost estimates, would also help DOD implement the BRAC process more effectively towards reducing excess capacity and provide more confidence to Congress and the public on DOD’s efforts in implementing BRAC actions.

With respect to achieving efficiencies in base support, DOD reported relying on a multitude of efforts and initiatives at the OSD, military service, and installation levels. We have reported on DOD’s progress in implementing its joint basing program, one key initiative aimed at achieving efficiencies in base support. We reported that OSD demonstrated some leadership commitment to addressing issues affecting joint bases by issuing a memo to the Secretaries of the military departments asserting its support for joint basing and clarifying the program goals, but OSD and the military departments have not yet provided detailed guidance on how to meet the goals and related timeframes. DOD’s memo outlined key areas for continual success of the program, including continuing to consolidate installation support functions at the bases. While the 2014 memo did not provide detailed guidance on achieving cost savings and efficiencies or provide for milestones, as we have recommended, it affirmed the purpose and goals of the joint bases and demonstrated a commitment to the program.

Continued leadership by DOD, to include implementing our prior recommendations in any future BRAC rounds and focusing its efforts to reduce duplication of support services for its bases, among DOD’s other efficiency measures, will be important to sustain efforts to more effectively and efficiently align its infrastructure with its needs.

Capacity

DOD partially met the criterion for capacity. DOD demonstrated its capacity to align its infrastructure with its force’s needs by disposing of excess infrastructure during past BRAC rounds, and by consolidating some installation services at the joint bases, among other efficiency efforts. However, DOD needs to ensure the accuracy of its real property data, and implement its utilization guide to improve its ability to identify potential areas to reduce and consolidate its infrastructure. DOD needs to further implement its Real Property Efficiency Plan, which is aimed at disposing of longstanding excess infrastructure.

DOD has improved the way it collects utilization data for its facilities since our 2015 high-risk update, and has issued a guide for calculating utilization to help improve completeness and accuracy of the utilization data. In following up on our September 2014 report recommendations on DOD’s use of its facilities, we found that DOD has utilization data on about 97 percent of its facilities as of September 2015, the most recent data available—increasing from 53 percent as of September 2013. However, the utilization rates entered into DOD’s database are likely not reliable, since a majority of the facilities (85 percent) have the highest possible rate of 100, which indicates full utilization at the same time that DOD believes it has over 20 percent excess facility capacity. In addition, of the facilities that have a rating of 100, 24 percent had either no inspection date or been mostly recently inspected prior to September 30, 1999, which calls into question the accuracy of this data. In December 2016, DOD issued a policy memorandum that provided guidance for calculating utilization to ensure utilization is measured and reported consistently throughout DOD, and to maintain current information on facility utilization. As the guidance is implemented, DOD officials expect improvement in the accuracy of utilization data as facilities are assessed and to increase the completeness of utilization data. Implementing the guidance will help focus DOD’s efforts on reducing excess facility capacity, and should improve information on the utilization of facilities to position DOD to better identify excess facility capacity in support of its efforts to reduce excess infrastructure.

In addition, we reported in September 2011 that long-standing excess facilities—those identified prior to DOD’s demolition program in fiscal 2008—accounted for more than half of the excess inventory DOD identified and may be more costly to eliminate due to historic preservation of certain facilities and environmental issues. We recommended that DOD continue to manage reduction of long-term excess facilities, such as proactively managing processes to meet historic preservation and environmental requirements and working with host nations to avoid prolonged negotiations over returning excess infrastructure in foreign countries. While DOD officials stated that they have been proactively managing historic preservation and environmental requirements, the amount of funding dedicated to future demolition is not consistent with the number of long-standing facilities yet to be demolished. In October 2015, DOD officials developed a DOD Real Property Efficiency Plan that describes DOD’s strategic and tactical approach to managing its real property effectively and efficiently, including reduction targets for fiscal years 2016 through 2020. The plan further provides for how DOD expects to dispose of long-standing excess facilities. However, DOD is in the early stages of implementing the plan, and thus it is too early to assess its results. If implemented effectively, the plan should help DOD improve its capacity and ability to identify excess facilities, and to more effectively and efficiently manage its real property.

We also reported that DOD has shown capacity to consolidate installation services at the joint bases. We reported in November 2012 that the joint bases reported meeting common standards more than 70 percent of the time in fiscal years 2010 and 2011. Also, in September 2014, we reported that the joint bases reported partially consolidating 80 percent of their installation functions. However, we noted that without comprehensively evaluating whether installation support functions were still suitable for consolidation, and without identifying and addressing limitations reported by the joint bases, DOD might not be able to fully consolidate all installation support functions. We recommended that DOD evaluate the support functions identified in its joint base guidance to determine which are still suitable for consolidation, and subsequently identify and make any appropriate changes. In 2015, DOD evaluated the possibility of a European joint base, and removed six support functions that it determined were not suitable because the functions provided limited opportunities for consolidation. In addition, as part of its regular annual review of joint base standards, DOD continues to evaluate which standards are suitable for consolidation. Together, these actions address the intent of our recommendation.

Action Plan

DOD partially met the criterion for having an action plan and has developed plans to better identify and dispose of excess infrastructure, including an overarching Real Property Efficiency Plan. However, these plans do not include actions geared toward improving infrastructure efficiencies related to achieving efficiencies in support services.

DOD developed a number of action plans to reduce infrastructure under various initiatives. These action plans together provide for corrective measures and solutions to reduce excess infrastructure. For example, in October 2015, in response to a requirement under the Office of Management and Budget’s (OMB) Reduce the Footprint policy, DOD officials developed a Real Property Efficiency Plan that describes its strategic and tactical approach to managing its real property effectively and efficiently. This plan addresses our September 2014 recommendation to establish a strategic plan to manage DOD’s real property and facilitate the department’s ability to identify potential consolidation and disposal opportunities. The finalized plan describes goals aligned with the National Strategy for the Efficient Use of Real Property and for reducing the footprint of its real property inventory. The plan also describes the strategies, programs, and methodology for meeting these goals through the real property management policies and procedures of the military departments, and metrics to gauge progress. Implementing the plan, which began in 2016 and is scheduled to run through 2020, will help DOD improve its ability to identify excess facilities and plan for the effective and efficient management of its real property.

However, DOD’s plans, such as the Real Property Efficiency Plan, do not address achieving efficiencies in support services. For example, for the joint base program, DOD has not established an action plan, including corrective measures and a timeline to benchmark progress, for achieving cost savings and efficiencies, as we recommended in November 2012 and September 2014. As a result, joint base commanders are responsible for determining to what extent they will pursue initiatives to reduce redundancy and achieve potential cost savings or efficiencies, and the extent to which such initiatives have been pursued varies by joint base. We continue to believe that having an action plan related to reducing duplication and consolidating installation support services would improve DOD’s efforts to align its infrastructure to its mission needs and lead to efficiencies in the department’s base support efforts.

Monitoring

DOD partially met the criterion for monitoring. DOD has committed to taking actions that would improve its monitoring of any future BRAC rounds, and has demonstrated some ability to monitor its efforts to achieve reductions and efficiencies in infrastructure, but it does not have reliable real property data to effectively monitor property and facility utilization. Specifically, DOD is able to generally monitor excess infrastructure reduced through past BRAC rounds and ongoing property reduction efforts, and has improved its cost data monitoring for the joint bases. For example, DOD has some procedures in place to monitor excess infrastructure reduced from the 2005 BRAC round, the Freeze and Reduce the Footprint policies and each service’s efforts at monitoring its infrastructure. Under the Freeze and Reduce the Footprint policies, OMB directed federal agencies to limit expansion of property (no new facilities without disposing of equivalent facilities), provide real property efficiency plans, and plan for and report on the reduction of property. Through DOD’s Real Property Efficiency Plan, each military department outlines its methods and metrics for identifying and reducing excess infrastructure, and DOD monitors the military departments’ progress towards meeting its reduction goals. However, it is too early to assess the results from the plan since implementation began in 2016 and is scheduled to run through 2020.

While DOD has made progress in improving its monitoring, it needs to improve the reliability of its real property data and the monitoring of costs and savings resulting from any future BRAC rounds. Specifically, as mentioned previously, we reported in September 2011 and September 2014 that DOD does not have reliable real property data to assess how it uses property and facilities. Subsequently, in March 2016 we reported that DOD lacked reliable data to effectively assess how it uses leases. While DOD is taking some steps to address data issues, it cannot fully determine the number, size, and costs of its leases for real property because the real property inventory system that DOD uses to monitor its leased assets contains some inaccurate and incomplete data. For example, we reported that about 15 percent of the lease records for fiscal year 2011 and 10 percent of the records for fiscal year 2013 were inaccurate. We recommended actions to improve the accuracy and completeness of this data, such as breaking out the cost and square footage information on multiple properties included in a single lease. DOD concurred with our findings, but did not concur with our recommended method to update DOD’s database. If DOD does not improve the reliability of its data, the department will continue to be limited in its ability to monitor its reduction of excess infrastructure, identify opportunities to consolidate underutilized facilities, and identify opportunities to reduce reliance on costly leased space by moving DOD organizations into excess facilities.

Further, DOD has committed to taking some actions that would improve the monitoring of costs and savings from any future BRAC rounds, although some additional actions are needed. For example, we made a number of recommendations in March 2013 and April 2013 which would help DOD better monitor the implementation and effectiveness of the BRAC recommendations. DOD officials acknowledged that they could improve the initial estimates in future BRAC rounds, and have reported taking some action to do so, including updating standard factors for information technology as part of the European Infrastructure Consolidation effort. However, DOD also needs to consistently capture liabilities from alternatively financed projects in the COBRA model for any future BRAC round. These actions would provide for better baseline data with which to make decisions as well as to track and monitor the results achieved through any future BRAC rounds. We also reported in February 2016 that DOD’s implementation of certain BRAC recommendations limited its ability to determine cost savings because it lacked baseline cost data. Despite challenges in isolating cost information, without maintaining such information, DOD cannot determine the budgetary effect of implementing actions to achieve reductions and efficiencies in infrastructure.

With respect to improving baseline cost data for the joint bases, in November 2012, we recommended that DOD continue to develop and refine the joint bases common standards in order to eliminate data reliability problems, facilitate comparisons of joint basing costs with the costs of operating separate bases, and isolate costs and savings from the joint basing initiative. DOD partially concurred with our recommendation, and stated that it was working to improve the data’s reliability but found it impractical to isolate and distinguish joint basing cost savings from the savings that result from unrelated DOD- or service-wide actions. DOD provided guidance to the joint bases to correct baseline data and as a result, the quality of the data improved for fiscal years 2012 and 2013, resulting in a 2013 analysis showing that the joint bases cost less to operate than the separate installations. Together, these actions met the intent of our recommendation and provided DOD with an improved picture of the cost of operating the joint bases.

Demonstrated Progress

DOD partially met the criterion for demonstrated progress. DOD has demonstrated some progress in aligning its infrastructure to its forces’ needs by reducing excess infrastructure through BRAC and other service efforts, and in consolidating base support services. Although initially not agreeing to our related recommendations, DOD identified steps to improve the quality of information used to support recommendations for any future BRAC rounds, and improve the accuracy and completeness of utilization data. However, DOD needs to further improve lease data to better identify excess infrastructure for disposal and develop a plan for reducing duplication and consolidating support services to increase the efficiency of the department’s infrastructure services.

DOD has also reduced some excess infrastructure, but needs to develop targets for eliminating excess through any future BRAC rounds, and ensure that its plans and programs to reach reduction goals are implemented and progress monitored. DOD did not concur with our recommendation to develop targets for eliminating excess infrastructure through any future BRAC rounds, stating that having overarching targets would subvert developing actions based on military value. However, in further discussion, DOD officials stated that qualitative goals, such as needing to reduce excess infrastructure, are helpful in focusing efforts and measuring success, but they continued to believe that quantitative goals would be in conflict with BRAC selection criteria. We have reported on the soundness of the BRAC selection criteria and generally endorsed their retention for the future, and do not believe that establishing targets for eliminating excess infrastructure affects DOD’s ability to apply these criteria. While we agree that stating a goal in future BRAC rounds, such as reducing excess infrastructure, is useful, we continue to believe that establishing specific targets would assist DOD in measuring progress in reducing excess infrastructure and not harm the department’s ability to consider military value as its primary selection criteria. Moreover, DOD would retain the ability to exercise military judgement in selecting from among the candidate recommendations to be put forward to the BRAC commission, as was the case in BRAC 2005 and which we have generally endorsed.

The military services have also demonstrated some progress in reducing excess infrastructure. For example, the services have disposed of and demolished excess facilities through their individual efforts, and under the Freeze the Footprint policy DOD has limited construction of new facilities without disposing of equivalent facilities. Further, for fiscal year 2013, DOD reported a net reduction of 7.7 million square feet, which is about 75 percent of the total reduction across the federal government under this policy. As described above, DOD’s Real Property Efficiency Plan outlines goals, strategies and programs to reach goals, and metrics to gauge progress. It will be important for DOD to ensure that the plan is effectively implemented and progress is monitored so that the department can achieve its reduction goals. However, DOD’s progress in reducing excess infrastructure is limited by challenges with long-standing excess facilities and unreliable data related to the use of its facilities and of its leased space. Until DOD improves its capacity and monitoring of efforts aimed at reducing long-standing excess facilities, the department cannot fully demonstrate progress in better aligning its infrastructure to its mission needs.

DOD has demonstrated some progress in achieving efficiencies in base support, such as officials reporting reductions of redundant funded positions, contracts, and procedures at the joint bases. DOD’s data shows that joint bases are obligating less funding than they would have as stand-alone bases, although some of the savings are attributable to other service actions, such as budget cuts unrelated to joint basing, as noted above. Further, DOD instituted mechanisms to facilitate routine communication to encourage jointly resolving common challenges and sharing best practices and lessons learned. DOD also issued a joint basing handbook to address inconsistent service level guidance. However, DOD has not provided clear direction to joint bases on steps needed to reach program goals, and lacks a plan for reducing duplication and consolidating support services.

Benefits Achieved by Implementing Our Recommendations

In October 2015, DOD issued its Real Property Efficiency Plan that describes DOD’s strategic and tactical approach to managing its real property effectively and efficiently. This plan addresses our September 2014 recommendation to establish a strategic plan to manage DOD’s real property and to facilitate the department’s ability to identify potential consolidation and disposal opportunities. The finalized plan describes goals aligned with the National Strategy for the Efficient Use of Real Property and for reducing the footprint of DOD’s real property inventory. The plan describes strategies, programs, and methodology to achieve these goals through the real property management policies and procedures of the DOD property holders—the three military departments and Washington Headquarters Service. The plan also provides baseline amounts and metrics to gauge progress toward goals established in the plan. As a result, we believe that DOD’s plan should help improve its ability to identify excess facilities and plan for effective and efficient management of its real property.

In May 2015, DOD issued a handbook to provide basic information and clarify processes and procedures for the joint bases. The document is intended to serve as a first point of reference for information about the joint bases and the unique policies and guidance that govern them. This handbook, which addresses how joint bases differ from other military installations among other relevant issues, can better inform incoming servicemembers about the particular characteristics of joint bases, as well as reduce duplication or inconsistency in how the joint bases train incoming servicemembers. This document addresses our November 2012 recommendation for DOD to develop guidance to ensure all joint bases develop and provide training materials to incoming personnel to increase opportunities for greater efficiencies and reduce duplication of efforts.

In January 2015, DOD evaluated the possibility of a European joint base, and removed six support functions that it determined were not suitable because the functions provided limited opportunities for consolidation. In addition, DOD continues to evaluate which standards are suitable for consolidation in its annual review process. Together these actions address the intent of our September 2014 recommendation to evaluate whether to continue including all current joint base support functions in future joint basing efforts and to make any changes appropriate to address these limitations.

GAO Contact

For additional information about this high-risk area, contact Brian J. Lepore at (202) 512-4523 or leporeb@gao.gov.

Related GAO Products

Defense Infrastructure: More Accurate Data Would Allow DOD to Improve the Tracking, Management, and Security of Its Leased Facilities. GAO-16-101. Washington, D.C.: March 15, 2016.

Military Base Realignments and Closures: More Guidance and Information Needed to Take Advantage of Opportunities to Consolidate Training. GAO-16-45. Washington, D.C.: February 18, 2016.

DOD Joint Bases: Implementation Challenges Demonstrate Need to Reevaluate the Program. GAO-14-577. Washington, D.C.: September 19, 2014.

Defense Infrastructure: DOD Needs to Improve Its Efforts to Identify Unutilized and Underutilized Facilities. GAO-14-538. Washington, D.C.: September 8, 2014.

Military Bases: DOD Has Processes to Comply with Statutory Requirements for Closing or Realigning Installations. GAO-13-645. Washington, D.C.: June 27, 2013.

Defense Infrastructure: Improved Guidance Needed for Estimating Alternatively Financed Project Liabilities. GAO-13-337. Washington, D.C.: April 18, 2013.

Military Bases: Opportunities Exist to Improve Future Base Realignment and Closure Rounds. GAO-13-149. Washington, D.C.: March 7, 2013.

DOD Joint Bases: Management Improvements Needed to Achieve Greater Efficiencies. GAO-13-134. Washington, D.C.: November 15, 2012.

Military Base Realignments and Closures: Updated Costs and Savings Estimates from BRAC 2005. GAO-12-709R. Washington, D.C.: June 29, 2012.

Excess Facilities: DOD Needs More Complete Information and a Strategy to Guide Its Future Disposal Efforts. GAO-11-814. Washington, D.C.: September 19, 2011.

DOD Approach to Business Transformation

Why Area Is High Risk

The Department of Defense (DOD) has taken some positive steps since the 2015 high-risk update to improve its business transformation efforts. For example, DOD has established the Defense Business Council (DBC) to serve as a senior-level governance forum for its business functions, and issued an Agency Strategic Plan that includes business transformation priorities and which the department is using to guide its business operations. However, additional steps are needed to address long-standing weaknesses in DOD’s business operations and remove this issue from the High-Risk List.

DOD spends billions of dollars each year to maintain key business operations intended to support the warfighter, including systems and processes related to the management of contracts, finances, the supply chain, support infrastructure, and weapon systems acquisition. Weaknesses in these areas adversely affect DOD’s efficiency and effectiveness, and render its operations vulnerable to waste, fraud, and abuse. DOD’s overall approach to transforming these business operations is inextricably linked to DOD’s ability to perform its overall mission, directly affecting the readiness and capabilities of U.S. military forces.

We added DOD’s overall approach to managing business transformation as a high-risk area in 2005 because DOD had not taken the necessary steps to achieve and sustain business reform on a broad, strategic, department-wide, and integrated basis. Further, DOD’s historical approach to business transformation has not proven effective in achieving meaningful and sustainable progress in a timely manner. For example, DOD had not established clear and specific management responsibility, accountability, and control over business transformation-related efforts and applicable resources across business functions. Also, DOD did not have an integrated plan for business transformation with specific goals, measures, and accountability mechanisms to monitor progress and achieve improvements.

What GAO Found

Since 2005, DOD has demonstrated some leadership commitment and notably improved capacity toward addressing business transformation efforts, such as assigning responsibility for agency goals and objectives. DOD has also taken several notable steps to improve its capacity to monitor DOD’s business transformation efforts, such as developing position descriptions for management analysts, and updating the mission for the Office of the Deputy Chief Management Officer’s (DCMO) Planning, Performance, and Assessment directorate to fulfill performance management-related requirements. While DOD has demonstrated some progress through undertaking initiatives intended to improve the efficiency of its business processes, DOD has not 1) fully developed a corrective action plan, 2) consistently held performance reviews that include department-wide performance information, and 3) fully established accountability mechanisms for meeting performance targets. Until DOD makes further progress in addressing these actions and outcomes, its progress in transforming into a more efficient department will be limited.

To date, Congress has passed legislation that could assist DOD in addressing this high-risk area. For example, the National Defense Authorization Act for Fiscal Year 2017, among other things, created a distinct Chief Management Officer (CMO) position effective February 1, 2018, with the mission of managing, establishing policies on, and supervising the business operations of the department. This position would also have the authority to direct the Secretaries of the military departments and the heads of all other DOD components with regard to matters for which the CMO would have responsibility. Before the implementation of this position, the Secretary of Defense is required to conduct a review of the disposition of leadership positions, subordinate organizations, and defined relationships, including the placement and responsibilities of the new CMO position. Specifically, it requires a proposed implementation plan for how the Department would recommendations for revisions to appointments and qualifications, duties and powers, and precedent in the Department; recommendations for such legislative and administrative action, including conforming and other amendments to law, as the Secretary considers appropriate to implement the plan; and any other matters that the Secretary considers appropriate.

A final report is due to the defense committees by August 1, 2017. Continued congressional attention to addressing this high-risk area will be essential going forward.

What Remains to Be Done

In August 2014, we provided DOD with a letter that outlined 13 actions and outcomes that we believe it should address in order to mitigate or resolve long-standing weaknesses in its business transformation efforts. Based on discussions with DOD officials and recent efforts across the department as of October 2016, we believe that DOD has addressed 5 of the 13 actions and outcomes, but have yet to address 8 actions and outcomes. These actions and outcomes are based on the five high-risk criteria for removal: leadership commitment, capacity, action plan, monitoring, and demonstrated progress. For the capacity criterion, while we believe the actions and outcomes we have identified remain important, we also believe they have made notable progress in this criterion to be considered as met, such as reviewing the systems and functions of the Office of the DCMO and Office of the Secretary of Defense (OSD) organizations, and improving the alignment of its personnel with the strategic goals in the draft Agency Strategic Plan. For the remaining four criteria, DOD needs to show measureable and sustained positive outcomes in addressing the remaining eight actions and outcomes. This includes, among other things, DOD continuing to hold business function leaders accountable for performance, refining or developing a more comprehensive corrective action plan as well as existing performance measures, and achieving measurable and sustained outcomes.

Leadership Commitment: DOD should continue to hold business function leaders accountable for diagnosing performance problems and identifying strategies for improvement; and continue to lead regular DOD performance reviews regarding transformation goals and associated metrics and ensure that business function leaders attend these reviews to facilitate problem solving. tradeoffs, priorities, and any sequencing needed to implement the initiatives, and help leaders plan for and provide the resources needed to make the corrective actions identified. continue to refine existing performance measures to ensure that measures assess progress in achieving all business transformation initiatives as needed, and hold owners of DOD’s business functions accountable for providing input into performance targets; and conduct frequent and regular data-driven performance reviews using established performance measures, and use existing governance structures, such as the DBC, to assess department-wide performance including the military departments.

Demonstrated Progress: DOD should make substantial progress in implementing a corrective action plan that includes measures addressing the root causes of shortfalls in business functions, and details how corrective actions designed to improve DOD business functions will be implemented; continue to implement initiatives that result in measurable and sustained positive outcomes over several years, including cost savings and increased efficiencies, thus promoting actions that control costs across the department envisioned by the Secretary of Defense, as noted in DOD’s 2014 Report to Congress on the Defense Business Operations; and document and report on progress in implementing corrective actions across business functions to Congress and other key stakeholders to strengthen accountability; progress could be reported in the annual report to Congress on DOD Business Operations or through other means.

Additional Details on What GAO Found

Leadership Commitment

a performance management framework that DOD intends to use to evaluate its effectiveness. DOD’s Agency Strategic Plan identifies five strategic goals that have associated strategic objectives, performance goals, agency priority goals, or cross-agency priority goals, as well as performance indicators with targets for assessing progress. One of these goals is to reform and reshape the defense institution. As part of the Agency Strategic Plan, OSD Principal Staff Assistants are responsible for reporting progress on performance goals, agency priority goals, or cross- agency priority goals that are linked to DOD’s strategic goals and objectives.

OSD Principal Staff Assistants have reported on the progress of meeting these associated goals at the DBC meetings. In June and in August 2016, the Acting DCMO, through the DBC, conducted performance reviews intended to assess progress against agency priority goals and other performance measures in the Agency Strategic Plan, and provide opportunities to discuss problems and alternatives, among other things. However, these performance reviews have not been conducted on a regular basis. Specifically, prior to June 2016, the DBC had not conducted a performance review since November 2015. Office of the DCMO officials stated that the Acting DCMO plans to conduct a performance review in December 2016 and on a quarterly basis going forward. It will be important for the Acting DCMO to continue to conduct these performance reviews on a regular basis to hold business function leaders accountable for progress.

To further enhance DOD’s oversight of its business transformation efforts, the National Defense Authorization Act for Fiscal Year 2017, among other things, created a distinct CMO position with the mission of managing, establishing policies on, and supervising the business operations of the department. This new position, to begin in February 2018, is expected to provide greater management authority to oversee management of business operations, and could help DOD further demonstrate its commitment to addressing business transformation efforts. This new position would also report directly to the Secretary of Defense. The Deputy Secretary of Defense will no longer serve as CMO. However, the effect of this new structure on improving business transformation within DOD remains to be determined, to include the extent to which this position will have the authority and support needed to drive business transformation efforts across the department.

Capacity

The Office of the DCMO has taken several notable steps to improve its capacity to monitor DOD’s business transformation efforts and now meets this high-risk criterion. In September 2016, the Acting DCMO stated that DOD conducted a business process and systems review that included reviewing structures and functions within the Office of the DCMO. DOD DCMO officials said that the office completed the review of the Office of the DCMO in September 2014.

The review of the DCMO found that the overall structure of the office was sound from a mission perspective, but also identified opportunities to better align related organizations within the office. For example, the Office of the DCMO’s Planning, Performance, and Assessment Directorate was restructured to create outreach teams aligned to major strategic initiatives that are responsible for establishing goals and objectives. According to DOD officials, as part of this effort, the Office of the DCMO reassessed position descriptions to determine the appropriate structure for the office. The Office of the DCMO also developed position descriptions for management analysts, updated the mission for its Planning, Performance, and Assessment directorate, and reorganized the directorate to align its personnel with the strategic goals in the draft Agency Strategic Plan. They stated that this action was taken to ensure that the Office of the DCMO could work across each business function to accomplish department-wide goals. Further, Office of the DCMO officials stated that the Planning, Performance, and Assessment directorate hired personnel with expertise in strategic planning and performance management to increase its capacity to oversee business transformation efforts. Officials further stated that the directorate has assessed its staff’s knowledge, skills, and abilities related to strategic planning and performance management, and monitors progress towards addressing any gaps through annual performance reviews. working group is used to leverage subject matter expertise, including conducting additional analyses on issues tied to business operations for the Office of the DCMO as needed. It will be important for the Office of the DCMO to continue to use its existing management analysis capacity along with the Fourth Estate Working Group to drive business transformation efforts across the department.

In addition to maintaining the capacity of the DCMO to drive business transformation efforts, it will be critical that the CMO position, established by the National Defense Authorization Act for Fiscal Year 2017, has the personnel and other resources needed to fulfill its significant responsibilities. Since this position will not go into effect until February 2018 and the details of its implementation and responsibilities are not fully known, it is too early to determine whether it will have the capacity needed to lead the department’s business transformation efforts. We will monitor DOD’s progress in implementing this position moving forward to include its impact on DOD’s transformation efforts.

Action Plan

DOD now partially meets this criterion. In July 2015, DOD issued its first Agency Strategic Plan. Subsequently, in September 2016, DOD officials shared its draft update to the Agency Strategic Plan for Fiscal Years 2015 – 2018, Version 2.0. This draft update has a performance action plan that contains some but not all elements of a corrective action plan. The performance action plan is intended to provide detailed information for monitoring and reporting DOD’s progress towards each strategic goal, objective, and performance goal as well as, where appropriate, to address actions the department is taking in response to our and DOD Inspector General recommendations. The performance action plan identifies business function leaders for each strategic objective and associated performance goals. In addition, the plan includes, among other things, a description of the problem and opportunity; relationship to strategic goal and objective; key barriers and challenges; mitigation efforts; and an implementation plan, initiatives, and targets for performance measures over time. However, the performance action plan does not define the root causes of business transformation weaknesses or the steps necessary to implement solutions we have recommended in our prior work. Further, the performance action plan does not identify processes and systems to implement initiatives to address root causes, or the tradeoffs needed to implement the initiatives. In January 2017, a senior DOD official stated that DOD does not plan to issue the update to its Agency Strategic Plan, and will instead continue to collect, review, and report on performance data using the draft update until it is superseded.

While the continued use of the draft update to the Agency Strategic Plan is a positive step forward, a more comprehensive performance action plan that outlines the necessary elements of a corrective action plan would allow DOD to more effectively hold business function leaders accountable.

Monitoring

DOD now partially meets this criterion. DOD’s performance action plan in its draft update to the Agency Strategic Plan contains performance measures intended to measure progress in DOD’s business transformation efforts and establishes clear linkages to performance and resource decisions. However, the Office of the DCMO has not established how it plans to hold owners of DOD business functions accountable for performance or monitor the military departments’ business transformation efforts. According to DOD and military department officials, there has been an increased emphasis on reviewing the performance of DOD’s business functions as part of the DBC meetings. However, the DBC did not conduct quarterly reviews of performance from November 2015 until June 2016, when the Acting DCMO conducted a briefing of DOD’s agency priority goals in June 2016. In September 2016, the Acting DCMO stated that the department plans to conduct quarterly performance reviews against the agency priority goals and other performance measures in the draft update to the Agency Strategic Plan, and in its most recent meeting in December 2016, the DBC conducted a quarterly performance review against these measures. Further, in January 2017, a senior DOD official stated that DOD does not plan to issue the update to its Agency Strategic Plan, and will instead continue to collect, review, and report on performance data using the draft update until it is superseded. Consistently conducting quarterly performance reviews is critical to assessing the department’s progress in its business transformation efforts, and issuing an updated Agency Strategic Plan that sets forth DOD’s approach to monitoring would further institutionalize such efforts. wide performance to more effectively achieve business transformation goals.

Demonstrated Progress

DOD now partially meets this criterion. Since 2014, and in part to respond to congressional direction, DOD has undertaken initiatives intended to improve the efficiency of its business processes, but DOD has not been able to demonstrate clear results associated with these initiatives, as well as sustained attention and focus consistently across the business functions. DOD guidance states that the DCMO is responsible for working to better synchronize, integrate, and coordinate the business operations of DOD to optimally align them to support the DOD warfighting mission. DOD reviewed headquarters organizations and other DOD entities to identify cost savings, but it is unclear to what extent these initiatives will help the department achieve the savings it has identified. For example, in May 2015, DOD concluded its Core Business Process Review, which was intended to apply lessons learned and information technology approaches from the commercial sector to the department’s business processes in order to reduce cost and improve mission performance. Through this review, the Office of the DCMO identified at least $62 billion in potential cumulative savings opportunities across the six business processes for fiscal years 2016 through 2020. The review identified that these potential savings opportunities could be achieved through not replacing civilian personnel who attrite and retire over the next 5 years; matching labor productivity in comparable industries or sectors; and improving core processes, such as rationalizing organizational structures to reduce excessive layers, optimizing contracts, and using information technology to eliminate or reduce manual processes. However, in June 2016, we reported that the potential savings opportunities could not entirely be achieved, according to Office of the DCMO officials. The results of DOD’s reviews of headquarters organizations and other DOD entities are still being implemented across the department, and DOD has not yet reported on progress associated with these reviews. efficiencies for delayering, contracted services, and other headquarters- related initiatives. Identifying savings and increased efficiencies from these efforts is important to promoting actions that control costs as envisioned by the Secretary of Defense, and we have cited the need for DOD to implement initiatives that result in measurable and sustained positive outcomes.

The DCMO has used the DBC to continue to focus attention on modernizing its business systems versus more broadly on business transformation issues. While this is important in addressing another DOD high-risk area, the DCMO also needs to place greater attention on improving its business processes across the business functions. Further, the DCMO has not yet documented or reported on progress in implementing any corrective actions across business functions to Congress and other key stakeholders to strengthen accountability.

GAO Contact

For additional information about this high-risk area, contact Zina D. Merritt at (202) 512-5257 or merrittz@gao.gov.

Related GAO Products

Defense Business Transformation: DOD Should Improve Its Planning with and Performance Monitoring of the Military Departments. GAO-17-9. Washington, D.C.: December 7, 2016.

Defense Headquarters: Improved Data Needed to Better Identify Streamlining and Cost Savings Opportunities by Function. GAO-16-286. Washington, D.C.: June 30, 2016.

DOD Financial Management: Greater Visibility Needed to Better Assess Audit Readiness for Property, Plant, and Equipment. GAO-16-383. Washington, D.C.: May 26, 2016.

High-Risk Series: Key Actions to Make Progress Addressing High-Risk Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.

DOD Financial Management: Continued Actions Needed to Address Congressional Committee Panel Recommendations. GAO-15-463. Washington, D.C.: September 28, 2015.

DOD Business Systems Modernization: Additional Action Needed to Achieve Intended Outcomes. GAO-15-627. Washington, D.C.: July 16, 2015.

Managing for Results: Agencies Report Positive Effects of Data-Driven Reviews on Performance but Some Should Strengthen Practices. GAO-15-579. Washington, D.C.: July 7, 2015.

Defense Business Transformation: DOD Has Taken Some Steps to Address Weaknesses, but Additional Actions Are Needed. GAO-15-213. Washington, D.C.: February 11, 2015.

Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and Protecting the Privacy of Personally Identifiable Information

Why Area Is High Risk

Federal agencies and our nation’s critical infrastructures—such as energy, transportation systems, communications, and financial services— are dependent on computerized (cyber) information systems and electronic data to carry out operations and to process, maintain, and report essential information. The security of these systems and data is vital to public confidence and the nation’s safety, prosperity, and well- being.

However, safeguarding federal computer systems and the systems that support critical infrastructures—referred to as cyber critical infrastructure protection—has been a long-standing concern. The security of federal cyber assets has been on our High-Risk List since 1997. In 2003, we expanded this high-risk area to include the protection of critical cyber infrastructure. In 2015, we added protecting the privacy of personally identifiable information (PII) that is collected, maintained, and shared by both federal and nonfederal entities. implemented. As of October 2016, about 1,000 of our information security–related recommendations had not been implemented.

Risks to cyber assets can originate from unintentional and intentional threats. These include insider threats from disaffected or careless employees and business partners, escalating and emerging threats from around the globe, the steady advances in the sophistication of attack technology, and the emergence of new and more destructive attacks. Ineffectively protecting cyber assets can facilitate security incidents and cyberattacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety.

Regarding PII, advancements in technology, such as new search technology and data analytics software for searching and collecting information, have made it easier for individuals and organizations to correlate data and track it across large and numerous databases. In addition, lower data storage costs have made it less expensive to store vast amounts of data. Also, ubiquitous Internet and cellular connectivity makes it easier to track individuals by allowing easy access to information pinpointing their locations. These advances—combined with the increasing sophistication of hackers and others with malicious intent, and the extent to which both federal agencies and private companies collect sensitive information about individuals—have increased the risk of PII being exposed and compromised.

What GAO Found

Leadership at the White House and Department of Homeland Security (DHS) demonstrated commitment to improving cybersecurity. For example, the President issued strategy documents for improving aspects of cybersecurity and an executive order (E.O.) and policy directive for improving security and resilience of critical cyber infrastructure. However, challenges remain, such as shortages in qualified cybersecurity personnel and continued weaknesses in agencies’ information security programs. These challenges need to be addressed as initial steps toward removal from the High-Risk List. Furthermore, progress will need to be demonstrated by agencies fully implementing their information security programs and by critical infrastructure sectors improving their cybersecurity.

In addition, Congress enacted legislation intended to strengthen information security across the federal government and to improve the protection of critical cyber assets. The Cybersecurity Act of 2015 established a voluntary framework for sharing cybersecurity threat information between and among the federal government, state governments, and private entities, and protects private sector entities from liability when sharing and receiving cyber threat information. The act also makes DHS’s National Cybersecurity and Communications Integration Center responsible for implementing these mechanisms, requires DHS to offer its intrusion and detection capabilities to any federal agency, and calls for agencies to assess their cyber-related workforce.

What Remains to Be Done

DHS needs to expand capabilities, improve planning, and support wider adoption of its government-wide intrusion detection and prevention system.

Agencies need to develop and implement complete policies, plans, and procedures for responding to cyber incidents and effectively oversee response activities.

Agencies need to consistently implement policies and procedures for responding to breaches of PII.

The federal government needs to expand its cyber workforce planning and training efforts. Agencies need to enhance efforts for recruiting and retaining a qualified improve cybersecurity workforce planning activities.

The federal government needs to expand efforts to protect cyber critical infrastructure. For example:

DHS and sector-specific agencies need to collaborate with sector partners to develop performance metrics and determine how to overcome challenges to reporting the results of their cyber risk mitigation activities; and

DHS needs to assess whether its efforts to share information on cyber threats, incidents, and countermeasures with federal and non-federal entities are useful and effective.

The federal government needs to better oversee the protection of PII contained in electronic health information and health insurance marketplaces. Needed efforts include the following:

Department of Health and Human Services (HHS) needs to enhance its oversight and guidance related to the actions to protect privacy implemented by entities that maintain electronic health information.

HHS’s Centers for Medicare & Medicaid Services (CMS) needs to ensure that Healthcare.gov and state health insurance marketplaces have effective controls in place to safeguard electronic health information.

Congress should consider amending privacy laws to more fully protect the PII collected, used, and maintained by the federal government.

Additional Details on What GAO Found

Leadership Commitment

The EOP and DHS met the criterion of demonstrating top leadership commitment to securing federal information and protecting the privacy of PII. For example, the President signed legislation, issued executive orders and a policy directive, and published a national action plan that were intended to improve aspects of federal information security, privacy safeguards, and critical infrastructure cybersecurity. In addition, updated guidance, as well as actions such as creating positions for a senior advisor for privacy and federal chief information security officer within the Office of Management and Budget (OMB), further demonstrated the extent to which the EOP was committed to securing federal information systems and protecting privacy. Specific actions taken by the administration and DHS included the following: In July 2016, the President released Presidential Policy Directive (PPD)-41 which set forth principles governing the federal government’s response to cyber incidents involving government or private sector entities. For significant cyber incidents, this PPD establishes lead federal agencies and a process for coordinating the broader federal government response. PPD-41 also requires the Department of Justice (DOJ) and DHS to maintain updated contact information for public use to assist entities affected by cyber incidents in reporting those incidents to the proper authorities.

In February 2016, the President issued E.O. 13719, which created the Federal Privacy Council, a council of senior federal privacy officials established to share ideas and best practices and develop new approaches for protecting privacy in today’s technology driven environment. The President also directed his administration to systematically review where the federal government can reduce reliance on Social Security numbers. organizations, executive departments and agencies, and other entities and to collaborate to respond in as close to real time as possible.

In July 2016, OMB issued a revised Circular A-130, Managing Information as a Strategic Resource, to reflect changes in law and advances in technology and to ensure consistency with executive orders, presidential directives, recent OMB policy, and National Institute of Standards and Technology (NIST) standards and guidelines. The revised circular establishes general policy for, among other things, information governance, security, and privacy. It incorporates security and privacy requirements as crucial elements of a comprehensive, strategic, and continuous risk-based program at federal agencies.

DHS established the Critical Infrastructure Cyber Community (C3)

Voluntary Program to encourage entities to adopt NIST’s Framework for Improving Critical Infrastructure Cybersecurity. As part of this program, DHS developed guidance and tools that are intended to help entities use the framework. The C3 Voluntary Program also includes outreach and awareness activities, promotion efforts targeting specific types of entities, and creation of communities of interest around critical infrastructure cybersecurity.

Capacity

The EOP and DHS partially met the criterion for improving the capacity of federal agencies to sufficiently protect their information systems and PII. Resources and initiatives were identified to address federal cybersecurity capacity concerns. Increased budgetary resources and human capital strategies were proposed to address limitations on federal cybersecurity capacity. For example, the President’s 2017 budget request proposed funds to enhance the Scholarship for Service program, develop a cybersecurity core curriculum, increase the number of academic institutions that are National Centers for Academic Excellence in Cybersecurity, and offer student loan forgiveness for cybersecurity experts in the federal workforce. The President’s 2017 budget also proposed investing $19 billion in cybersecurity, an increase of about 35 percent over fiscal year 2016.

Nevertheless, according to OMB and agency chief information security officers, the federal government suffered from a shortage of cybersecurity professionals due to persistent recruitment and retention challenges. Also, it is unclear the extent to which efforts to improve the capacity of the cybersecurity workforce, among other cybersecurity-related initiatives, were focused on increasing resources at agencies devoted to privacy protection. Executing the human resources strategy and budget priorities could ensure that federal agencies have the necessary capacity to better address the information security and PII protection needs of federal civilian agencies.

Action Plan

The EOP and DHS partially met the criterion for having a corrective action plan to improve the protection of cyber assets and PII. Government-wide plans identified actions to be taken to enhance cybersecurity and PII protection. Examples included the following:

OMB issued the Cybersecurity Strategy and Implementation Plan in October 2015. The plan aimed to strengthen federal civilian cybersecurity by (1) identifying and protecting high-value information and assets, (2) detecting and responding to cyber incidents in a timely manner, (3) recovering rapidly from incidents when they occur and accelerating the adoption of lessons learned, (4) recruiting and retaining a highly qualified cybersecurity workforce, and (5) efficiently acquiring and deploying existing and emerging technology.

The President directed his administration to implement the Cybersecurity National Action Plan. The plan identified near-term actions and a long-term strategy that are intended to enhance cybersecurity awareness and protections, protect privacy, maintain public safety and economic and national security, and empower Americans to take better control of their digital security.

OMB issued the Federal Cybersecurity Workforce Strategy on July 12, 2016, which identified key actions to help recruit and retain a federal cybersecurity workforce. These key actions included directions to OMB and the Office of Personnel Management (OPM) to provide guidance on the use of special hiring authorities to recruit cybersecurity professionals as well as directions to DHS for piloting a new hiring tool.

However, agencies had not yet fully implemented the actions identified in the plans and strategy. In addition, the plans do not consistently address the implementation of about 1,000 of our information security–related recommendations identified across federal agencies.

Monitoring

The EOP, DHS, and federal agencies partially met the criterion for implementing programs to monitor corrective actions related to cybersecurity and PII protection. A government-wide reporting process provided a mechanism for monitoring the efforts of federal agencies in achieving cross-agency priority goals for cybersecurity. Specifically, the EOP and DHS developed and used metrics for measuring agency progress in implementing initiatives on information security regarding continuous monitoring, strong authentication, and anti-phishing and malware defense. In addition, OMB and DHS continued to monitor agencies’ implementation of information security requirements using FISMA reporting metrics that are tracked in the CyberScope system. Together, they had conducted CyberStat reviews that are intended to hold agencies accountable and offer assistance for improving their information security posture.

Nevertheless, other cybersecurity monitoring efforts lacked metrics to measure and report on the effectiveness of the planned and implemented activities. Examples included the following: In December 2015, we reported that DHS had not developed metrics to measure the effectiveness of its efforts to promote the voluntary use of NIST’s Framework for Improving Critical Infrastructure Cybersecurity or to develop guidance and tools to help entities use the framework. We recommended that DHS develop metrics to monitor the effectiveness of its efforts to promote the framework. DHS agreed and indicated that these efforts are underway. mitigate cyber risks and vulnerabilities for their respective sectors. However, most sector-specific agencies had not developed metrics to measure and report on the effectiveness of their cyber risk mitigation activities or their sectors’ cybersecurity posture. We recommended that federal agencies develop performance metrics to monitor their progress. These metrics have not yet been developed.

Demonstrated Progress

The EOP, DHS, and federal agencies partially met this criterion by demonstrating progress in implementing the many requirements for securing federal systems and networks. For example, the federal government had taken the following steps to enhance cybersecurity and protect PII:

The EOP established an OMB Cyber Unit in January 2015 to improve overall federal cybersecurity oversight.

OMB initiated a 30-day Cybersecurity Sprint in June 2015 to lead federal agencies to adopt strong authentication controls and deploy critical patches.

OMB and DHS conducted CyberStat reviews at federal agencies during fiscal years 2015 and 2016. weakness or significant deficiency in internal controls over financial reporting for fiscal year 2016. Further, inspectors general at 20 of the 23 agencies cited information security as a major management challenge for their agencies.

Providing government-wide intrusion detection and prevention services. In January 2016, we reported that DHS’s National Cybersecurity Protection System (NCPS) was partially, but not fully, meeting its stated system objectives of detecting intrusions, preventing intrusions, analyzing malicious content, and sharing information. DHS also had not developed metrics for measuring the performance of NCPS. We recommended that DHS take action to enhance NCPS’s capabilities, among other things. DHS concurred with our recommendations but has not yet fully implemented them.

Strengthening security over industry and public health data at FDA. In August 2016, we reported that the Food and Drug Administration (FDA) had a significant number of security control weaknesses jeopardizing the confidentiality, integrity, and availability of its information and systems. The agency did not fully or consistently implement access controls, which are intended to prevent, limit, and detect unauthorized access to computing resources. Specifically, FDA did not always (1) adequately protect the boundaries of its network, (2) consistently identify and authenticate system users, (3) limit users’ access to only what was required to perform their duties, (4) encrypt sensitive data, (5) consistently audit and monitor system activity, and (6) review the physical security of its facilities. We made 15 recommendations to FDA to fully implement its agency-wide information security program. In a separate report with limited distribution, we recommended that FDA take 166 specific actions to resolve weaknesses in information security controls. FDA concurred with our recommendations and stated it has begun implementing many of them.

Improving security controls over high-impact systems. In May 2016, we reported that 18 federal agencies with high-impact systems identified cyberattacks from “nations” as the most serious and most frequently occurring threat to the security of their systems. These agencies also noted that attacks delivered through e-mail were the most serious and frequent. During fiscal year 2014, 11 of the 18 agencies reported 2,267 incidents affecting their high-impact systems, with almost 500 of the incidents involving the installation of malicious code. At least half of the 18 agencies reported that challenges in recruiting and retaining staff with appropriate skills, rapidly changing technologies, and the limited effectiveness of intrusion detection tools impaired their capability to identify cyber threats to high-impact systems to a great or moderate extent.

We also examined the security controls over eight high-impact systems at four agencies and reported that although the agencies had implemented numerous controls over the systems, they did not always fully implement key elements of their information security programs including developing security plans, assessing security controls, and remedying known vulnerabilities. We recommended that OMB complete its plans and practices for securing federal systems and that the National Aeronautics and Space Administration, Nuclear Regulatory Commission, OPM, and Department of Veterans Affairs fully implement key elements of their information security programs. The agencies generally concurred with the recommendations, with the exception of OPM. OPM did not concur with our recommendation to re-evaluate security control assessments to ensure they comprehensively test technical controls. We continue to believe the recommendation is warranted.

Addressing cybersecurity for the nation’s critical infrastructures.

Improving Critical Infrastructure Cybersecurity in the critical infrastructure sectors. For example, DHS established the Critical Infrastructure Cyber Community Voluntary Program to encourage entities to adopt the framework. However, DHS had not developed metrics to measure the success of its activities and programs. In addition, DHS and the General Services Administration (GSA) had not determined whether to develop tailored guidance for implementing the framework in government facilities sectors as other sector-specific agencies had done for their respective sectors. DHS concurred with our recommendation to develop metrics, but has not indicated that it has taken action as of yet, and DHS and GSA concurred with our recommendation and made a determination about whether to develop sector-specific guidance.

In November 2015, we reported that the sector-specific agencies had determined the significance of cyber risk to the nation’s critical infrastructures and took actions to mitigate cyber risks and vulnerabilities for their respective sectors. However, not all sector-specific agencies had metrics to measure and report on the effectiveness of all their activities to mitigate cyber risks or their sectors’ cybersecurity posture. We recommended that agencies lacking metrics develop them and determine how to overcome any challenges to reporting the results of their activities to mitigate cyber risks. Four of the agencies explicitly agreed with our recommendations and identified planned or on-going efforts to implement performance metrics, but none have yet to provide developed metrics or reports of outcomes.

Protecting the security and privacy of electronic health information. In August 2016, we reported that guidance for securing electronic health information issued by HHS did not address all key controls called for by other federal cybersecurity guidance. In addition, HHS oversight efforts did not always offer pertinent technical guidance and did not always follow up on corrective actions when investigative cases were closed. HHS generally concurred with the five recommendations we made and stated it would take actions to implement them. Information about actions taken to address the recommendations had not been provided at the time of this report.

Ensuring privacy when face recognition systems are used. In May 2016, we reported that the Federal Bureau of Investigation (FBI) had not been timely in publishing and updating privacy documentation for using face recognition technology. Publishing such documents in a timely manner would better assure the public that the FBI is evaluating risks to privacy when implementing systems. Also, the FBI had taken limited steps to determine whether the face recognition system it was using was sufficiently accurate. Of the six recommendations we made, DOJ agreed with one, partially agreed with two, and disagreed with three. Information about actions taken to address the recommendations had not been provided at the time of this report.

Protecting the privacy of users’ data on state-based marketplaces. In March 2016, we reported on weaknesses in technical controls for the “data hub” that CMS uses to exchange information between its health insurance marketplace and external partners. We also identified significant weaknesses in the controls in place at three selected state-based marketplaces established to carry out provisions of the Patient Protection and Affordable Care Act. We recommended that CMS define procedures for overseeing the security of state-based marketplaces and require continuous monitoring of state marketplace controls. HHS concurred with our recommendations. Information about actions taken to address the recommendations had not been provided at the time of this report.

Improving consumer privacy protections. Major recommendations of the administration’s 2012 report on consumer privacy had not yet been implemented in 2016. The report included a framework as a broad action plan intended to improve consumer privacy protection, yet the administration’s recommendations to enact a consumer privacy bill of rights into law and to establish a national standard for data breach notification had not been implemented.

Benefits Achieved by Implementing Our Recommendations

Establishing a strategy for improving federal cybersecurity. In October 2015, OMB issued the Cybersecurity Strategy and Implementation Plan, which identified a series of action steps in several key areas that are intended to improve federal information security. As we had recommended in February 2013, the strategy clearly assigns responsibilities to specific organizations and individuals, sets specific dates for completing actions, and establishes a mechanism for monitoring progress. Implementing the strategy effectively and on time will likely improve the overall posture and capabilities of the federal government to protect its information and computer systems and networks.

Bolstering information security at federal agencies. Over the last 4 fiscal years, federal agencies have implemented over 330 of our recommendations related to strengthening the security over sensitive information and systems at the Census Bureau, Federal Communications Commission, Internal Revenue Service, Federal Deposit Insurance Corporation, Securities Exchange Commission, CMS, and Federal Aviation Administration, among others. Security vulnerabilities expose agency information to increased risk of unauthorized access, disclosure, modification, and use. Addressing vulnerabilities better assures the confidentiality, integrity, and availability of the information agencies maintain and use for conducting their missions.

Improving privacy protections for PII. While more needs to be done, agencies have taken action in response to our recommendations for specific steps to enhance the protection of PII. For example, agencies have implemented 8 of the 23 recommendations we made in 2013 to improve their practices in response to breaches of PII, improvements which can improve the consistency and effectiveness of data breach response programs. Likewise, HHS has implemented all 6 management recommendations we made in 2014 to ensure that PII contained in systems supporting the Healthcare.gov health insurance marketplace is properly protected from potential privacy threats.

GAO Contact

For additional information about this high-risk area, contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov.

Related GAO Products

Federal Information Security: Actions Needed to Address Challenges. GAO-16-885T. Washington, D.C.: September 19, 2016.

Electronic Health Information: HHS Needs to Strengthen Security and Privacy Guidance and Oversight. GAO-16-771. Washington, D.C.: August 26, 2016.

Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority GAO-16-686. Washington, D.C.: August 26, 2016.

Information Security: FDA Needs to Rectify Control Weaknesses That Place Industry and Public Health Data at Risk. GAO-16-513. Washington, D.C.: August 30, 2016.

Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems. GAO-16-501. Washington, D.C.: May 18, 2016.

Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack. GAO-16-350. Washington, D.C.: March 24, 2016.

SmartPhone Data: Information and Issues Regarding Surreptitious Tracking Apps That Can Facilitate Stalking. GAO-16-317. Washington, D.C.: April 21, 2016.

Information Security: DHS Needs to Enhance Capabilities, Improve Planning, and Support Greater Adoption of Its National Cybersecurity Protection System. GAO-16-294. Washington, D.C.: January 28, 2016.

Healthcare.gov: Actions Needed to Enhance Information Security and Privacy Controls. GAO-16-265. Washington, D.C.: March 23, 2016.

Critical Infrastructure Protection: Sector-Specific Agencies Need to Better Measure Cybersecurity Progress. GAO-16-79. Washington, D.C.: November 19, 2015.

Strengthening Department of Homeland Security Management Functions

Why Area Is High Risk

The Department of Homeland Security’s (DHS) top leadership, including the Secretary and Deputy Secretary of Homeland Security, has demonstrated exemplary commitment and support for addressing the department’s management challenges. However, DHS needs to continue implementing its Integrated Strategy for High Risk Management and maintain engagement with us to show measurable, sustainable progress in implementing corrective actions and achieving outcomes. In 2003, we designated implementing and transforming DHS as high risk because DHS had to transform 22 agencies—several with major management challenges—into one department. Further, failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Given the significant effort required to build and integrate a department as large and complex as DHS, our initial high-risk designation addressed the department’s implementation and transformation efforts to include associated management and programmatic challenges. At that time, we reported that the creation of DHS was an enormous undertaking that would take time to achieve, and that successfully transforming large organizations, even those undertaking less strenuous reorganizations, could take years to implement. needs facing the nation after the department’s establishment, and the challenges posed by creating, integrating, and transforming it.

As DHS continued to mature, and as we reported in our assessment of DHS’s progress and challenges in the 10 years following 9/11, we found that the department implemented key homeland security operations and achieved important goals in many areas to create and strengthen a foundation to reach its potential. For example, DHS developed strategic and operational plans to guide its efforts—such as the National Response Framework that outlines disaster response guiding principles—and successfully hired, trained, and deployed workforces, including the federal screening workforce to assume screening responsibilities at airports nationwide.

However, we also found that more work remained for DHS to address weaknesses in other areas of its operational and implementation efforts. For example, we reported in 2011 that DHS had not yet determined how to implement a biometric exit capability, had taken action to address a small portion of the estimated overstay population in the United States, and needed to strengthen efforts to assess national capabilities for all- hazards preparedness. We further reported that continuing weaknesses in implementing and integrating DHS’s management functions continued to affect the department’s implementation efforts.

2013 we narrowed the scope of the high-risk area and changed the name from Implementing and Transforming the Department of Homeland Security to Strengthening Department of Homeland Security Management Functions to reflect this focus. In our 2015 high-risk update, we found that DHS’s top leadership had continued to demonstrate exemplary commitment to and support for addressing the department’s management challenges and that DHS had made important progress in strengthening its management functions. However, we also found that DHS continued to face significant management challenges that hindered its ability to achieve its missions and concluded that DHS needed to continue to demonstrate sustainable, measureable progress in addressing key challenges that remained within and across its management functions.

What GAO Found

DHS’s continued efforts to strengthen and integrate its acquisition, IT, financial, and human capital management functions have resulted in the department meeting three criteria for removal from the High-Risk List (leadership commitment, a corrective action plan, and a framework to monitor progress) and partially meeting the remaining two criteria (capacity and demonstrated, sustained progress). DHS’s top leadership, including the Secretary and Deputy Secretary of Homeland Security, has demonstrated exemplary commitment and support for addressing the department’s management challenges. For instance, the department’s Deputy Secretary, Under Secretary for Management, and other senior management officials have frequently met with us to discuss the department’s plans and progress, which serves as a model for senior- level engagement and helps ensure a common understanding of the remaining work needed to address our high-risk designation. Further, DHS established a framework for monitoring its progress in its Integrated Strategy for High Risk Management, in which it has included performance measures to track the implementation of key management initiatives since June 2012. In addition, since our 2015 high-risk update, DHS has strengthened its monitoring efforts for financial system modernization programs that are key to effectively supporting the department’s financial management operations, resulting in DHS meeting the monitoring criteria for the first time. which we identified and DHS agreed are critical to addressing the challenges within the department’s management areas, and to integrating those functions across the department. DHS has continued to make important progress across all of its management functions, fully addressing 13 of these outcomes, 9 of which it has sustained as fully implemented for at least 2 years. For example, DHS fully addressed one outcome for the first time by demonstrating improvement in human capital management by linking workforce planning efforts to strategic and program planning efforts.

DHS also sustained full implementation of two other outcomes by obtaining a clean audit opinion on its financial statements for 4 consecutive fiscal years. Further, DHS has mostly addressed an additional eight outcomes, meaning that a small amount of work remains to fully address them. Considerable work remains, however, in several areas for DHS to fully achieve the remaining 17 outcomes and thereby strengthen its management functions. Addressing some of these outcomes, such as those pertaining to improving employee morale and modernizing the department’s financial management systems, are significant undertakings that will likely require multiyear efforts. DHS needs to make additional progress identifying and allocating resources in certain areas to sufficiently demonstrate that it has the capacity (that is, the people and resources) to achieve and sustain all 30 outcomes, as well as demonstrate additional sustainable and measurable progress in addressing key challenges that remain within and across these management functions.

2015, the DHS Accountability Act of 2016, and the DHS Reform and Improvement Act.

House Report 114-215, which accompanied H.R. 3128 (DHS appropriations bill for fiscal year 2016) and later became effective under the Consolidated Appropriations Act, 2016, includes mandates related to DHS’s financial management system modernization projects, which relate to three high-risk financial management outcomes. Specifically, the committee directed GAO to assess the risks of DHS utilizing the Department of Interior’s Business Center (IBC), whether IBC is capable of expanding its services to additional federal agencies, and a comparison of the services and capabilities of federal and commercial shared service providers. In addition, the committee directed the DHS Office of the Chief Financial Officer to update the lifecycle cost estimate to reflect all contract awards and projected overall costs, including those for every component that plans to migrate to a federal shared service provider.

The Border Patrol Agent Pay Reform Act of 2014, enacted on December 18, 2014, includes a mandate related to cybersecurity workforce assessments, which relates to one human capital management outcome. Specifically, DHS must identify all cybersecurity workforce positions and identify positions and areas of critical need.

Congress also held a number of oversight hearings related to addressing DHS’s management challenges:

U.S. Senate, Committee on Homeland Security and Governmental Affairs Hearing: DHS Management and Acquisition Reform. March 16, 2016.

U.S. House of Representatives, Committee on Homeland Security, Subcommittee on Oversight and Management Efficiency Hearing: Assessing DHS’s Performance: Watchdog Recommendations to Improve Homeland Security. February 26, 2015.

U.S. House of Representatives, Committee on Homeland Security Hearing: Preventing Waste, Fraud, Abuse and Mismanagement in Homeland Security – A GAO High-Risk List Review. May 7, 2014.

U.S. Senate, Committee on Homeland Security and Governmental Affairs Hearing: The Department of Homeland Security at 10 Years: A Progress Report on Management. March 21, 2013.

What Remains to Be Done

In the coming years, DHS needs to continue implementing its Integrated Strategy for High Risk Management and maintain engagement with us to show measurable, sustainable progress in implementing corrective actions and achieving outcomes. In doing so, it will be important for DHS to maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion; continue to identify the people and resources necessary to make progress towards achieving outcomes, work to mitigate shortfalls and prioritize initiatives, as needed, and communicate to senior leadership critical resource gaps; continue to implement its plan for addressing this high-risk area and periodically provide assessments of its progress to us and Congress; closely track and independently validate the effectiveness and sustainability of its corrective actions, and make midcourse adjustments as needed; and make continued progress in achieving the 17 outcomes it has not fully addressed and demonstrate that systems, personnel, and policies are in place to ensure that progress can be sustained over time.

We will continue to monitor DHS’s efforts in this high-risk area to determine if the outcomes are achieved and sustained over the long term. Further, in order to address the outcomes, DHS must implement our prior recommendations listed below.

DHS should address employee morale problems through comprehensively examining root causes and establishing clear metrics of success within DHS and its components’ action plans.

DHS should ensure that its Human Resources IT Program (HRIT), of which the Performance and Learning Management System is the primary active project, receives necessary oversight and attention by ensuring the HRIT Executive Steering Committee is consistently involved. DHS should also address HRIT’s poor progress and ineffective management by: (1) updating and maintaining a schedule estimate for when DHS plans to implement each of the strategic improvement opportunities; (2) developing a complete life-cycle cost estimate for the implementation of HRIT; (3) documenting and tracking all costs, including components’ costs, associated with HRIT; and (4) updating and maintaining the department’s human resources system inventory, among other things.

To more accurately communicate DHS’s funding plans for U.S. Coast Guard’s major acquisitions programs, DHS should ensure the funding plans presented to Congress are comprehensive and clearly account for all operations and maintenance funding DHS plans to allocate to each of the programs.

DHS should enhance its leadership’s ongoing efforts to improve the affordability of the department’s major acquisitions portfolio by requiring components to submit funding certification memorandums for all major acquisition programs that have not been reviewed at an Acquisition Decision Event; and convening Acquisition Review Boards to discuss affordability and make tradeoffs between cost, schedule, and performance, as necessary. In addition, DHS should ensure that the Fiscal Year 2017 Future Years Homeland Security Program report reflects the results of any tradeoffs stemming from the acquisition affordability reviews; and require components to establish formal, repeatable processes for addressing major acquisition affordability issues.

DHS’s Chief Information Officer should use accurate and reliable information, such as operational assessments of the new architecture and cost and schedule parameters approved by the Under Secretary of Management, to help ensure that assessments prepared by the Office of the Chief Information Officer in support of the department’s updates to the federal IT Dashboard more fully reflect the current status of the Transformation Program.

DHS should continue to work to address its IT mission critical skills gaps, such as those related to its cybersecurity workforce. Further, DHS needs to remediate the material weakness in information security controls reported by its financial statement auditor in fiscal year 2016 by effectively addressing weaknesses in controls related to access, configuration management, and segregation of duties.

DHS should ensure consistent, effective oversight of DHS’s acquisition programs and make the Comprehensive Acquisition Status Report (CASR) more useful by adjusting CASR to enable DHS to hold programs accountable for maintaining their cost, schedule, and performance data. For example, CASR could report an individual rating for each program’s cost, schedule, and technical risks, and the level at which the program’s life-cycle cost estimate was approved.

Additional Details on What GAO Found

Leadership Commitment

progress on outstanding actions that are to be accomplished related to the high-risk area. According to DHS officials, these meetings provide an opportunity to maintain leadership support and accountability for making progress toward resolving management challenges facing the department. It will be important for DHS to maintain its current level of top leadership support and commitment to ensure continued progress in successfully completing its corrective actions.

Capacity

DHS has taken important actions to identify and put in place the people and resources needed to resolve departmental management risks; however, DHS needs to make additional progress identifying and allocating resources in certain areas to sufficiently demonstrate that it has the capacity to achieve and sustain corrective actions and outcomes. In particular, in a September 2010 letter to DHS, we identified and DHS agreed to achieve 31 outcomes that are critical to addressing challenges within the department’s management areas and in integrating those functions across the department. In March 2014, we updated these outcomes in collaboration with DHS to reduce overlap and ensure their continued relevance and appropriateness. These updates resulted in a reduction from 31 to 30 total outcomes. Toward achieving the outcomes, DHS has issued 10 updated versions of its initial January 2011 Integrated Strategy for High Risk Management, most recently in August 2016.

Prior to the January 2016 Integrated Strategy for High Risk Management, DHS did not identify sufficient resources in a number of areas that could undermine DHS’s efforts to strengthen its management functions. For example, in June 2015, DHS identified that it had resources and personnel needed to implement 8 of the 11 key management initiatives it was undertaking to achieve the 30 outcomes, but did not identify sufficient resources for the 3 remaining initiatives. In addition, our prior work has identified specific capacity gaps that could undermine achievement of management outcomes. the Unity of Effort Integration within the Office of Policy to oversee Unity of Effort implementation.

However, we found that DHS needs to make additional progress identifying and allocating resources in certain areas.

Acquisition management. With respect to acquisition, DHS’s 2016 staffing assessments focused on identifying critical acquisition-related position gaps rather than all major program acquisition-related positions; consequently, some programs were assessed as being fully or almost fully staffed for critical positions despite significant staffing shortfalls in the overall program. This increased focus on critical gaps may limit DHS’s insight into the size and nature of acquisition-related staffing shortfalls, making it difficult for DHS to develop a plan or process to address these vacancies. In December 2016, DHS updated its staffing assessment guidance to refocus the assessment process on all major program acquisition-related positions. However, DHS plans to pilot the implementation of this policy update incrementally during 2017, and the timing of full implementation is not yet known.

Emergency Management Agency and U.S. Immigration and Customs Enforcement modernization projects until April 2017.

DHS has taken actions to address some of its previous capacity shortcomings and ensure that the department has the people and resources necessary to resolve risk. However, additional progress is needed to ensure that DHS has sufficient capacity not only to resolve risks, but to fully achieve and sustain the 30 outcomes. As a result, we assess DHS having partially met the capacity criterion. DHS needs to continue to comprehensively identify the people and resources necessary to make progress towards achieving all 30 outcomes; work to mitigate shortfalls and prioritize initiatives, as needed; and communicate to senior leadership about critical resource gaps requiring resolution.

Action Plan

DHS previously established a plan for addressing this high-risk area as discussed above, and has continued to take critical, actionable steps towards addressing challenges faced within the department. As with prior iterations, DHS included in its most recent August 2016 version of its Integrated Strategy for High Risk Management key management initiatives and related corrective actions for addressing each of the management challenges and related outcomes we identified. For example, the August 2016 updated version of its strategy includes information on actions DHS is taking for an initiative focused on financial systems modernization and an initiative focused on IT human capital management, which support various outcomes. DHS’s strategy and approach, if effectively implemented and sustained, provides a path for DHS to be removed from our High-Risk List.

Monitoring

strategy. For example, to monitor progress made towards strengthening the DHS acquisition process by improving the acquisition workforce, DHS management continues to monitor the percent of its nine acquisition certification policies completed—policies related to program management, cost estimating, and contracting among others—and the percent of required acquisition certification training developed.

However, in our 2015 high-risk update, we found that DHS could strengthen its financial management monitoring efforts and thus concluded that the department had partially met the criterion for establishing a framework to monitor progress. In particular, according to DHS officials, as of November 2014, the department was establishing a monitoring program that would include assessing whether the projects modernizing key components of their financial management systems were following industry best practices and meeting users’ needs. Effectively implementing these modernization projects is important because until they are complete, the department’s systems will not effectively support financial management operations. Following the 2015 high-risk update, DHS entered into a contract for independent verification and validation services that should help ensure that financial management systems modernization projects meet key requirements. Moving forward, DHS will need to continue to closely track and independently validate the effectiveness and sustainability of its corrective actions, and make midcourse adjustments as needed.

Demonstrated Progress

DHS has continued to make important progress in strengthening its management functions, but needs to demonstrate additional sustainable and measurable progress in addressing key challenges that remain within and across these functions. DHS has either fully or mostly addressed 21 of the 30 outcomes, demonstrating the department’s progress in strengthening its management functions, and partially addressed or initiated the remaining 9 outcomes. For example, DHS established the Joint Requirements Council, an acquisition oversight body, through which it has created a process for validating capability and requirements documents, among other things. DHS has also worked to improve the management and oversight of its IT investments by establishing and implementing a tiered governance and portfolio management structure. In addition, DHS obtained a clean audit opinion on its financial statements for 4 consecutive fiscal years—2013, 2014, 2015, and 2016. that hinder the department’s ability to meet its missions. For this update, we determined that DHS has partially addressed 6 and initiated 3 of the 30 outcomes. For example, while DHS has initiated acquisition program health assessments to demonstrate that major acquisition programs are on track to achieve their cost, schedule, and capability goals, it will take time to demonstrate that these initiatives will improve program performance. In addition, DHS does not have modernized financial management systems, which affects its ability to have ready access to reliable information for informed decision making. Further, it is important that DHS retain and attract the talent required to complete its work—a challenge the department continues to face due to employee morale issues. Addressing these and other management challenges will be a significant undertaking, but will be critical to mitigate the risks that management weaknesses pose to mission accomplishment.

Achieving sustained progress across the outcomes, in turn, requires leadership commitment, effective corrective action planning, adequate capacity (that is, the people and other resources), and monitoring the effectiveness and sustainability of supporting initiatives. Table 7 summarizes DHS’s progress in addressing the 30 key outcomes and is followed by selected examples.

Acquisition management. DHS has fully addressed two of the five acquisition management outcomes, mostly addressed two outcomes, and partially addressed the remaining outcome. For example, DHS has validated the required acquisition documentation for all of its major acquisition programs and plans to continue to ensure that all major acquisition programs have approved acquisition program baselines, and to use a pre-Acquisition Review Board checklist to confirm that programs have all required documentation for Acquisition Decision Events. In addition, DHS has taken a number of recent actions to establish and operate the Joint Requirements Council. These actions include (1) establishing a process for validating capability and requirements documents, and (2) piloting a joint assessment of requirements process that is intended to eventually inform the department’s budget decisions.

Further, DHS continues to assess and address whether appropriate numbers of trained acquisition personnel are in place at the department and component levels. Finally, we reported in March 2016 that only 11 of the 25 major DHS acquisition programs we reviewed remained on track to meet their current schedule and cost goals. DHS has initiated acquisition program health assessments to report to senior DHS management the status of major acquisition programs toward achieving cost, schedule, and capability goals; however, it will take time to demonstrate that such initiatives are improving program performance. of DHS’s IT workforce, as well as hiring, training, and managing staff with those new skill sets.

Enforcement financial management systems before DHS will be in a position to implement modernized solutions for these components and their customers.

For example, discovery phase activities to determine the feasibility of implementing, deploying, and maintaining the chosen solution are not expected to be completed for these two projects until April 2017. Such information is essential for determining the implementation schedule and finalizing cost estimates that are needed prior to approving the projects for implementation. Further, without sound internal controls and systems, DHS faces long-term challenges in sustaining a clean audit opinion on its financial statements and in obtaining and sustaining a clean opinion on its internal controls over financial reporting, which are needed to ensure that its financial management systems generate reliable, useful, and timely information for day-to- day decision making as a routine business operation.

Human capital management. DHS has fully addressed three human capital management outcomes, mostly addressed three, and partially addressed the remaining one. For example, the Secretary of Homeland Security signed a human capital strategic plan in 2011— which was revised and reissued in 2014—that DHS has since made sustained progress in implementing, thereby fully addressing one outcome. In addition, DHS successfully demonstrated the ability to conduct structured workforce planning for the majority of its priority mission critical occupations at the department in fiscal year 2015, and for all mission critical occupations in fiscal year 2016. To support this planning, DHS issued its Workforce Planning Guide in 2015, which enabled DHS components to apply a consistent and departmentally- approved methodology, including the use of standardized tools and templates. DHS also published and implemented a department-wide Employee Engagement Action Plan, which DHS’s components used to develop tailored action plans for their own employee engagement and outreach. results-oriented performance culture, talent management, and job satisfaction) from 2008 through 2015. DHS has developed plans for addressing its employee satisfaction problems and improved scores in all four areas in 2016, but as we previously recommended, in September 2012, DHS needs to continue to improve its root-cause analysis efforts related to these plans. DHS also needs to continue strengthening its learning management capabilities. Specifically, in February 2016, we reported that DHS had initiated the Human Resources Information Technology (HRIT) investment in 2003 to address issues presented by its human resource environment. designed to allow the department to operate in a more integrated fashion.

Further, in support of this effort, in August 2015, the Under Secretary for Management identified four integrated priority areas to bring focus to strengthening integration among the department’s management functions. According to DHS’s August 2016 updated version of its strategy, these priorities—which include, for example, strengthening resource allocation and reporting reliability and developing and deploying secure technology solutions—each include detailed goals, objectives, and measurable action plans that are monitored at monthly leadership meetings led by senior DHS officials, including the Under Secretary for Management. Accomplishments DHS officials attribute to the Unity of Effort initiative and integrated priorities initiatives include the following, among others:

DHS’s Office of Program Accountability and Risk Management developed and implemented a policy directive to monitor and track critical staffing gaps for major acquisition programs to ensure that such gaps are identified and remediated in a timely manner.

DHS Science and Technology Directorate established Integrated Product Teams to better link the department’s research and development investments with the department’s operational needs.

DHS strengthened its strategy, planning, programming, budgeting, execution, and acquisition processes by improving existing structures and creating new ones where needed to build additional organizational capability. DHS has institutionalized these reforms by issuing a range of departmental management directives and instructions.

However, given that these main management integration initiatives are in the early stages of implementation and contingent upon DHS sustaining implementation plans and efforts over a period of years, it is too early to assess their effects. To achieve this outcome, DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department and its components, as well as fully address the other 17 outcomes it has not yet achieved.

Benefits Achieved By Implementing Our Recommendations

In 2016, we recommended, among other things, that DHS (1) update the HRIT executive steering committee charter to establish the frequency with which HRIT executive steering committee meetings are to be held, (2) establish time frames for re-evaluating the strategic improvement opportunities and associated projects in the Human Capital Segment Architecture Blueprint and determining how to move forward with HRIT, and (3) evaluate the strategic improvement opportunities and projects within the Human Capital Segment Architecture Blueprint to determine whether they and the goals of the blueprint are still valid and reflect DHS’s HRIT priorities going forward, and update the blueprint accordingly. We reported that HRIT’s limited progress was due in part to lack of involvement of its executive steering committee and, as a result, key governance activities, such as approval of HRIT’s operational plan, were not completed. We concluded that until DHS takes actions to reevaluate and manage this neglected investment, it was unknown when its human capital weaknesses would be addressed. In response, in 2016, DHS addressed these three recommendations. As a result, DHS should have better assurance that the HRIT executive steering committee will meet regularly and carry out its responsibility to provide oversight and guidance to the HRIT investment. Further, DHS is better positioned to update the blueprint and address inefficiencies in its human resources environment, make informed resource decisions on the implementation of the strategic improvement opportunities, and address inefficiencies in its human resources environment.

In 2015, we recommended that DHS re-baseline cost, schedule, and performance expectations for the remainder of the U.S. Citizenship and Immigration Services Transformation Program. We reported that the Transformation Program had an increased cost of $1 billion and delay of over 4 years from its initial July 2011 baseline, mostly due to changes in its acquisition strategy to address various technical challenges. These changes significantly delayed the program’s planned schedule, which in turn had adverse effects on when the program expects to achieve cost savings, operational efficiencies, and other benefits. In response, in 2015, DHS addressed this recommendation, and the re-baseline helps ensure that progress made by the program can be monitored against established and approved parameters.

Secretary for Management (USM) to develop written guidance to clarify roles and responsibilities of PARM and the Office of the Chief Information Officer Enterprise Business Management Office for conducting oversight of major acquisition programs; (3) directed the USM to produce operations and maintenance cost estimates for programs in sustainment and establish responsibility for tracking sustainment programs’ adherence to those estimates; and (4) directed the USM to determine mechanisms to hold programs accountable for entering data in the Next Generation Periodic Reporting System consistently and accurately, and to hold Component Acquisition Executives accountable for validating the information and evaluate the root causes of why programs are not using the Next Generation Periodic Reporting System as intended. By PARM issuing a handbook that provides oversight roles and responsibilities and other guidance to PARM component leads, and by the USM and Acting Deputy USM issuing multiple memorandums regarding the clarification of acquisition oversight roles and responsibilities, the verification and certification of the data in designated fields, the verification and certification of the data on a biannual basis, and the requirement of root cause analyses, DHS is helping ensure consistent and effective oversight of its acquisition programs.

In 2015, we recommended that DHS should ensure the Director of Operational Test and Evaluation explicitly address all of the relevant key performance parameters in each letter of assessment appraising operational test results of DHS’s major acquisitions programs. As a result, in 2015, DHS finalized an internal office procedure that established that each letter of assessment should provide detailed analysis indicating whether or not the key performance parameters were met.

In 2014, we recommended that DHS clearly identify Leader Development Program goals and ensure program performance measures include key attributes, such as linkage, clarity, and measurable targets. As a result, in December 2014, Leader Development Program Office officials provided us with updated documentation on the program’s assessment approach. This documentation established 10 program goals. It also explained how the program’s performance measures link to the 10 program goals and to department-wide goals. Further, the documentation established targets for each performance measure and provided clarification for ambiguous measures. These enhancements to the Leader Development Program assessment approach should help produce actionable information for the program’s management to use in identifying the need for, and making, program improvements.

In 2013, we recommended that DHS should direct the Office of the Chief Human Capital Officer (OCHCO) to require all components to provide recruiting cost information in a consistent manner to allow better tracking of overall recruiting costs, and use this information to assess the extent to which recruiting costs are being reduced by components as a result of increased coordination and leveraging resources as called for in the Coordinated Recruiting and Outreach Strategy. In June 2015, OCHCO provided us with examples of recruiting cost information that it has begun tracking in response to this recommendation. The data provided demonstrate that OCHCO has begun to better track component-level recruiting expenditures in a way that illustrates coordination among components, and could be used to track reduction in costs stemming from this coordination.

In 2015, in response to one of our recommendations, DHS developed a financial systems modernization transition plan that included the tasks, milestones, and time frames for implementing new systems, and establishing the optimal sequencing of activities. If effectively implemented, the transition plan will help DHS increase its ability to effectively manage its financial management system modernization efforts. Also, in 2015, DHS developed a financial systems modernization transition plan and an updated architecture roadmap that collectively describe a target state architecture for DHS financial management segment in business terms (e.g., business functions and business processes) and technical terms (e.g., account classification standards data model, shared services, and federated solution approach). These DHS actions have helped improve DHS’s ability to ensure the effectiveness of financial management system investment decisions.

GAO Contact

For additional information about this high-risk area, contact Rebecca Gambler (202) 512-8777 or gamblerr@gao.gov.

Related GAO Products

Homeland Security Acquisitions: Joint Requirements Council’s Initial Approach Is Generally Sound and It Is Developing a Process to Inform Investment Priorities. GAO-17-171. Washington, D.C.: October 24, 2016.

Homeland Security Acquisitions: DHS Has Strengthened Management, but Execution and Affordability Concerns Endure. GAO-16-338SP. Washington, D.C.: March 31, 2016.

Department of Homeland Security: Progress Made, but Work Remains in Strengthening Acquisition and Other Management Functions. GAO-16-507T. Washington, D.C.: March 16, 2016.

Homeland Security: Oversight of Neglected Human Resources Information Technology Investment Is Needed. GAO-16-253. Washington, D.C.: February 11, 2016.

Immigration Benefits System: Better Informed Decision Making Needed on Transformation Program. GAO-15-415. Washington, D.C.: May 18, 2015.

Homeland Security Acquisitions: DHS Should Better Define Oversight Roles and Improve Program Reporting to Congress. GAO-15-292. Washington, D.C.: March 12, 2015.

Department of Homeland Security: Progress Made, but More Work Remains in Strengthening Management Functions. GAO-15-388T. Washington, D.C.: February 26, 2015.

DHS Training: Improved Documentation, Resource Tracking, and Performance Measurement Could Strengthen Efforts. GAO-14-688. Washington, D.C.: September 10, 2014.

DHS Financial Management: Continued Effort Needed to Address Internal Control and System Challenges. GAO-14-106T. Washington, D.C.: November 15, 2013.

DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in Internal Controls and Financial Management Systems. GAO-13-561. Washington, D.C.: September 30, 2013.

Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interests

Why Area Is High Risk

Technological superiority is critical to U.S. military strategy. Thus, the Department of Defense (DOD) spends billions of dollars each year to develop and acquire sophisticated technologies to provide an advantage for the warfighter during combat or other missions. Many of these technologies are also sold or transferred to foreign partners to promote U.S. economic, foreign policy, and national security interests. These technologies can also be acquired through foreign investment in the U.S. companies that develop or manufacture them. In addition, they are targets for unauthorized transfer, such as theft, espionage, reverse engineering, and illegal export.

To identify and protect technologies critical to U.S. interests, the U.S. government has a portfolio of programs. These include export controls— those developed to regulate exports and ensure that items and information are transferred in a manner consistent with U.S. interests—as well as a number of non-export control programs, including the Foreign Military Sales (FMS) program, anti-tamper measures, and the National Industrial Security Program, which oversees government contractors handling classified information, including that associated with critical technologies. These programs and activities are administered by multiple federal agencies with various interests, including DOD and the Departments of Commerce, Homeland Security, Justice, State, and the Treasury. We designated this area as high risk in 2007 because these programs, established decades ago, were ill-equipped to address the evolving challenges of balancing national security concerns and economic interests. While these agencies are making progress in addressing challenges identified by our work, we believe that additional leadership and coordination of programs and activities in the non-export control programs, among other things, is needed to identify strategic reforms that will help to advance U.S. interests.

What GAO Found

Since this area was added to the High-Risk List in 2007, our body of work in this area has identified progress in the programs designed to protect technologies critical to U.S. national security interests, but government- wide challenges remain, including the need to adopt a more consistent leadership approach, improve coordination among programs, address weaknesses in individual programs, and implement export control reform.

Hence, we continue to consider each of our high-risk criteria in this area to be partially met:

Leadership commitment to addressing challenges has been evident in some areas of the critical technologies portfolio, particularly with respect to the Export Control Reform initiative. However, as we reported in our 2015 update, greater collaboration among the critical technologies programs not directly related to export controls— including the FMS program, the anti-tamper program, and the National Industrial Security Program—could ensure that lead and stakeholder agencies take a more consistent approach to meeting program goals.

The capacity for addressing challenges and implementing reforms has improved for some programs. However, many efforts remain limited to individual programs or activities within the overall program portfolio, and there are areas where broader coordination could be beneficial, such as determining an appropriate technical reference to inform key decisions relating to critical technologies.

Action plans to guide improvements are in place for some programs; however, additional steps have yet to be taken to develop and implement action plans that will address ongoing challenges, such as administering the anti-tamper program.

Monitoring of efforts to meet key challenges also has improved at some programs. DOD and State have implemented some, but not all, of our past recommendations on developing performance measures and monitoring program outcomes.

What Remains to Be Done

The need for action remains both at the individual program level and the portfolio level. We have made a number of recommendations to agencies aimed at improving coordination among the programs that are intended to protect technologies critical to U.S. national security. We believe that implementing these recommendations could result in significant improvements. Our body of work shows that challenges remain.

Leadership Commitment

To address existing challenges, we have previously reported that the executive branch and Congress should consider reevaluating the wider portfolio of programs protecting critical technologies, including assessing the prospects for achieving collaboration across separate but related programs designed to protect critical technologies. Executive branch leadership has been committed to reforming the area of export controls, an important step forward. But leadership commitment is less evident in the critical technologies programs that fall outside the scope of export control reform.

Capacity

Individual agencies need to continue to implement our recommendations to address weaknesses in their respective programs. Doing so could increase these programs’ capacity for implementing reforms. For example, the export control agencies should work to develop standard operating procedures for the Export Enforcement Coordination Center—a primary forum within the federal government to coordinate export enforcement efforts and identify and resolve conflicts—to facilitate data sharing.

Action Plan

Developing a concrete action plan for achieving collaboration across separate but related programs designed to protect critical technologies remains important. Executive branch leadership has developed a thorough action plan for export control reform. But formal and integrated planning is less evident in the critical technologies programs that fall outside the scope of export control reform.

Monitoring

Individual agencies need to continue to implement our recommendations to address weaknesses in their respective programs. Doing so could increase these programs’ ability to monitor progress. For example, DOD should take additional actions to enhance its ability to provide security assistance through, for example, its FMS program by establishing performance measures for all phases of the security assistance process.

Demonstrated Progress

users’ needs for a technical reference, whether it be the U.S. Munitions List or the Industrial Base Technologies List, other alternatives being used, or some combination thereof, and ensure that resources are coordinated and efficiently devoted to sustain the approach chosen. Since our recommendation, DOD officials said the department has moved toward using the U.S. Munitions List. However, DOD has not changed its policy requiring use of the Militarily Critical Technologies List (MCTL) as it has not yet received relief from that statutory requirement.

At the portfolio level, implementing export control reforms demonstrates leadership commitment, but the agencies involved in export controls must continue to implement reforms to achieve the goals set to protect U.S. interests. For non-export control reform, increased collaboration between DOD’s offices responsible for administering the FMS program and approving exports represents an important step forward in coordinating the activities of selected programs. However, leadership still must decide, among other things, how to address protection of critical technologies at a more strategic level. In particular, in February 2015 we recommended that, to ensure a consistent and more collaborative approach to protecting critical technologies, the Secretaries of Commerce, Defense, Homeland Security, State, and the Treasury as well as the Attorney General of the United States—who have lead and stakeholder responsibilities for the programs within the critical technologies portfolio—should take steps to promote and strengthen collaboration mechanisms among their respective programs while they implement and assess ongoing initiatives. These steps need not be onerous; for example, they could include conducting an annual meeting to discuss their programs, including the technologies they are protecting, their programs’ intent, and any new developments or changes planned for their programs, as well as defining consistent critical technologies terminology and sharing important updates.

Congressional Actions Needed

Export control reform is being implemented in three phases. Phases I and II reconcile various definitions, regulations, and policies for export controls. As of August 2015, Phase I was finished. Phase II is nearing completion. This is all building toward Phase III, which will result in implementation of major changes supported by these reconciliations by consolidating export control efforts in four reform areas: creating a single, consolidated control list; designating a single licensing agency; designating a primary export enforcement coordination agency; and establishing a unified information technology system. We reported in February 2015 that significant collaboration by the participating agencies is essential to the Phase III consolidation efforts. In that same report, we noted that in order for full implementation of this third and final phase to occur, congressional action is needed to designate a single licensing agency and a primary export enforcement coordination agency. For example, since there are currently separate statutory bases for State and Commerce to review and issue export licenses, legislation will be required to consolidate the current system into a single licensing agency.

Additional Details on What GAO Found

Ensuring Protection of Critical Technologies - Export Controls

Some of the issues identified through past reports on export controls include poor interagency coordination, inefficiencies in the license application process, and a lack of systematic assessments.

Leadership Commitment

This criterion has been met. The Obama administration directed an interagency review of the U.S. export control system that resulted in the 2010 establishment of an Export Control Reform initiative, which has continued to demonstrate strong leadership commitment, both from that administration and from leaders at the key federal agencies. This initiative is under way and actions toward the four key goals of reform—creation of a single, consolidated control list, a single licensing agency, a primary export enforcement coordination agency, and a unified information technology system—have been implemented using a phased approach, which we have concluded has the potential to address weaknesses in the U.S. export control system.

Capacity

the three key export control agencies are using this single system, and other agencies, such as Treasury, are working toward joining this system.

However, other efforts under this criterion have yet to be completed. Fifteen federal agencies have come together through the establishment of the Export Enforcement Coordination Center (the Center), which, according to statistics the Center Director provided to us, has heightened awareness by exchanging investigation-related information. The Center had made good progress in addressing our February 2015 findings that export enforcement agencies had poor interagency coordination, but remaining efforts have stalled. For example, the Center has not yet finalized procedures for coordination between the investigative export control enforcement and intelligence communities. Center officials cited understaffing of interagency personnel as a key barrier, and, in August 2016, Commerce assigned new staff to the Center to assist in this process.

Action Plan

This criterion has been met. The export control reform efforts lay out a clear plan of action—consisting of a three-phase framework of agency actions to implement reforms to export control lists, licensing, enforcement, and information technology—which has the potential to improve the efficiency and effectiveness of the export control process.

Monitoring

This criterion has been partially met. We made four recommendations in March 2012 that departments with responsibilities for export control enforcement take steps to more effectively monitor resources spent on export control enforcement activities and develop and implement metrics for monitoring their effectiveness. As of 2016, one of these recommendations has been implemented by Homeland Security, but not Justice; a second has been implemented by both Homeland Security and Commerce; a third has not been implemented by Homeland Security; and a fourth has been implemented by both Commerce and State.

Demonstrated Progress

remain under State control or move to Commerce control. The goal is to move certain less sensitive items from State’s jurisdiction to Commerce’s, while leaving high-risk and high-priority items on State’s list. However, other key steps, such as implementation of the Center’s procedures for coordination with the intelligence communities, remain incomplete.

Ensuring Protection of Critical Technologies - Non-Export Controls

Leadership Commitment

for ensuring consistent protection of critical technologies across weapon systems and their respective export variants.

The Defense Security Service, which is responsible for administering the National Industrial Security Program and overseeing the protection of classified information at contractor facilities, has also made leadership progress in its technology protection role by beginning implementation of an enterprise-wide risk management approach that it expects to allow more effective oversight of technology and classified information. In 2016, agency officials reported that this approach has improved the overall oversight of all contractors by increasing visibility of security management issues across the agency’s individual directorates.

Capacity

This criterion has been partially met. In our 2015 update, we reported that DOD had initiated a plan and instituted the capacity for oversight and collaboration on those programs related to security cooperation and disclosure, and, while DOD has continued to expand these capacities, they remain fragmented across the portfolio of programs. For example, based on direction in the National Defense Authorization Act for Fiscal Year 2011, DOD created a Defense Exportability Features Pilot Program to reduce program costs and facilitate export sales for U.S. and foreign customers while balancing program protection needs. Since it was created, this pilot program has funded a limited number of designated systems to conduct initial feasibility studies, follow-on studies, and design efforts relating to protection of critical information on systems that may be candidates for export. Our ongoing work suggests that the pilot program has achieved some significant initial successes in helping assure greater value and effectiveness in preparing weapon programs for export. DOD officials also reported improved collaboration between agencies involved in the protection of critical technologies. Specifically, DOD officials responsible for administering FMS and export license requests, respectively, highlighted areas of increased collaboration, including joint briefings to Congress and temporary staff details across their organizations.

Action Plan

significant work remains to be done in this area. Specifically, DOD officials said they do not have a strategic plan for administering the anti- tamper program, and officials also noted that, although technology protection is a strategic priority within the department, it was not included in a recent presidential transition strategy in terms of performance and tracking measures.

Monitoring

This criterion has been partially met. While DOD has made some progress in establishing data-driven performance measures and tracking them against organizational goals, additional work is needed in some areas relating to the transfer of U.S. military equipment to foreign governments. For example, in our last update we noted that DOD has not implemented our recommendations to improve monitoring of the security assistance process for FMS and other security cooperation programs in which military equipment is provided directly to foreign governments. Since then, one recommendation—from November 2012—that DOD establish performance measures to assess the timeliness of the security assistance case closure process for FMS and related programs, has been implemented, but another—from the same report—calling for DOD to establish a performance measure to assess timeliness for the acquisition phase of the security assistance process remains unaddressed. Additionally, DOD officials responsible for administering the Defense Exportability Features Pilot Program said they have not yet developed meaningful metrics relating to aspects of the program International Cooperation officials would like to measure, such as cost savings and the defense industry’s ability to handle increased production to accommodate both U.S. and export items.

Demonstrated Progress

example, we have previously reported that DOD’s MCTL, originally developed in response to the Export Administration Act of 1979 in order to inform export decisions, is no longer being updated or used by DOD officials who provide input on the criticality of technologies as part of export license determinations and reviews of foreign acquisition of U.S. companies.

We recommended in January 2013 that DOD determine the best approach for meeting users’ requirements for a technical reference and DOD officials noted that a memorandum is pending final signature that would cancel DOD’s policy requiring use of the MCTL. In the meantime, DOD officials we spoke with in August 2016 highlighted an ongoing effort to update the U.S. Munitions List, which is now more widely used in security cooperation efforts. Additionally, the Defense Security Service maintains a separate list—the Industrial Base Technology List—which is used by many DOD entities to characterize threats to information and technology and to categorize technology acquisitions.

Benefits Achieved by Implementing Our Recommendations

In March 2012, we issued a report identifying delays in the license determination process, by which agencies confirm whether an item for export is controlled and requires a license. We recommended that Commerce establish timeliness goals for responding to license determination requests. According to Commerce, in April 2014, Commerce’s Bureau of Industry and Security began implementing the license determination module of the Commerce USXPORTS Export Support System. This system has enabled them to reduce their average processing time for license determinations to around 14 days, well below Commerce’s internal requirement for processing license determinations of 35 days. foreign security forces under security-related assistance programs to establish formal written procedures to consult with the Directorate of Defense Trade Controls to determine if there are additional safeguards recommended for the transfer of the defense articles. According to State officials, in October 2015, the Department of State’s Bureau of International Narcotics Control and Law Enforcement Affairs issued new standard operating procedures directing end-use monitoring officials to ensure that all U.S. government personnel utilize an end-use monitoring defense article checklist when conducting inspections.

GAO Contact

For additional information about this high-risk area, contact Marie A. Mak at (202) 512-4841 or makm@gao.gov.

Related GAO Products

Critical Technologies: Agency Initiatives Address Some Weaknesses, but Additional Interagency Collaboration Is Needed. GAO-15-288. Washington, D.C.: February 10, 2015.

Export Controls: NASA Management Action and Improved Oversight Needed to Reduce the Risk of Unauthorized Access to Its Technologies. GAO-14-315. Washington, D.C.: April 15, 2014.

Countering Overseas Threats: DOD and State Need to Address Gaps in Monitoring of Security Equipment Transferred to Lebanon. GAO-14-161. Washington, D.C.: February 26, 2014.

Protecting Defense Technologies: DOD Assessment Needed to Determine Requirement for Critical Technologies List. GAO-13-157. Washington, D.C.: January 23, 2013.

Security Assistance: DOD’s Ongoing Reforms Address Some Challenges, but Additional Information Is Needed to Further Enhance Program Management. GAO-13-84. Washington, D.C.: November 16, 2012.

Export Controls: Compliance and Enforcement Activities and Congressional Notification Requirements under Country-Based License Exemptions. GAO-13-119R. Washington, D.C.: November 16, 2012.

Nonproliferation: Agencies Could Improve Information Sharing and End- Use Monitoring on Unmanned Aerial Vehicle Exports. GAO-12-536. Washington, D.C.: July 30, 2012.

Export Controls: U.S. Agencies Need to Assess Control List Reform’s Impact on Compliance Activities. GAO-12-613. Washington, D.C.: April 23, 2012.

Export Controls: Proposed Reforms Create Opportunities to Address Enforcement Challenges. GAO-12-246. Washington, D.C.: March 27, 2012.

Export Controls: Agency Actions and Proposed Reform Initiatives May Address Previously Identified Weaknesses, but Challenges Remain. GAO-11-135R. Washington, D.C.: November 16, 2010.

Improving Federal Oversight of Food Safety

Why Area Is High Risk

The Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Office of Management and Budget (OMB) have taken some positive steps since the 2015 high-risk update to address fragmentation in the federal food safety oversight system. For example, HHS and USDA have continued and expanded collaboration on specific food safety issues, and HHS has updated its strategic plan to address interagency coordination on food safety. However, additional steps are needed to address the system’s fragmentation and remove this issue from the High-Risk List.

For more than four decades, we have reported on the fragmented federal food safety oversight system, which has caused inconsistent oversight, ineffective coordination, and inefficient use of resources. We added federal food safety oversight to the High-Risk List in 2007 because of risks to the economy, to public health, and to safety. A 2011 estimate by the Centers for Disease Control and Prevention (CDC)—its most recent estimate—indicates that, as a result of foodborne illness, roughly 1 in 6 Americans (48 million people) gets sick each year, 128,000 are hospitalized, and 3,000 die. CDC data also show that the number of reported multistate foodborne illness outbreaks is increasing. This is notable because although multistate outbreaks make up a small proportion of total outbreaks, they affect greater numbers of people. For example, according to CDC data, 3 percent of reported outbreaks from 2010 to 2014 were multistate, but these outbreaks were associated with 11 percent of illnesses, 34 percent of hospitalizations, and 56 percent of deaths. CDC cites several potential contributors to the increase in reported multistate outbreaks, including greater centralization of food processing practices, wider food distribution, and improved detection and investigation methods. developing Crohn’s disease, a chronic inflammatory bowel disease. According to a May 2015 estimate from USDA’s Economic Research Service, the most common 15 foodborne pathogens together impose an economic burden related to foodborne illnesses, hospitalizations, and deaths in the United States of over $15.5 billion annually. That same year, researchers at HHS’s Food and Drug Administration (FDA) estimated health costs associated with foodborne illness at about $36 billion annually.

In addition to the human health toll, foodborne illness outbreaks can impose high costs to industry from food recalls. An October 2011 study published by the Grocery Manufacturers Association (GMA), in partnership with Covington & Burling LLP and Ernst & Young, estimated the cost of food recalls. The study surveyed 36 GMA member companies and found that more than half had been affected by a product recall in the prior 5 years. For companies that had faced a recall in the past 5 years, 48 percent estimated the financial impact to be less than $9 million; 29 percent, from $10 million to $29 million; and 23 percent, $30 million or more. Based on the survey results, the four largest costs that companies face as a result of a recall are business interruption or lost profits; recall execution costs, such as destroying and replacing recalled products; liability risk; and company or brand reputation damage.

As we reported in December 2014, three major trends create food safety challenges. First, a substantial and increasing portion of the U.S. food supply is imported, which stretches the federal government’s ability to ensure the safety of these foods. Second, consumers are eating more raw and minimally processed foods, which in general are more susceptible to foodborne pathogens. Third, segments of the population that are particularly susceptible to foodborne illnesses, such as older adults and immune-compromised individuals, are growing.

The safety and quality of the U.S. food supply, both domestic and imported, are governed by a highly complex system stemming from at least 30 federal laws that are collectively administered by 16 federal agencies. The federal agencies with primary responsibility for food safety oversight are USDA’s Food Safety and Inspection Service (FSIS) and FDA. FSIS is responsible for the safety of meat, poultry, processed egg products, and catfish. FDA is responsible for virtually all other food. As we reported in May 2016, the federal food safety oversight system is supplemented by states, localities, tribes, and territories, which may have their own laws and agencies to address the safety and quality of food.

What GAO Found

HHS, USDA, and OMB have taken some positive steps since the 2015 high-risk update to address fragmentation in the federal food safety oversight system—including in relation to crosscutting requirements for individual strategic and performance planning documents and collaboration on specific food safety issues—but they have not addressed our March 2011 recommendation for a government-wide plan and Congress has not acted on our December 2014 matters for it to consider for government-wide planning and leadership. We continue to believe that these actions are important to federal food safety oversight efforts. A framework for addressing these actions could be provided through development and implementation of a national strategy for food safety oversight. Food safety and government performance experts who participated in a 2-day meeting that we, with the assistance of the National Academies of Sciences, Engineering, and Medicine (National Academies), convened in June 2016 stated that there is a compelling need for such a strategy to provide a framework for strengthening the federal food safety oversight system and addressing fragmentation. a government-wide plan and our December 2014 matters for Congress to consider for government-wide planning and leadership. In addition, developing and implementing a national strategy could provide a framework for addressing criteria for removing food safety from the High- Risk List. Such a strategy could also include actions consistent with our prior suggestion that Congress may wish to assess the need for comprehensive, uniform, risk-based food safety legislation or amendment of FDA’s and USDA’s existing authorities.

What Remains to Be Done

To address capacity constraints for addressing fragmentation in federal oversight of food safety and to guide corrective actions and monitor progress, Congress should consider directing OMB to develop a government-wide performance plan for food safety and formalizing the Food Safety Working Group (FSWG) through statute. To provide building blocks toward OMB’s development of a government-wide performance plan for food safety, USDA should implement our priority recommendation to continue building upon its efforts to implement the GPRA Modernization Act of 2010 (GPRAMA) requirements to address crosscutting food safety efforts in its strategic and performance planning documents, which HHS has already done. These actions should provide federal food safety agencies with vehicles to demonstrate strong commitment to, top leadership support for, and progress in implementing corrective measures to address fragmentation in federal oversight of food safety. These actions could also be addressed through development and implementation of a national strategy for food safety oversight, which could thereby address criteria for removing food safety oversight from the High-Risk List. In addition, such a strategy could include actions consistent with our prior suggestion that Congress may wish to assess the need for comprehensive, uniform, risk-based food safety legislation or amendment of FDA’s and USDA’s existing authorities. If, over the next several years, weaknesses in the food safety system persist, Congress should also consider commissioning a detailed analysis of alternative organizational structures for food safety.

Additional Details on What GAO Found

Leadership Commitment

The criterion of demonstrating commitment to, and top leadership support for, addressing fragmentation in federal oversight of food safety has been partially met. With the enactment of GPRAMA in January 2011, Congress and the executive branch demonstrated strong commitment and top leadership support for improving collaboration across the federal government. GPRAMA further highlights the need for crosscutting strategic and performance planning for issues that involve multiple federal agencies and could provide the initial steps toward a government-wide performance plan for food safety.

GPRAMA added new requirements for addressing crosscutting efforts in federal strategic and performance planning. For example, GPRAMA requires agencies to describe in their strategic and performance planning documents how they are working with other agencies to achieve their goals and objectives. In December 2014, we found that HHS and USDA had taken steps to implement GPRAMA’s crosscutting requirements for their food safety efforts. However, the agencies did not fully address crosscutting food safety efforts in their strategic and performance planning documents. We recommended that HHS and USDA continue to build upon their efforts to implement GPRAMA requirements to address crosscutting food safety efforts in their strategic and performance planning documents. Both agencies agreed with the recommendation. included more information on crosscutting food safety efforts in its fiscal year 2017-2021 strategic plan and in its draft fiscal year 2017 annual plan than it did in its prior strategic and annual plans; USDA planned to include information on interagency collaboration in its next strategic plan, according to USDA officials.

Fully addressing crosscutting food safety efforts in individual strategic and performance planning documents is an important first step toward providing a comprehensive picture of the federal government’s performance in overseeing food safety. However, the agency-by-agency focus of individual planning documents alone does not provide the integrated perspective on federal food safety performance necessary to guide congressional and executive branch decision making and to inform the public about what federal agencies are doing to ensure food safety. Those individual documents could, however, provide building blocks toward the next, more challenging task of developing a single, government-wide performance plan for food safety.

The President demonstrated strong commitment and top leadership in March 2009, when the President established the FSWG to coordinate federal efforts and develop goals to make food safer. In March 2011, we indicated that creation of the FSWG was a positive step. However, the group stopped meeting after about 2 years. In December 2014, we reported that, according to senior FDA and FSIS officials and OMB staff, the FSWG was no longer needed, given the existence of other collaborative mechanisms. FDA and FSIS are involved in numerous mechanisms to facilitate interagency coordination on food safety; however, existing mechanisms focus on specific issues, and none provides for broad-based, centralized collaboration. For example, FDA and FSIS are collaborating with CDC through the Interagency Food Safety Analytics Collaboration to improve estimates of the most common sources of foodborne illnesses. However, this and other mechanisms do not allow FDA, FSIS, and other agencies to look across their individual programs and determine how they all contribute to federal food safety goals.

In addition, the FDA Food Safety Modernization Act (FSMA)—enacted in 2011 to amend existing food safety laws—includes numerous provisions requiring interagency collaboration, but these too focus on specific topics and do not provide for centralized, broad-based collaboration across food safety regulations and programs. In December 2014, we suggested that Congress consider formalizing the FSWG through statute to help ensure sustained leadership across food safety agencies over time.

As of January 2017, HHS, USDA, and OMB had taken some positive steps since our 2015 high-risk update to address fragmentation in the federal food safety oversight system—including continued and expanded collaboration on specific food safety issues—but they had not addressed our March 2011 recommendation for a government-wide plan and Congress had not acted on our December 2014 matters for it to consider for government-wide planning and leadership. We continue to believe that these actions are important to federal food safety oversight efforts. In January 2017, however, we also concluded that a framework for addressing these actions could be provided through development and implementation of a national strategy for food safety oversight. Food safety and government performance experts who participated in a 2-day meeting that we, with the assistance of the National Academies, convened in June 2016 stated that there is a compelling need for such a strategy to provide a framework for strengthening the federal food safety oversight system and addressing fragmentation.

The experts identified stating the purpose, establishing sustained leadership, identifying resource requirements, monitoring progress, and including actions for gaining traction as key elements that should be included in a national strategy for food safety oversight; these elements are consistent with characteristics that we have identified as desirable in a national strategy. We have found that complex interagency and intergovernmental efforts, which could include food safety, can benefit from developing a national strategy and establishing a focal point with sufficient time, responsibility, authority, and resources to lead the effort.

The experts did not specify which entity should lead such a strategy, but they emphasized that it should be led by the highest level of the administration.

Past efforts to develop high-level strategic planning for food safety have depended on leadership from entities within the Executive Office of the President (EOP). By developing a national strategy to guide the nation’s efforts to improve the federal food safety oversight system and address ongoing fragmentation, the appropriate entities within the EOP, in consultation with relevant federal agencies and other stakeholders, could provide a comprehensive framework for considering organizational changes and making resource decisions. Experts identified the following stakeholders as key contributors to a national strategy for food safety: federal, tribal, state, and local government agencies; industry; consumer groups; academia; and key congressional committees.

In our January 2017 report, we found that a national strategy for food safety, as described by the experts and possessing the desirable characteristics identified in our past work, could fulfill the intent behind our March 2011 recommendation for a government-wide plan and our December 2014 matters for congressional consideration for government- wide planning and leadership. Such a strategy could include all of the elements of a government-wide performance plan for federal food safety oversight, such as government-wide goals and performance indicators. In addition, we found that, to the extent that such a strategy establishes sustained leadership, it could fulfill the intent behind our December 2014 matter for Congress to consider formalizing the FSWG through statute to help ensure sustained leadership across food safety agencies over time. We therefore recommended that the appropriate entities within the EOP, in consultation with relevant federal agencies and other stakeholders, should develop a national strategy that states the purpose of the strategy, establishes high-level sustained leadership, identifies resource requirements, monitors progress, and identifies short- and long-term actions to improve the food safety oversight system. HHS and OMB did not comment on our recommendation. USDA disagreed with the need for a national strategy but cited factors to consider should changes be proposed. Even with USDA’s reservations, we continue to believe that a national strategy would provide a comprehensive framework for considering organizational changes and resource decisions to improve the federal food safety oversight system. It will be up to the stakeholders participating in such a strategy to decide which actions to pursue.

Among the actions identified by experts at our June 2016 meeting for potential inclusion in a national strategy was alignment of FDA’s and USDA’s existing authorities. For example, several experts mentioned modifying the statutes that FSIS implements, such as the Federal Meat Inspection Act and the Poultry Improvement Act, to align the authorities of USDA with the Federal Food, Drug, and Cosmetic Act, as amended by FSMA, which outlines FDA’s responsibilities. This could help ensure a consistent approach across food commodities. Such actions would comport with our prior suggestion that Congress may wish to assess the need for comprehensive, uniform, risk-based food safety legislation or to amend FDA’s and USDA’s existing authorities.

Capacity

Federal food safety agencies have partially met the criterion for capacity to address the fragmentation in food safety oversight. USDA and HHS have the capacity to more fully address crosscutting food safety efforts in their individual strategic and performance planning documents; however, OMB action is needed to use those documents as building blocks to develop a government-wide performance plan on food safety. Federal food safety agencies also have the capacity to participate in a centralized collaborative mechanism on food safety—like the FSWG—but congressional action would be required to formalize such a mechanism through statute. Furthermore, appropriate entities within the EOP have the capacity to consult with relevant federal agencies and other stakeholders to develop a national strategy for food safety. Doing so could address our March 2011 recommendation for a government-wide plan and our December 2014 matters for congressional consideration for government-wide planning and leadership.

Action Plan

The criterion of having a corrective action plan has not been met. Without a government-wide performance plan for food safety, Congress, program managers, and other decision makers are hampered in their ability to identify agencies and programs addressing similar missions and to set priorities, allocate resources, and restructure federal efforts, as needed, to achieve long-term goals. Moreover, without a centralized collaborative mechanism on food safety—like the FSWG—there is no forum for agencies to reach agreement on a set of broad-based food safety goals and objectives that could be articulated in a government-wide performance plan on food safety. Development and implementation of a national strategy for food safety could also fulfill these government-wide planning and leadership needs.

Monitoring

The criterion of having a program to monitor corrective measures has not been met. Without a government-wide performance plan for food safety, federal food safety efforts are not clear and transparent to the public. Currently, to understand what government is doing to ensure the safety of the food supply, Congress, program managers, other decision makers, and the public must access, attempt to make sense of, and reconcile individual documents across the 16 federal agencies responsible for administering the more than 30 federal statutes that govern food safety and quality. This government-wide planning need could also be addressed through a national strategy for food safety.

Demonstrated Progress

The criterion of demonstrating progress in implementing corrective measures to address fragmentation in federal oversight of food safety has been partially met. As noted, HHS, USDA, and OMB took some positive steps to address fragmentation in the federal food safety oversight system—including in relation to GPRAMA crosscutting requirements and collaborative mechanisms on specific food safety issues—but they did not address our March 2011 recommendation for a government-wide plan and Congress did not act on our December 2014 matters for it to consider for government-wide planning and leadership. Development and implementation of a national strategy for food safety could fulfill these government-wide planning and leadership needs and show sustained progress in addressing fragmentation in the federal food safety oversight system.

Benefits Achieved by Implementing Our Recommendations

In response to a recommendation we made in December 2014, HHS took steps to update its strategic and performance planning documents to better address crosscutting food safety efforts. For example, in February 2015, HHS updated its strategic plan to more fully describe how it is working with other agencies to achieve its food safety related goals and objectives. Among other things, HHS described its collaboration with USDA, the Environmental Protection Agency, and others through collaborative mechanisms such as the National Antimicrobial Resistance Monitoring System, the Partnership for Food Protection, and the Food Emergency Response Network. As a result, we closed the recommendation to HHS as implemented.

GAO Contact

For additional information about this high-risk area, contact Steve D. Morris at (202) 512-3841 or morriss@gao.gov.

Related GAO Products

Food Safety: A National Strategy Is Needed to Address Fragmentation in Federal Oversight. GAO-17-74. Washington, D.C.: January 13, 2017.

Food Safety: FDA Coordinating with Stakeholders on New Rules but Challenges Remain and Greater Tribal Consultation Needed. GAO-16-425. Washington, D.C.: May 19, 2016.

Federal Food Safety Oversight: Additional Actions Needed to Improve Planning and Collaboration. GAO-15-180. Washington, D.C.: December 18, 2014.

Federal Food Safety Oversight: Food Safety Working Group Is a Positive First Step but Governmentwide Planning Is Needed to Address Fragmentation. GAO-11-289. Washington, D.C.: March 18, 2011.

High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January 2007.

Protecting Public Health through Enhanced Oversight of Medical Products

Why Area Is High Risk

Millions of medical products—drugs, biologics, and medical devices—are used daily by Americans at home, in the hospital, and in other health care settings. The Food and Drug Administration (FDA) has the vital mission of protecting the public health by overseeing the safety and effectiveness of these products marketed in the United States. The agency’s responsibilities begin long before a product is brought to market and continue after FDA approves a product, regardless of whether it is manufactured in the United States or abroad.

The importance of FDA’s role in ensuring our citizens’ well-being cannot be overstated. In recent years, FDA has been confronted with multiple challenges. Rapid changes in science and technology, globalization, unpredictable public health crises, an increasing workload, and the continuing need to monitor the safety of thousands of marketed medical products are among the many challenges with which FDA must routinely contend. The oversight of medical products was added to our High-Risk List in 2009 because these obstacles threatened to compromise FDA’s ability to protect the public health. While progress has been made, we have found that some challenges remain and new ones, such as drug shortages, have emerged.

What GAO Found

In 2015, we found that FDA had made substantial progress in addressing some of the concerns we raised in this high-risk area. Specifically, we determined that FDA had significantly improved its oversight of medical device recalls and the implementation of the Safe Medical Devices Act of 1990. In recognition of the agency’s significant strides in these two areas, we narrowed the scope of our high-risk designation. FDA met all five criteria—demonstrating strong leadership commitment, ensuring sufficient capacity, developing both specific action plans and effective monitoring tools, and demonstrating progress—for having the high-risk designation removed for both medical device areas. At that time we also found that FDA had action plans in place to help it respond to two remaining issues of high importance: the effect of globalization on FDA’s ability to monitor medical product manufacturing, and the availability of medically necessary drugs. In addition, we reported that the agency’s leadership was committed to and supportive of initiatives in these two remaining areas. However, the agency’s capacity to address these issues was unclear, and the effectiveness of its monitoring and lack of adequate progress was a concern. Therefore, FDA’s oversight of medical products remained as a high-risk area.

Since 2015, we have found FDA has made some progress addressing our remaining concerns about globalization and drug availability. For example, FDA has demonstrated progress in responding to globalization by increasing the number of inspections it conducts of foreign manufacturing establishments producing drugs for the U.S. market. It has also improved the accuracy and completeness of information in its catalog of drug manufacturing establishments subject to inspection (which we referred to as an “inventory” in previous reports). The availability of more reliable data should enhance FDA’s oversight and help FDA apply its risk-based model for selecting drug establishments for inspection. FDA also has the opportunity to better monitor drug shortages by fully utilizing a recently implemented tracking system.

Although these are positive steps, we continue to have concerns in both areas. The effectiveness of FDA’s foreign offices, which began opening in 2008, has not yet been meaningfully assessed. In addition, persistently high vacancy rates in these offices suggest that they may lack the capacity to robustly monitor the global arena as the agency originally envisioned. As of July 2016, 46 percent of FDA foreign offices positions were vacant. Moreover, we found that some of the challenges FDA faces in recruiting staff to work in these offices are the same as those we reported on in 2010 and 2015.

With regard to ensuring drug availability, the way FDA monitors its drug shortage information remains a concern. Although it implemented a new tracking system—the Shortage Tracker—in March 2016, this is the fourth approach to monitoring shortages that the agency has taken in 5 years. According to FDA, it routinely enters data into the system, but the agency has not yet developed standard reports to help it manage its efforts, nor has it made plans to use these data to analyze trends or identify patterns to help it predict future shortages. Similarly, we remain concerned about the reliability and availability of information that is necessary to monitor postmarket drug safety. For example, FDA has not yet fully implemented a recommendation we made in 2013 to ensure its databases collect reliable and timely data on inspections of certain establishments that compound drugs. causes, has been inconsistent. These inconsistencies may undermine FDA’s action plan and its effectiveness. In addition, in December 2015 and May 2016, we identified new concerns regarding the agency’s collection of reliable data regarding postmarket drug safety and shortcomings in its broader strategic planning efforts for drugs and other medical products. As a result, we no longer consider that FDA has met the criteria associated with having an effective action plan, and are therefore changing its rating in this area from met to partially met.

In recent years, Congress has taken actions that have facilitated FDA’s ability to address concerns we have identified, and make progress in this important high-risk area.

In July 2013, we reported that FDA’s authority to oversee drug compounding was unclear. The Drug Quality and Security Act, enacted in November 2013, helped clarify FDA’s authority to oversee drug compounding nationally. In November 2016, we reported that since the law’s enactment, FDA has issued numerous guidance documents related to compounding and conducted more than 300 inspections of drug compounders. These inspections have resulted in actions such as FDA issuing warning letters, which are issued for violations of regulatory significance, and recalls voluntarily initiated by manufacturers of potentially contaminated drugs.

The Food and Drug Administration Safety and Innovation Act (FDASIA), enacted in July 2012, directed FDA to take a risk-based approach to inspecting both foreign and domestic drug manufacturing establishments, consistent with our 2008 recommendation. FDA has now fully implemented this provision. The number of foreign inspections has consistently increased each year since fiscal year 2009. In fiscal year 2015, FDA conducted more foreign than domestic inspections. The agency has also enhanced its risk-based approach to prioritizing drug establishments for inspection.

What Remains to Be Done

consider the agency to meet the criteria for having an effective action plan.

In addition to redoubling its efforts to develop—and sustain—an effective action plan for both globalization and drug availability, FDA needs to demonstrate that it has the capacity to address multiple challenges we have identified, along with effective monitoring strategies. For example, it needs to fully execute its plan to inspect the many foreign drug establishments making drugs for the U.S. market, for which it has no inspectional history, over the next 3 years.

Furthermore, FDA should implement our prior recommendations to resolve new and previously identified concerns, including the following:

FDA should assess the effectiveness of the foreign offices’ contributions, by systematically tracking information to measure whether the offices’ activities specifically contribute to drug safety- related outcomes, such as inspections, import alerts, and warning letters.

FDA should establish goals to achieve the appropriate staffing level for its foreign offices.

FDA should routinely use its new Shortage Tracker and conduct periodic analyses to systematically assess drug shortage information to proactively identify risk factors for potential drug shortages.

FDA should develop comprehensive plans, including goals and time frames, to correct problems with its postmarket safety data and ensure that these data can be easily used for oversight.

FDA should consistently collect reliable and timely information in FDA’s databases on inspections and enforcement actions associated with compounded drugs.

Additional Details on What GAO Found

Response to Globalization

Leadership Commitment

FDA has met this criterion. In 2015, we noted FDA showed leadership commitment to this area by creating an office dedicated to confronting the challenges of globalization and helping prepare the agency to move from regulating domestic products to overseeing a worldwide market. The agency’s leadership commitment was made further evident by its strategic priorities for fiscal years 2014 through 2018, which discuss its goal of expanding its regulatory presence and partnerships overseas.

Capacity

producing drugs for the U.S. market than any other country, followed closely by China. While globalization brings benefits, it also carries risks, as some of these countries have regulatory systems less sophisticated than our own. This global marketplace has placed greater pressure on FDA to oversee the safety and effectiveness of all medical products marketed in the United States, regardless of where they are produced.

In 2008, we reported that FDA inspected relatively few foreign drug manufacturing establishments each year. We also pointed out that FDA had not used its risk-based process to select foreign establishments for inspection to the extent it had for selecting domestic establishments. Two years later, in 2010, we reported FDA had increased the number of foreign drug inspections it conducted, but that it still conducted relatively fewer foreign drug inspections. However, since 2009, FDA has enhanced its capacity to conduct inspections and has increased the number of foreign establishments it inspects each year. In fiscal year 2015, FDA conducted more foreign than domestic inspections. Establishments in China and India were inspected by FDA more than those in other foreign countries.

More recently, we have questioned the effectiveness of FDA’s foreign offices, which are overseen by its Office of International Programs (OIP). FDA began opening these offices in 2008 to obtain better information on products coming from overseas. Among other things, these offices help FDA build partnerships with its regulatory counterparts and industry members overseas, and help certain countries improve their regulatory capacities. Staff in these offices also inspect foreign establishments, gather intelligence, and foster information sharing with FDA headquarters. In December 2016, we reported that, while foreign office staff have inspected drug establishments overseas, they have conducted relatively few such inspections and may not have the capacity to do more. Most inspections of foreign drug establishments have been conducted by FDA’s domestically-based staff. Foreign office staff have conducted 5 percent of these inspections since fiscal year 2010.

Further, the persistently high vacancy rates in these offices suggest that they may lack the capacity to robustly assist FDA and monitor the global arena, as the agency originally envisioned. As of July 2016, 46 percent of the offices’ positions were vacant, up slightly from 44 percent in October 2014. Moreover, we found that FDA still faces some of the challenges of recruiting staff to work in these offices that we identified in 2010 and 2015.

Although FDA recently finalized a strategic workforce plan, as we recommended in 2010, we have identified several weaknesses in it. For example, the plan does not target vacancies by specific position types. While FDA recognizes its vacancy rate in its foreign offices is high and has set a goal of reducing this rate, the measure it has developed targets all of the staff in OIP, including those who are domestically-based. Thus, FDA could increase the number of domestically-based staff in OIP and fulfill its goal without reducing vacancies in its foreign offices. We remain concerned that, without targeting the foreign offices specifically or the types of positions most likely to have vacancies, FDA will not have a meaningful measure reflecting its true staffing needs overseas. In December 2016, we recommended that FDA establish goals to achieve the appropriate staffing levels for its foreign offices, which would include separating foreign office vacancies from the OIP-wide vacancy rate and setting goals by position type. We believe such actions are needed in order for FDA to demonstrate progress and help ensure that its foreign offices have the capacity to monitor conditions abroad and meaningfully contribute to drug safety. FDA said it is taking immediate steps to address this recommendation.

Action Plan

FDA has met this criterion. In 2015, we recognized that FDA had developed an action plan for building a stronger, more secure global product safety net. In addition, we noted that FDA developed plans to partner with foreign regulatory authorities to leverage resources through increased information sharing following the enactment of FDASIA in 2012, which increased FDA’s ability to strengthen its efforts in this area. FDASIA also reinforced our 2008 recommendation that the agency should take a risk-based approach to selecting both foreign and domestic drug manufacturing establishments for inspection, which helped FDA develop plans to prioritize its drug inspections.

Monitoring

FDA has partially met this criterion. We have been critical of FDA’s internal monitoring of its drug inspection program since as early as 1998, when we reported that the agency’s own internal evaluations concluded that it did not have a comprehensive data management system to monitor foreign manufacturers. The evaluations concluded that unless corrected, problems in FDA’s foreign inspection program could allow adulterated and low-quality drugs to be imported, posing serious health risks to Americans. Although the agency was aware of this problem, we found that similar problems persisted in 2008 and 2010, which affected the agency’s ability to manage the foreign drug inspection program.

FDA has recently taken steps to better monitor its drug inspection program. In December 2016, we reported that FDA formalized its process for developing, evaluating, and documenting key decisions about the risk- based model that it will use to select drug establishments to inspect each year. FDA previously lacked a process for tracking revisions to its model and, as a result, officials were unable to recall or explain all the changes to the model over time. FDA’s documentation will now chronicle decisions made regarding which factors were included in the model in a particular year, according to officials. FDA officials also said that our prior reviews reinforced the need for written procedures.

FDA has also taken steps to improve the accuracy and completeness of the information it uses to manage its foreign drug inspection program. The databases that FDA was using to select establishments to inspect did not contain accurate information on the number of establishments manufacturing drugs for the U.S. market, as we reported in 2008. Two years later, in 2010, we also found that 64 percent of the foreign establishments in FDA’s catalog may have never been inspected, almost half of which were in China and India. To help the agency manage its catalog of data, FDA established a data governance board in May 2015 to define standards, best practices, and policies, on which FDA’s oversight depends, including the veracity of its risk-based site selection model. FDA officials said the board has developed guidance for merging data processes and is working toward defining data metrics to determine whether they have improved on their reporting. The board has also defined data standards for storing key attributes of establishments, such as companies’ names, and continues to examine best practices for sharing establishment data across FDA.

This action has helped FDA reduce the number of establishments in its catalog that may never have had a surveillance inspection. Currently, FDA lacks information on the inspection history of 33 percent of the foreign establishments in its catalog, compared to the 64 percent for which it lacked inspection history in 2010. While the agency has made progress in reducing this knowledge gap, it is important to note that the overall number of foreign establishments with no surveillance inspection history remains large, with about 1,000 of the approximately 3,000 in its catalog of establishments with no inspection history. To address this persistent concern, the agency plans to inspect all establishments in its catalog with no prior surveillance inspection history over the next 3 years (approximately one-third each year), beginning in fiscal year 2017.

In addition, FDA has not sufficiently monitored the contributions of its foreign offices or meaningfully assessed their effectiveness. While these offices engage in collaborative activities with foreign stakeholders, FDA does not systematically track how information collected by the offices has contributed to drug safety. The agency has been considering the best approach to assessing the future needs of its foreign offices and measuring their performance. In 2014 and 2015, FDA’s Office of Planning compiled detailed information about their operations, including their workforce composition.

More recently, in July 2016, FDA’s Office of Planning completed an internal evaluation to develop an evidence-based, collaborative, and repeatable process to select foreign post locations, considering the effects of cost, legislation, and program alignment on FDA foreign post operations, and the appropriate mix of FDA staffing at the posts. This evaluation proposed a process for determining the correct mix of staffing and position types for the foreign offices. The results of this evaluation suggest that the foreign offices would benefit from strategically aligning their operational activities and desired public health impacts. However, OIP has yet to implement and apply the process to the foreign offices. In December 2016, we recommended that FDA assess the effectiveness of the foreign offices’ contributions, which would require systematically tracking information to measure whether the offices’ activities specifically contribute to drug safety-related outcomes. FDA said it is taking immediate steps to address this recommendation.

Demonstrated Progress

FDA has partially met this criterion. Since 2015, FDA has taken a variety of steps to respond to globalization and has made progress in meeting this challenge. For example, FDA has strengthened its monitoring of foreign drug establishments by improving the accuracy and completeness of information used to develop its catalog of drug manufacturing establishments subject to inspection. The availability of more reliable data should enhance FDA’s monitoring and oversight while helping it apply its risk-based model for prioritizing drug establishments for inspection. taken a risk-based approach to inspecting both foreign and domestic drug manufacturing establishments, in accordance with a directive in FDASIA and consistent with our 2008 recommendation. formalized its process for prioritizing the establishments it inspects to determine compliance with good manufacturing requirements, based on certain risk factors specified by FDASIA. decided that, starting in fiscal year 2017, the agency will allow no more than 5 years to elapse between inspections at a specific establishment.

Yet, FDA still faces challenges overseeing the global marketplace and must continue to demonstrate progress in conducting more inspections of foreign establishments. There remain a large number of foreign establishments making drugs for the U.S. market—almost 1,000—that may never have been inspected.

Drug Availability

Over the last decade, prescription drugs—including those that are life- saving and life-sustaining—have been in short supply, preventing health care providers and patients from accessing medications that are essential for treatment. Those in shortage have included essential therapies, such as anesthetic, anti-infective, cardiovascular, nutritive, and oncology drugs. Although the number of new shortages reported each year has generally decreased since 2011, the number of ongoing shortages—those that began in prior years—have remained high. Since 2013, the majority of the ongoing shortages in a given year were first reported at least 2 years earlier. We have issued several reports on this topic since 2011 and made recommendations to enhance the agency’s ability to respond and oversee shortages. FDA has since implemented some of these recommendations.

Leadership Commitment

FDA has met this criterion by demonstrating leadership commitment to responding to drug shortages, which we recognized in 2015. Its strategic priorities for fiscal years 2014 through 2018 emphasize its continued commitment to responding to shortages. FDASIA also required FDA to issue a strategic plan to enhance the agency’s ability to prevent and mitigate shortages. FDA issued this strategic plan in October 2013.

Capacity

found that, while shortages persisted, FDA had prevented more potential shortages than it had in the prior 2 years by, for example, working with manufacturers to increase production. More recently, in 2016, we reported that FDA prioritized its review of nearly 400 applications to market generic drugs (or supplements to existing approved new or generic drug applications) to address shortages from January 2010 through July 2014. We analyzed a subset of those submissions and found that some were approved before the shortage was prevented or resolved. Although the timing of FDA’s approvals of submissions could not be directly linked to the resolution of particular shortages, we believe that prioritizing reviews may be a useful strategy in addressing some drug shortages. Despite the agency efforts, shortages persist and we recognize that FDA cannot resolve this concern alone. Nonetheless, there is more FDA could do. For example, given that the median time to approve prioritized generic drug applications is over a year, this approach is generally not a strategy for addressing shortages in the short term. In addition, FDA’s ability to manage risk-based decisions and proactively help prevent and resolve shortages may be hindered because it does not routinely analyze the data it collects.

Action Plan

FDA now partially meets this criterion. In 2015, we rated FDA as meeting this criterion. However, we are changing this rating to partially meets due to shortcomings that we identified in recent reports, as discussed below.

In order to protect public health, FDA works to ensure the availability of medically necessary drugs and the safety of the drug supply. In our 2015 high-risk report, we credited FDA for having an action plan that focuses on its capacity to respond when alerted to supply disruptions and on developing long-term prevention strategies to address the causes underlying supply disruptions. However, more recently we have identified several concerns with the agency’s readiness and plans to collect, track, and analyze data related to drug shortages and postmarket drug safety. We have also reported on shortcomings in its broader strategic planning efforts related to drugs and other medical products. We no longer consider that FDA has met the criteria associated with having an effective action plan. routinely and systematically assess this information, and use it proactively to identify risk factors for potential drug shortages. FDA’s response to these two recommendations has been mixed and an action plan has not been fully developed to implement these recommendations.

In 2011, FDA relied on e-mail status reports to track shortages. Later that year it began using an electronic spreadsheet, which was replaced by a drug shortage database in 2012. A new drug shortage data system followed in 2014. But FDA’s planning did not result in a smooth transition from one system to another. FDA suspended its use of the drug shortage database at the end of 2013 while it was developing the more robust drug shortage data system. The transition to the new data system took longer than anticipated and FDA documented limited information about shortages using manual logs during an extended period in 2014. FDA began using its new data system in late 2014, and information on new and active shortages in 2014 was entered retroactively into this system. However, that system is no longer in use and FDA has now adopted an even newer system—its fourth approach to monitoring shortages in 5 years. The Shortage Tracker was implemented in March 2016. While it appears promising, FDA officials said it has been populated with data going back to January 2015 only, precluding the agency from easily conducting extensive analyses of trends prior to that date. Moreover, the agency has not yet made plans to use these data to analyze trends or identify patterns to help it predict future shortages, nor has it developed standard reports to assist with managing its efforts.

Similar to our concerns with FDA’s drug shortage data, the reliability and availability of information that is necessary to monitor postmarket drug safety is limited. FDA lacks an action plan to address these issues. For example, in July 2013 we reported that FDA lacks timely and reliable information to oversee the entities that compound drugs, including timely, reliable information on the findings of inspections of these entities. FDA’s inspection database did not always distinguish compounding pharmacies from manufacturers of human or veterinary drugs. In addition, its database did not consistently reflect the agency’s final determination of an individual inspection’s results. We also found that the agency lacked reliable data to make decisions to prioritize its inspections of such pharmacies and other follow-up and enforcement actions. We recommended that FDA ensure its databases collect reliable and timely data on inspections of certain establishments that compound drugs, but the agency has not yet fully implemented this recommendation, which would improve its monitoring.

Similarly, in December 2015, we found that FDA lacks reliable, readily accessible data on tracked safety issues and postmarket studies needed to meet certain postmarket safety reporting responsibilities, and to conduct systematic oversight. Tracked safety issues are potential safety issues that FDA determines are significant and that it tracks using an internal database. However, FDA’s evaluations of its database revealed problems with the completeness, timeliness, and accuracy of the data. For example, data on tracked safety issues were incomplete, postmarket study data were outdated and contained inaccuracies, and tracked safety issue and postmarket study data were not readily accessible to FDA staff for analysis. These problems, as well as problems with the way data are recorded that impair their accessibility, have prevented FDA from publishing statutorily required reports on certain potential safety issues and postmarket studies in a timely manner, and have restricted the agency’s ability to perform systematic oversight of postmarket drug safety.

FDA has demonstrated some progress in addressing the problems with its data. However, the agency lacks plans that comprehensively outline its efforts and establish related goals and time frames. We recommended that FDA develop plans to correct problems with its postmarket safety data and ensure that these data can be easily used for oversight. While FDA recognized the challenges with its ability to track safety issues and has begun some efforts to improve its data, the agency has not provided comprehensive plans, with goals and time frames, to help ensure that FDA corrects the identified problems with its database on safety issues and postmarket studies. among the centers. Moreover, the strategic integrated management plan does not fully link its performance goals to its general goals and objectives.

We also found in May 2016 that FDA lacks measurable goals to assess its progress in advancing regulatory science—the science supporting its effort to assess the products it regulates. Although the agency issued strategic planning documents in 2011 and 2013 to guide its regulatory science efforts and identify priority areas for conducting work, these documents do not specify the targets and time frames necessary for the agency to measure progress overall or within each of the eight priority areas related to medical products. According to leading practices for strategic planning, identifying and using consistent measurable goals in planning and progress documents is important to assessing effectiveness. While FDA cited examples of its achievements in regulatory science in a 2015 report, it cannot assess how those achievements constitute progress towards its goals. In addition, FDA lacks information about how funding targeted at regulatory science is distributed across the priority areas. Decisions to award these funds are made by individual FDA centers and offices, which generally did not collect information on the associated priority areas of funded projects. Rather, FDA retrospectively identified these areas for the purpose of our review. The lack of consistent information limits FDA’s ability to examine obligations across, or progress within, specific priority areas. Furthermore, multiple centers or offices fund projects toward a given priority area and leading practices for strategic planning encourage agencies to manage efforts that cut across the agency.

Given the totality of our concerns, which range from needing action plans to address specific weaknesses we have identified to the agency’s overall strategic planning, we no longer consider that FDA has met the criteria associated with having an effective action plan. This criterion requires that a corrective action plan exist that defines the root cause, identifies solutions, and explains how an agency will substantially complete corrective measures, including steps necessary to implement solutions we recommended. We are therefore changing FDA’s action plan rating in this area, as well as its overall rating, from met to partially met.

Monitoring

help it predict future shortages. While the drug shortage staff said that FDA’s Office of Pharmaceutical Quality will be interested in using data to conduct rigorous analyses for predicting shortages and risk factors, the drug shortage staff have not provided reports to any FDA components, raising questions about the agency’s commitment to conducting such analyses and leaving this recommendation unimplemented.

We are also concerned that the annual reports FDA has issued to Congress on drug shortages have been limited, with no report providing data for more than a 9-month period. This annual report, which is required by FDASIA, is due no later than the end of the calendar year. FDA staff explained to us that it is not possible to issue a report containing 12 months of calendar year data by December 31, and they therefore report data from the first 9 months. However, FDA has not met the December 31 deadline, with publication dates ranging from February 5 through April 17. Given that the agency has never met its publication deadline, we believe it would be more helpful that policymakers receive a full year’s worth of data—such as data covering the federal fiscal year (October 1 through September 30)—so they could more closely monitor shortage information themselves and obtain a more realistic view of this serious public health problem.

Demonstrated Progress

FDA has partially met this criterion by taking actions in recent years. FDA has implemented some of our recommendations, including one we made in 2014 regarding the need for the agency to develop policies and procedures for its drug shortages information management system, now known as the Shortage Tracker. These policies and procedures should help ensure information is entered into the Shortage Tracker consistently and accurately. FDA has assessed how it allocates its resources to improve the agency’s capacity to respond to drug shortages and increased the number of personnel devoted to shortages, as we recommended in 2011. In addition, FDA elevated the office of its drug shortage staff to a more prominent position in the agency and assigned drug shortage coordinators in each of its 20 district offices to help bring drug shortage-related concerns to light earlier, such as inspections citing violations of good manufacturing practices at establishments producing a large volume of drugs. And as we recommended in 2011, FDA has issued a strategic plan to enhance the agency’s ability to prevent and mitigate shortages, and also developed results-oriented performance metrics that can help evaluate program performance. including fully addressing the recommendations we made in 2011 and 2014. While FDA developed the new Shortage Tracker in March 2016— its fourth approach to monitoring shortages in the last 5 years—it needs to use this system consistently and share information across FDA offices regarding drugs that are in short supply. FDA also needs to periodically analyze this information to proactively identify risk factors for potential drug shortages early, thereby potentially helping FDA to recognize trends, clarify causes, and resolve problems before drugs go into short supply.

Benefits Achieved by Implementing Our Recommendations

FDA is now conducting more inspections of foreign manufacturing establishments producing drugs for the U.S. market, and is taking a risk-based approach by combining foreign and domestic establishments into a single list to prioritize establishments for inspection.

FDA has improved the accuracy and completeness of information in its catalog of drug manufacturing establishments subject to inspection.

FDA has developed a new drug shortage tracking system.

GAO Contact

Related GAO Products

Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but Needs to Assess the Effectiveness and Staffing of Its Foreign Offices. GAO-17-143. Washington, D.C.: December 16, 2016.

Drug Compounding: FDA Has Taken Steps to Implement Compounding Law, but Some States and Stakeholders Reported Challenges. GAO-17-64. Washington, D.C.: November 17, 2016.

Drug Shortages: Certain Factors Are Strongly Associated with This Persistent Public Health Challenge. GAO-16-595. Washington, D.C.: July 7, 2016.

Food and Drug Administration: Comprehensive Strategic Planning Needed to Enhance Coordination between Medical Product Centers. GAO-16-500. Washington, D.C.: May 16, 2016.

Drug Safety: FDA Expedites Many Applications, But Data for Postapproval Oversight Need Improvement. GAO-16-192. Washington, D.C.: December 15, 2015.

Drug Shortages: Better Management of the Quota Process for Controlled Substances Needed; Coordination between DEA and FDA Should Be Improved. GAO-15-202. Washington, D.C.: February 2, 2015.

Drug Shortages: Public Health Threat Continues, Despite Efforts to Help Ensure Product Availability. GAO-14-194. Washington, D.C.: February 10, 2014.

Drug Compounding: Clear Authority and More Reliable Data Needed to Strengthen FDA Oversight. GAO-13-702. Washington, D.C.: July 31, 2013.

Drug Shortages: FDA’s Ability to Respond Should Be Strengthened. GAO-12-116. Washington, D.C.: November 21, 2011.

Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals

Why Area Is High Risk

The Environmental Protection Agency’s (EPA) ability to effectively implement its mission of protecting public health and the environment is critically dependent on assessing the risks posed by chemicals in a credible and timely manner. Such assessments are the cornerstone of scientifically sound environmental decisions, policies, and regulations under a variety of statutes, such as the Safe Drinking Water Act, the Toxic Substances Control Act (TSCA), and the Clean Air Act. EPA conducts assessments of chemicals under its Integrated Risk Information System (IRIS) program. EPA is also authorized under TSCA to obtain information on the risks of chemicals and to control those the agency determines pose an unreasonable risk. Because EPA had not developed sufficient chemical assessment information under these programs to limit exposure to many chemicals that may pose substantial health risks, we added this issue to the High-Risk List in 2009 as a government program in need of broad-based transformation. The Frank R. Lautenberg Chemical Safety for the 21st Century Act, enacted on June 22, 2016, provides EPA with greater authority to address chemical risks, but implementing it will take time.

What GAO Found

to continue to implement the TSCA reform legislation and define how it will implement corrective actions to assess and control toxic chemicals.

EPA has now met the criteria for monitoring the IRIS program by finalizing the IRIS Multi-Year Agenda and other actions, including continuing to submit IRIS assessments for independent review to entities with scientific and technical credibility. EPA has not met the criteria for monitoring the TSCA program; to help ensure that the resources dedicated to TSCA are sufficient for effectively implementing the new law, EPA needs to institute a program to monitor and independently validate the effectiveness and sustainability of its initiative to use the new TSCA authorities. For the IRIS program, EPA has now partially met the criteria for demonstrated progress by, among other things, issuing five IRIS assessments since fiscal year 2015—as of January 19, 2017—and making three assessments available for public comment in fiscal year 2016 in preparation for an external peer review meeting associated with that particular assessment. For the TSCA program, EPA has not met the criteria for demonstrated progress. Both the IRIS and TSCA programs need to continue to implement corrective actions to resolve this complex high-risk area.

Passing the Frank R. Lautenberg Chemical Safety for the 21st Century Act may facilitate EPA’s effort to improve its processes for assessing and controlling toxic chemicals in the years ahead. The new law provides EPA with greater authority and the ability to take actions that could help EPA implement its mission of protecting human health and the environment. Continued leadership commitment from EPA officials and Congress will be needed to fully implement reforms. Additional work will also be needed to issue a workload analysis to demonstrate capacity, complete a corrective action plan, and demonstrate progress implementing the new legislation.

What Remains to Be Done

Integrated Risk Information System

We recommended that EPA periodically assess the level of resources that should be dedicated to the Integrated Risk Information System (IRIS) program to meet user needs and maintain a viable database. therefore is not ensuring that current and accurate information on chemicals that EPA plans to assess through IRIS is available to IRIS users. Using the Federal Register to communicate these plans offers greater transparency to the public about the IRIS process than other forms of communication.

We recommended that EPA develop a strategy to address the needs of its Program Offices and regions when IRIS toxicity assessments are not available. Officials from select EPA offices stated that, in the absence of agency-wide guidance, they used a variety of sources, other than IRIS toxicity assessments to meet their needs, including toxicity information from other EPA offices, or other state or federal agencies. IRIS program officials also stated that there is no agency- wide mechanism for EPA to ensure that chemicals without sufficient scientific data during one nomination period will have such information by subsequent nomination periods. We recognize that the development of EPA’s Multi-Year Agenda, issued in December 2015, was a productive effort that EPA told us included an extensive evaluation of user needs. However, the agency does not have a strategy for addressing data gaps or have assurance that its efforts will be sustainable over time. EPA needs to address this priority recommendation by developing: (1) an agency-wide strategy that addresses coordination across EPA offices and with other federal research agencies to help identify and fill data gaps that preclude the agency from conducting IRIS toxicity assessments, and (2) guidance that describes alternative sources of toxicity information and when it would be appropriate to use them when IRIS values are not available, applicable, or current.

Toxic Substances Control Act

After many years of congressional committees considering legislation aimed at reforming the Toxic Substances Control Act (TSCA), in June 2016, Congress passed and the President signed the Frank R. Lautenberg Chemical Safety for the 21st Century Act, which gave EPA greater authority to improve its processes for assessing and controlling toxic chemicals. EPA and Congress need to continue to ensure that the resources dedicated to TSCA activities are sufficient to effectively implement the new law.

We made three priority recommendations to address challenges EPA has faced obtaining toxicity and exposure data, banning or limiting the use of chemicals, and identifying resource needs. First, we recommended that EPA issue a rule to obtain toxicity and exposure data that chemical companies have submitted to the European Chemicals Agency. Second, we recommended that EPA issue a rule to obtain exposure-related data from processors. Third, we recommended that EPA develop strategies for addressing challenges associated with obtaining these data, banning or limiting the use of chemicals, and identifying resource needs. Because EPA has used its authority to limit or ban only five chemicals since TSCA was originally enacted in 1976, in part, because it believed it didn’t have enough information, we made these recommendations to address these concerns. The Frank R. Lautenberg Chemical Safety for the 21st Century Act, enacted on June 22, 2016, provides EPA with greater authority to address chemical risks, but implementing it will take time.

With the implementation of the Frank R. Lautenberg Chemical Safety for the 21st Century Act, we believe EPA can make progress on these open recommendations. The act substantially revises TSCA and requires EPA to carry out numerous rulemaking and other activities within the next 2 years. In early 2016, we started a review of the TSCA program. With the passage of TSCA reform, we decided to suspend our review and give EPA time to implement the new law. In October 2016, as part of our recommendation follow-up process, we reviewed information on the new TSCA provisions. EPA officials told us that with new TSCA authority, the agency is better positioned to take action to require chemical companies to report chemical toxicity and exposure data. The new law authorizes EPA to order companies to develop new information relating to a chemical as necessary for prioritization and risk evaluation. This authority may help EPA to gather new information, as necessary, to evaluate hazard and exposure risks. TSCA reform legislation offers promise for EPA implementation of our recommendations and bringing the agency closer to achieving its goal of ensuring the safety of chemicals.

Additional Details on What GAO Found

provide a management-level review for consistency and quality control across assessments. Also, the Office of Research and Development’s Deputy Assistant Administrator worked with other EPA Deputy Assistant Administrators in Program Offices, such as the Office of Water and Deputy Regional Administrators, to develop the IRIS Multi-Year Agenda. EPA’s top leadership has also demonstrated support for improving the IRIS program by continuing to implement recommendations from us and EPA’s Science Advisory Board, and suggestions from the National Academies.

Capacity

EPA has partially met the criteria for capacity, after not meeting the criteria in 2015. In May 2013, we reported that EPA had not recently evaluated the demand for IRIS toxicity assessments with input from users inside and outside EPA. In response to our report, EPA started work on an IRIS Multi-Year Agenda in the summer of 2013 and issued it in December 2015. According to EPA, the purpose of the agenda was to: (1) identify IRIS assessments currently underway and their status; (2) prioritize IRIS assessments that will be initiated over the next few years; and (3) evaluate assessment needs and develop an update process for existing IRIS values. Now that EPA has finalized the agenda, the agency is better informed about how many people and resources to dedicate to the IRIS program.

We have reviewed internal EPA documents on the need for people and resources, and the IRIS program has started to determine if it has the capacity to address the issues it faces. Because of EPA’s efforts to develop the Multi-Year Agenda, in October 2016, we closed a priority recommendation we made to EPA in 2008 for the program to determine the types of IRIS assessments to conduct on the basis of the needs of EPA’s Program Offices and other users. EPA’s actions are a good starting point for EPA’s continued process for determining the types of IRIS assessments to conduct on the basis of the needs of EPA’s Program Offices and others.

Action Plan

part of its process for developing the Multi-Year Agenda it issued in December 2015. EPA also indicated that the agency used six general criteria to inform the selection of chemicals for assessment or reassessment, and it documented this process in an internal working table as part of its process for developing the agenda. By beginning to document how it applies its IRIS selection criteria, the IRIS program can start to determine a corrective action plan that defines root causes and solutions to move the program forward. EPA needs to be as transparent as possible when applying the selection criteria so that IRIS stakeholders can know how EPA is choosing what assessments to start and why.

Monitoring

EPA has met the criteria for monitoring the IRIS program—after partially meeting the criteria in 2015—by finalizing the IRIS Multi-Year Agenda and other actions. Specifically, the program identified and evaluated demand for the number of IRIS toxicity assessments and resources required to meet users’ needs—a priority recommendation we made in 2013 and closed recently based on internal documents provided by EPA. Moreover, EPA presented a plan for how the agency will implement the National Academies’ suggestions for improving IRIS assessments in the “roadmap for revision” included in the National Academies’ peer review report on the draft formaldehyde assessment. The National Academies’ most recent report on the IRIS program, issued in May 2014, independently validates some of the corrective measures the program is implementing. EPA also created the Chemical Assessment Advisory Committee in January 2013, and uses it to provide continuing, consistent review of IRIS assessments and comment on implementing the National Academies’ suggestions in specific IRIS assessments—a recommendation we made in December 2011 and closed in the fall of 2016. All of these actions demonstrated EPA’s commitment to monitoring the IRIS program.

Demonstrated Progress

EPA has partially met the criteria for demonstrating progress in implementing corrective measures by taking actions, such as releasing the IRIS Multi-Year Agenda that publicly identifies the current and future IRIS assessments. As of January 19, 2017, EPA issued two assessments in fiscal year 2017, two assessments in fiscal year 2016, and one assessment in fiscal year 2015. In addition, EPA made three assessments available for public comment in fiscal year 2016 in preparation for an external peer review meeting associated with that particular assessment. the public’s comments prior to peer review. EPA told us that the Stopping Rules also are important to the IRIS process to determine how to include new studies in an assessment without delaying the process or cycling through repeated revisions and re-revisions.

Because of these actions, we closed a 2008 priority recommendation that demonstrated progress in implementing corrective measures. The recommendation called for EPA to conduct IRIS assessments on the basis of peer-reviewed scientific studies available at the time of the assessment, and develop criteria for allowing assessments to be suspended to await the completion of scientific studies only under exceptional circumstances. Although EPA officials told us that the agency has not formally invoked the Stopping Rules in response to a request to delay an assessment to incorporate studies, they told us they apply the rules in their everyday work when deciding whether to include new studies at different points in the IRIS development process. EPA said they would characterize the Stopping Rules as public IRIS policies that are in place to avoid delay for the inclusion of new studies or analysis that they believe would not affect the assessment’s conclusions.

Over the past two decades, we reported that EPA had found much of TSCA difficult to implement—hampering the agency’s ability to obtain certain chemical data or place limits on chemicals. For example, EPA has found it difficult to obtain adequate information on toxicity—that is, the degree to which the chemical is harmful or deadly—and exposure levels—the frequency and duration of contact with the chemical. Without this information, it is difficult for EPA to determine whether a chemical poses an unreasonable risk to human health or the environment, and then take any action necessary to regulate such chemicals. The Frank R. Lautenberg Chemical Safety for the 21st Century Act, which reformed TSCA, was enacted on June 22, 2016. The new law provides EPA with greater authority and the ability to take actions that could help EPA implement its mission of protecting human health and the environment.

Leadership Commitment

including TSCA. In addition, the former Administrator and top leadership have expressed support for implementing TSCA reform. For example, the former Administrator said that, as with any major policy reform, this one includes compromises. But the former Administrator noted that the legislation should help EPA’s mission to protect public health and the environment.

Capacity

As in 2015, EPA has not met the criteria for capacity because the agency has not yet issued a workload analysis which is needed to determine whether EPA’s TSCA program has the capacity—people and resources— to resolve the risk to the program. The TSCA reform legislation requires EPA to report to Congress by December 2016 on its capacity to implement certain aspects of the legislation, including carrying out chemical risk evaluations and issuing rules regulating specific chemicals. In January 2017, EPA issued a report in response to this deadline. The report estimates the costs of carrying out risk evaluations under the TSCA reform legislation and discusses actions underway or planned for increasing EPA’s capacity to carry out these evaluations. The report does not, however, contain estimates of EPA’s capacity for carrying out risk evaluations or promulgating associated rules. We have previously reported that EPA has found many provisions of TSCA cumbersome and time consuming to implement. It is currently unclear if EPA has the people and resources to implement the new law. We will continue to monitor the program to determine if progress is made and the criteria for capacity are met.

Action Plan

EPA continues to partially meet the criteria for having an action plan. As we reported in 2015, EPA has increased its efforts to obtain chemical toxicity and exposure data, initiate chemical risk assessments, and review certain new uses of chemicals, but it is too early to tell whether these actions will reduce chemical risks. With new TSCA authority, EPA officials stated that the agency is better positioned to take action to require chemical companies to report chemical toxicity and exposure data. Officials also stated that the new law gives the agency additional authorities, including the authority to require companies to develop new information relating to a chemical as necessary for prioritization and risk evaluation. Using both new and previously existing TSCA authorities should enhance the agency’s ability to gather new information as necessary to evaluate hazard and exposure risks.

Monitoring

ensuring the safety of chemicals. We will continue to monitor the TSCA program as the agency implements this important legislation.

Demonstrated Progress

As in 2015, EPA has not met the criteria for demonstrating progress, although it has recently begun implementing corrective measures to resolve this high-risk area. For example, the first TSCA reform reporting deadline directed EPA to publish in the Federal Register a list of mercury compounds that will be prohibited from export, not later than 90 days after the date of enactment. That reporting deadline was September 20, 2016; on August 26, 2016, EPA published a list of the mercury compounds that will be prohibited from export effective January 1, 2020. TSCA reform actions required by December 19, 2016, included the following topics and actions: (1) Risk Evaluations: EPA must ensure that risk evaluations are being conducted on 10 chemical substances drawn from the 2014 TSCA Work Plan; (2) Small Business: EPA must review, and potentially revise, its definitions of small businesses for reporting purposes after consulting with the Small Business Administration; and (3) Congressional Report: EPA must submit a report to Congress regarding the agency’s capacity to carry out risk evaluations and associated actions.

According to EPA, the promulgation of these rules will better position the agency to increase the rate at which chemicals are evaluated for human and environmental health and safety. As of December 19, 2016, EPA had taken steps to respond to the December deadlines for risk evaluations and small business. Specifically, EPA has announced the first 10 chemicals it will evaluate for potential risks to human health and the environment and published a Federal Register notice on Standards for Small Manufacturers and Processors. In January 2017, EPA took action in response to December deadline 3 by issuing a report: Initial Report to Congress on the EPA’s Capacity to Implement Certain Provisions of the Frank R. Lautenberg Chemical Safety for the 21st Century Act. We will continue to monitor EPA as it implements this important piece of chemical legislation and determine if it is satisfying all the criteria for removal from the High-Risk List.

Benefits Achieved by Implementing Our Recommendations

recommendation we made in 2013 and closed recently based on EPA’s actions.

Our work has also supported deliberations by Congress about TSCA and about strengthening EPA’s ability to regulate chemicals. For example, as far back as 1994, we reported that Congress should consider setting specific deadlines for reviewing existing chemicals, which the new TSCA legislation would address because it requires EPA to establish a chemical prioritization process, and to initiate risk evaluations of high priority chemicals, among other issues.

Our work since then has addressed a variety of chemical management policy matters for Congress. For example, in 2009, we testified that EPA does not routinely assess the risks of chemicals in commerce, and in 2013, we testified about possible statutory changes to TSCA to give EPA additional authorities to obtain information, and shift more of the burden to chemical companies for demonstrating the safety of their chemicals. Finally, in 2016, Congress passed the Frank R. Lautenberg Chemical Safety for the 21st Century Act, which we found addresses key challenge areas we’ve identified previously.

GAO Contact

For additional information about this high-risk area, contact Alfredo Gómez at (202) 512-3841 or gomezj@gao.gov.

Related GAO Products

Chemicals Management: Observations on Human Health Risk Assessment and Management by Selected Foreign Programs. GAO-16-111R. Washington, D.C.: October 9, 2015.

Chemical Assessments: Agencies Coordinate Activities, but Additional Action Could Enhance Efforts. GAO-14-763. Washington, D.C.: September 29, 2014.

Chemical Regulation: Observations on the Toxic Substances Control Act and EPA Implementation. GAO-13-696T. Washington, D.C.: June 13, 2013.

Chemical Assessments: An Agencywide Strategy May Help EPA Address Unmet Needs for Integrated Risk Information System Assessments. GAO-13-369. Washington, D.C.: May 10, 2013.

Toxic Substances: EPA Has Increased Efforts to Assess and Control Chemicals but Could Strengthen Its Approach. GAO-13-249. Washington, D.C.: March 22, 2013.

Chemical Assessments: Challenges Remain with EPA’s Integrated Risk Information System Program. GAO-12-42. Washington, D.C.: December 9, 2011.

Chemical Assessments: Low Productivity and New Interagency Review Process Limit the Usefulness and Credibility of EPA’s Integrated Risk Information System. GAO-08-440. Washington D.C: March 7, 2008.

Mitigating Gaps in Weather Satellite Data

Why Area Is High Risk

The two federal agencies responsible for managing weather satellites, the Department of Commerce’s National Oceanic and Atmospheric Administration (NOAA) and the Department of Defense (DOD), are in different stages in their efforts to ensure continued weather satellite coverage in their respective satellite orbits. In recognition of NOAA’s significant progress, we have narrowed the scope of this high-risk area to remove the segment on NOAA’s geostationary weather satellites. At the same time, we are expanding this high-risk area to include a segment on DOD’s polar-orbiting weather satellites because the agency has been slow to replace aging satellites and, as a result, is at risk of a gap in weather satellite data in the early morning orbit. We did not include a segment on DOD weather satellites in our prior high-risk update because the department was not, at that time, facing an imminent satellite data gap.

The United States relies on two complementary types of satellite systems for weather observations and forecasts: (1) polar-orbiting satellites that provide a global perspective every morning and afternoon, and (2) geostationary satellites that maintain a fixed view of the United States. Both types of systems are critical to weather forecasters, climatologists, and the military, who map and monitor changes in weather, climate, the oceans, and the environment. Federal agencies are currently planning or executing major satellite acquisition programs to replace existing polar and geostationary satellite systems that are nearing the end of, or beyond, their expected life spans. Specifically, NOAA is responsible for the polar satellite program that crosses the equator in the afternoon and for the geostationary satellite program, while DOD is responsible for the polar satellite program that crosses the equator in the early morning orbit. However, these programs have troubled legacies of cost increases, missed milestones, technical problems, and management challenges that have reduced functionality and delayed launch dates. As a result, the continuity of weather satellite data is at risk.

NOAA officials acknowledge that there is a risk of a gap in polar satellite data in the afternoon orbit, between the time that the current polar satellite is expected to reach the end of its life and the time when the next satellite is expected to be in orbit and operational. This gap could span up to a year or more, depending on how long the current satellite lasts and whether there are any delays in launching or operating the new one. In addition, there is a risk of a gap in polar satellite data in the early morning orbit because DOD has not yet replaced satellites that are nearing the end of their life spans. While NOAA does not anticipate gaps in geostationary satellite observations, such a gap could occur if the satellites currently in orbit do not last as long as anticipated or if the major satellite acquisition currently underway encounters schedule delays.

According to NOAA program officials, a satellite data gap would result in less accurate and timely weather forecasts and warnings of extreme events—such as hurricanes, storm surges, and floods. Such degraded forecasts and warnings would endanger lives, property, and our nation’s critical infrastructures. Similarly, according to DOD officials, a gap in space-based weather monitoring capabilities could affect the planning, execution, and sustainment of U.S. military operations around the world. Given the criticality of satellite data to weather forecasts, the likelihood of significant gaps, and the potential impact of such gaps on the health and safety of the U.S. population and economy, we concluded that the potential gap in weather satellite data is a high-risk area and added it to the High-Risk List in 2013. It remained on the High-Risk List in 2015. the Geostationary Operational Environmental Satellite-R (GOES-R) series. Moreover, the agency successfully launched this satellite in November 2016 and is now better able to ensure continuous satellite coverage.

In contrast, we are expanding the high-risk area to include a segment on DOD’s polar-orbiting satellite program, which provides weather observations in the early morning orbit. The department has been slow to establish plans for its follow-on satellite program and has made little progress in determining how it will meet selected weather satellite requirements in the early morning orbit. Moreover, DOD is currently relying on an older satellite that is well past its expected life span. As a result, there is a real risk of a weather satellite data gap in the early morning orbit. Such a gap could negatively affect military operations that depend on weather data.

What GAO Found

The two federal agencies responsible for managing weather satellites, NOAA and DOD, are in different stages in their efforts to ensure continued weather satellite coverage in their respective satellite orbits. NOAA’s efforts to strengthen mitigation planning for its polar-orbiting satellites in the afternoon orbit have resulted in it meeting three of the five criteria for removal from the high-risk area: leadership commitment, capacity, and monitoring progress. Specifically, NOAA has demonstrated leadership commitment in mitigating data gaps on its polar-orbiting weather satellites by establishing gap mitigation action plans, improving its computing capacity, and monitoring progress in implementing multiple mitigation activities. However, the agency has not yet addressed key shortfalls in its gap mitigation plans and several mitigation projects are not yet complete. Moreover, the agency recently decided to delay the launch date of the next polar-orbiting satellite due to problems in development. These issues increase the likelihood of a data gap in the afternoon orbit. The agency’s efforts to further improve its gap mitigation plans, complete gap mitigation projects, and successfully launch the next polar satellite will help ensure that it is in a good position to mitigate the possibility of gaps in satellite data.

Aeronautics and Space Administration (NASA) successfully launched the latest geostationary weather satellite in November 2016, a step which improved the agency’s ability to ensure robust satellite coverage. In recognition of the agency’s significant progress, we have narrowed the scope of this high-risk area to remove the segment on NOAA’s geostationary satellites.

On the other hand, DOD has been slow to establish a new satellite program, selected high-priority capabilities are not addressed by the department’s planned program, and problems with existing satellites have increased the risk of a gap in satellite data in the early morning orbit. In October 2016, over 6 years after the department was directed to establish a program to launch new satellites in the early morning orbit, DOD established a plan for its Weather Satellite Follow-on—Microwave program. The department plans to launch the first operational satellite under this program in 2022. However, this program does not address two high-priority capabilities—cloud characterization and area-specific weather imagery—and the department has not yet determined how it will provide those capabilities. Further, DOD’s primary satellite in the early morning orbit failed in February 2016, and the department is now using an older satellite that is well past its expected life span. Until the department launches its next satellite and establishes a plan to provide the two high-priority capabilities, it faces a significant risk of a gap in satellite data should the existing operational satellite fail. As a result of DOD’s limited progress in developing and implementing a plan to fulfill its weather satellite requirements, we are expanding this high-risk area to include a segment on DOD’s progress in addressing the need for satellite coverage in the early morning orbit.

Over the last 4 years, congressional committees have held multiple hearings to address this high-risk area. Examples include:

Subcommittees of the House Science, Space, and Technology Committee have held multiple hearings to provide oversight of major satellite acquisitions and the risk of gaps in satellite coverage (September 2013, February 2015, December 2015, July 2016) and on private sector weather forecasting (May 2015, June 2016).

In March 2016, the Subcommittee on Commerce, Justice, Science, and Related Agencies of the Senate Appropriations Committee held a hearing on the President’s fiscal year 2017 budget proposal that included a discussion of current and future satellite programs.

In July 2016, the House Science, Space, and Technology Committee’s Subcommittee on Environment held a hearing to provide oversight of DOD’s efforts to plan a new satellite acquisition and address the potential for gaps in satellite coverage.

Also over the last 4 years, Congress has worked on legislation to address this high-risk area. Examples include:

The Weather Research and Forecasting Innovation Act of 2015 was introduced as a bill in the House of Representatives to advance programs and activities related to improving weather warnings and forecasts—including analysis of potential observing system gaps— and clarifying NOAA’s ability to access commercial weather data and products.

Congress appropriated funds for satellite data gap mitigation activities through the Disaster Relief Appropriations Act, 2013.

What Remains to Be Done

NOAA’s Weather Satellites

address residual shortfalls in its mitigation plan, including providing key information about the cost and effects of the mitigation options, and establishing when the testing of selected options would be completed (this is a recommendation that we identified as a priority recommendation to the Secretary of Commerce); and demonstrate progress by completing the remaining gap mitigation projects identified in the polar satellite gap mitigation plan, including addressing the technical challenges that delayed the scheduled launch date for the next satellite, deciding when the next satellite will be launched, and acting to ensure a timely and successful launch.

DOD’s Polar-Orbiting Weather Satellites

DOD has made limited progress in its efforts to replace aging satellites and is now at risk of a gap in weather satellite data in the early morning orbit. As a result, we are expanding this high-risk area to include DOD’s polar-orbiting weather satellites. The department needs to demonstrate progress on its next generation of weather satellites, called the Weather System Follow-on—Microwave (WSF-M) program, to address the risk of a gap in the early morning orbit; and establish and implement plans to mitigate the risk of a gap in the high- priority capabilities that are not included in WSF-M .

Additional Details on What GAO Found

NOAA’s Polar-Orbiting Weather Satellites

Leadership Commitment

NOAA has met the criterion of demonstrating a strong leadership commitment to mitigating potential gaps in polar-orbiting satellite data. In April 2015, NOAA issued an updated polar satellite gap mitigation plan which identifies the specific technical, programmatic, and management steps the agency is taking to ensure that satellite mitigation options are viable. Moreover, NOAA continues to oversee the implementation of 35 gap mitigation projects, including efforts to assimilate data from new sources into weather models and to explore how manned and unmanned aircraft observations could increase the accuracy of numerical weather predictions for high-impact weather events. In addition, NOAA executives oversee the acquisition of the next generation of polar-orbiting satellites through monthly briefings on the cost, schedule, and technical risks affecting the satellites’ development and planned launch dates.

Capacity

performance computing capacity resulted in reduced scope or delayed work on other critical mitigation projects, and recommended that NOAA investigate ways to prioritize the gap mitigation projects with the greatest potential benefit to weather forecasting. NOAA agreed with this recommendation, implemented it, and has since completed efforts to improve its high-performance computing capacity. Specifically, in May and December 2015, the agency completed upgrading its high- performance computers that support research and operations. These upgrades allowed the agency to move forward on multiple other mitigation activities, including experimenting with other data sources and assimilating these data into its weather models.

Action Plan

NOAA has partially met the criterion for having a plan to address the risk of a polar satellite data gap. In April 2015, NOAA issued an updated satellite mitigation plan, which includes several improvements over its prior plan. For example, in response to a recommendation we made in December 2014 to address shortfalls in the mitigation plan, NOAA’s latest plan includes an expanded list of mitigation projects and identifies opportunities for accelerating the availability of satellite products after the next satellite is launched. However, the agency has not yet addressed residual shortfalls in its mitigation plan, including providing key information about the cost and impact of the mitigation options, and establishing when the testing of selected options would be completed. Until NOAA fully addresses the shortfalls in its gap mitigation plan, it may not be sufficiently prepared to mitigate potential gaps in polar satellite coverage.

Monitoring

NOAA has met the criterion for monitoring progress on its gap mitigation activities, which is an increase over its prior rating. In December 2014, we reported that NOAA’s oversight of its many gap mitigation projects was not consistent or comprehensive. For example, only one of three NOAA organizations had briefed management on a monthly basis on the status of its mitigation projects and the agency had not yet reported progress on nine mitigation activities outlined in its plan. We recommended that NOAA ensure that the relevant entities provide regular progress updates on all mitigation projects and activities. NOAA agreed and implemented this recommendation. All three responsible NOAA organizations are now regularly briefing management on all active gap mitigation projects.

Demonstrated Progress

categories: (1) understanding the likelihood and impact of a gap, (2) reducing the likelihood of a gap, and (3) reducing the impact of a gap. As of May 2016, 16 projects had been completed; 18 were ongoing; and 1 was planned for the future. However, one of the most important steps in reducing the likelihood of a gap—keeping the launch of the next polar satellite on schedule—has had problems. While NOAA targeted a March 2017 launch date for the next polar-orbiting satellite, agency officials recently decided to delay the launch by 4 to 6 months due to problems in developing the ground system and a critical instrument on the spacecraft. This launch delay exacerbates the probability of a gap in satellite data since the current operational satellite is now past its expected 5-year life span and one key instrument on that satellite has been experiencing technical issues.

NOAA acknowledged that if this instrument fails before the next satellite is launched and operational, it would result in degraded weather forecasts, exposing the nation to a 15 percent chance of missing an extreme weather event forecast. While NOAA has made progress on its many mitigation projects, the agency acknowledges that no steps will completely mitigate a sudden failure of the primary operational polar- orbiting satellite. Until NOAA demonstrates that it is making swift and effective progress in mitigating potential near-term gaps in polar satellite data, there will be a growing risk that degraded forecasts and warnings will negatively impact the U.S. population and economy.

NOAA’s Geostationary Weather Satellites

Leadership Commitment

NOAA has met the criterion of demonstrating strong leadership commitment to mitigating potential gaps in geostationary satellite data by revising and improving its geostationary satellite contingency plans, updating an assessment of the viability of the program schedule leading up to the launch date, and taking steps to ensure that the GOES-R satellite was successfully launched in November 2016.

Capacity

NOAA has met the criterion for ensuring it has the capacity to address the risk of a gap in backup coverage, which is an increase over its prior rating. Over the past several years, the agency has demonstrated its ability to mitigate operational satellite outages by monitoring the health of the satellites and by moving a backup satellite into operation when needed. Moreover, we rated capacity as partially met in our 2015 report due to concerns about NOAA’s ability to complete critical testing activities because it was already conducting testing on a round-the-clock, accelerated schedule. Since then, NOAA adjusted its launch schedule from March 2016 to November 2016 to allow time to complete critical integration and testing activities.

Action Plan

rating. In December 2014, we reported on shortfalls in the satellite program’s gap mitigation/contingency plans and made recommendations to NOAA to address these shortfalls. For example, we noted that the plan did not sufficiently address strategies for preventing a launch delay, timelines and triggers to prevent a launch delay, and whether any of its mitigation strategies would meet minimum performance levels. NOAA agreed with these recommendations and released a new version of its geostationary satellite contingency plan in February 2015. The new plan includes information on steps planned or underway to mitigate potential launch delays, the potential impact of failure scenarios in the plan, and the minimum performance levels expected under such scenarios.

Monitoring

NOAA has met the criterion for monitoring progress in addressing its risks. Officials responsible for satellite operations actively monitor the health of the satellite constellation and are prepared to implement contingency operations if they are warranted. In addition, GOES-R program officials actively monitored and analyzed the program schedule in order to minimize changes to the launch date. Program officials also regularly report to senior managers on progress and risks.

Demonstrated Progress

NOAA has met the criterion for demonstrating progress in mitigating risks, which is an increase over its prior rating. In September 2013, we reported that the agency had weaknesses in its schedule management practices on its core ground system and spacecraft, and we made recommendations to address those weaknesses. The weaknesses pertained to the sequencing of all activities, ensuring there were adequate resources for the activities, and conducting a schedule risk analysis. NOAA agreed with the recommendations and the GOES-R program made improvements to its schedule management practices. In early 2016, the program improved the links between remaining activities on the spacecraft schedule, included needed schedule logic for a greater number of activities on the ground schedule, and included indications in the ground schedule that the results of a schedule risk analysis were used in calculating the duration of its activities.

In addition, the GOES-R program made significant progress in developing and testing the GOES-R satellite and successfully launched it in November 2016. The agency now has a robust constellation of operational satellites and backup satellites in orbit. As a result, the agency has made significant progress in addressing the risk of a gap in geostationary satellite data coverage.

DOD’s Polar-Orbiting Weather Satellites

In 2010, when the Executive Office of the President decided to disband a tri-agency polar weather satellite program, DOD was given responsibility for providing polar-orbiting weather satellite capabilities in the early morning orbit. However, the department was slow to develop plans to replace its existing satellites that provide this coverage. The department conducted a requirements review and analysis of alternatives from February 2012 through September 2014 to determine the best way forward for providing needed polar-orbiting satellite environmental capabilities in the early morning orbit. In October 2016, DOD approved plans for the WSF-M program. Through this program, the department plans to launch a demonstration satellite in 2017 and to launch its first operational satellite in 2022.

However, DOD’s plans for the early morning orbit are not comprehensive. The department did not thoroughly assess options for providing its two highest-priority capabilities (cloud characterization and area-specific weather imagery) due to an incorrect assumption about the capabilities that would be provided by international partners. WSF-M does not include these two highest-priority capabilities and the department has not yet determined its long-term plans for providing them.

Due to DOD’s delay in establishing plans for its next generation of weather satellites, there is now a significant risk of a satellite data gap in the early morning orbit. The last satellite that the department launched, called Defense Meteorological Satellite Program (DMSP)-19, stopped providing recorded data used in weather models in February 2016. A prior satellite, called DMSP-17, is now the primary satellite operating in the early morning orbit. However, this satellite was launched in 2006 and is operating with limitations due to the age of its instruments. DOD had developed another satellite, called DMSP-20, but plans to launch that satellite were canceled after the department did not certify that it would launch the satellite by the end of calendar year 2016. As a result, the department will need to continue to rely on the older DMSP-17 satellite until (1) its new satellite becomes operational in 2022, and (2) it determines how it will address the high priority capabilities that the new satellite will not provide. Given the age of the DMSP-17 satellite and uncertainty on how much longer it will last, the department could face a gap in critical satellite data that lasts for years. options for acquiring and fielding new equipment, such as satellites and satellite components, to provide the capabilities. In addition, the department anticipates that the demonstration satellite to be developed as a precursor to WSF-M could help mitigate a potential gap by providing some data. However, these proposed solutions may not be available in time or be comprehensive enough to avoid near-term coverage gaps. Such gaps could negatively affect operations that depend on weather data, such as long-range strike capabilities and aerial refueling.

Over the next 2 years, we will assess DOD’s progress in addressing polar-orbiting weather satellites against the high-risk criteria and will report this information as appropriate.

Benefits Achieved by Implementing Our Recommendations

Examples of benefits achieved over the last 4 fiscal years by implementing our recommendations include the following actions by NOAA: Improving its gap mitigation/contingency plans for its polar-orbiting weather satellites.

Prioritizing its gap mitigation efforts supporting its polar-orbiting weather satellites.

Improving its oversight of its gap mitigation projects for its polar- orbiting weather satellites.

Improving its schedule management practices on its geostationary satellite program.

Improving its outreach to key external users of geostationary satellite data.

Addressing shortfalls in its geostationary gap mitigation plans. its plan in April 2015 and addressed several of the identified shortfalls. However, we also reported that the plan does not include all elements needed to fully implement our recommendation, such as a schedule with meaningful timelines and linkages among mitigation activities. NOAA plans to update its polar satellite contingency plan to address these residual shortfalls in early 2017.

GAO Contact

For additional information about this high-risk area, contact David Powner at (202) 512-9286, or pownerd@gao.gov.

Related GAO Products

Environmental Satellites: NOAA Needs to Ensure Its Timelines Are Accurate, Clear, and Fully Documented.GAO-16-767. Washington, D.C.: September 8, 2016.

Polar Satellites: NOAA Faces Challenges and Uncertainties that Could Affect the Availability of Critical Weather Data. GAO-16-773T. Washington, D.C.: July 7, 2016.

Defense Weather Satellites: DOD Faces Acquisition Challenges for Addressing Capability Needs. GAO-16-769T. Washington, D.C.: July 7, 2016.

Polar Weather Satellites: NOAA Is Working to Ensure Continuity but Needs to Quickly Address Information Security Weaknesses and Future Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016.

Defense Weather Satellites: Analysis of Alternatives Is Useful for Certain Capabilities, but Ineffective Coordination Limited Assessment of Two Critical Capabilities. GAO-16-252R. Washington, D.C.: March 10, 2016.

Environmental Satellites: Launch Delayed; NOAA Faces Key Decisions on Timing of Future Satellites. GAO-16-143T. Washington, D.C.: December 10, 2015.

Environmental Satellites: Improvements Needed in NOAA’s Mitigation Strategies as It Prepares for Potential Satellite Coverage Gaps. GAO-15-386T. Washington, D.C.: February 12, 2015.

Polar Weather Satellites: NOAA Needs To Prepare for Near-term Data Gaps . GAO-15-47. Washington, D.C.: December 16, 2014.

Geostationary Weather Satellites: Launch Date Nears, but Remaining Schedule Risks Need to be Addressed. GAO-15-60. Washington, D.C.: December 16, 2014.

DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management

Why Area Is High Risk

Since our high-risk report in February 2015, the Department of Energy (DOE) continued to meet the leadership commitment criterion and to partially meet the criterion for having a corrective action plan. DOE has improved its monitoring of the effectiveness of corrective measures and now partially meets this criterion. DOE did not meet the criterion for having the capacity to resolve contract and project management problems, nor did DOE meet the criterion for demonstrating progress toward implementing measures to resolve high-risk areas.

DOE oversees a broad range of programs related to nuclear security, science, energy, and nuclear waste cleanup, among other areas. To support these missions, DOE has several offices, each of which oversees numerous programs that often design and construct large capital asset projects to meet the department’s mission needs. DOE relies primarily on contractors to carry out its programs. It is the largest civilian contracting agency in the federal government, and spends approximately 90 percent of its fiscal year 2017 funding of more than $32 billion on contracts and large capital asset projects. We designated DOE’s contract management—which has included both contract administration and project management—a high-risk area in 1990 because DOE’s record of inadequate management and oversight of contractors has left the department vulnerable to fraud, waste, abuse, and mismanagement.

In January 2009, to recognize progress made at DOE’s Office of Science, we narrowed the focus of DOE’s high-risk designation to 2 DOE program elements—the Office of Environmental Management (EM) and the National Nuclear Security Administration (NNSA). Together, these 2 elements accounted for almost 60 percent of DOE’s annual budget. In February 2013, we further narrowed the focus of the high-risk designation to NNSA and EM’s major contracts and projects—those with an estimated cost of $750 million or greater—to acknowledge progress made in managing nonmajor projects, those with an estimated cost below $750 million. We continue to monitor DOE’s management of nonmajor projects to ensure that progress in this area is sustained. implemented corrective actions that aim to identify and address root causes of persistent project management challenges and implement solutions. Since our 2015 assessment, we also observed progress in DOE’s monitoring of the effectiveness and sustainability of corrective measures. As in previous years, however, EM and NNSA struggled to ensure they have the capacity (both people and resources) to mitigate risks. They have also demonstrated limited progress in contract management, particularly in the area of financial management, and have struggled to stay within cost and schedule estimates for some major projects.

What GAO Found

DOE has made progress in its contract and project management. DOE continued to meet the criterion for demonstrating a strong commitment and top leadership support for improving project management. The Secretary of Energy issued two memorandums, in December 2014 and June 2015, that lay out a series of changes to policies and procedures to improve project management. These changes were included in DOE’s revised project management order, DOE Order 413.3B, issued in May 2016. As noted in the memorandums, some of these changes are in response to recommendations we made in prior years, such as requiring that projects develop cost estimates and analyses of alternatives according to our best practices.

According to DOE officials, the two memorandums serve as DOE’s corrective action plan, but we note that this plan does not appear to be comprehensive and, as such, DOE continues to partially meet this criterion. Specifically, DOE’s corrective action plan does not address 1) acquisition planning for its major contracts—a phase during which critical contract decisions are made that have significant implications for the cost and overall success of an acquisition; 2) the quality of enterprise-wide cost information available to DOE managers and key stakeholders; 3) DOE’s need for a program management policy; and 4) how DOE’s new requirements will be applied to the department’s major legacy projects, which receive billions of dollars in annual funding and often present the most intractable project management challenges. executes its major projects and programs, but additional time is needed for us to assess how effectively these recent monitoring improvements will validate the sustainability of corrective measures. We have not yet evaluated the operations of the newly created Project Management Risk Committee (PMRC). In addition, DOE’s new oversight and monitoring efforts are not comprehensive, as certain activities within EM are not subject to review by the PMRC, even though together they cost billions of dollars and last for numerous years. Finally, the effectiveness of DOE’s monitoring of its contracts, projects, and programs depends upon the availability of reliable enterprise-wide cost information on which to base oversight activities.

DOE did not meet the criterion for having the capacity to mitigate risks with project and contract management. Since 2015, DOE has taken steps to improve capacity, such as increasing its number of contract specialists, but even with these recent steps, capacity challenges remain. The Secretary’s December 2014 and June 2015 memorandums were generally silent on capacity issues. In several recently issued reports, we found capacity shortfalls in key contract management functions, including cost and schedule performance evaluation, as well as in oversight of major projects and programs. For example, in May 2015, we found that NNSA had not determined whether it has sufficient, qualified personnel to ensure it used information from contractor assurance systems (CAS) consistently, which include information on contractors’ cost and schedule performance. In 2016, DOE issued a new Supplemental Directive on NNSA Site Governance requiring NNSA to develop training for NNSA organizations to help them implement the governance model that relied on information from CAS for oversight, but it is unclear whether this training has been developed and initiated. In November 2016, we found that DOE and NNSA had not established training programs, such as a career development program, for program managers. On December 14, 2016, the President signed the Program Management Improvement Accountability Act. The act, among other things, requires that each agency head appoint a Program Management Improvement Officer, who must develop a strategy for enhancing the role of program managers within the agency that includes enhanced training and educational opportunities for program managers. Finally, in July 2016, we found problems with DOE’s effort to evaluate the environment for raising concerns without fear of reprisal. are in the early stages, and more time is needed to assess the effectiveness of corrective measures and associated progress, especially with respect to ongoing major projects. DOE has taken significant actions regarding two of its six ongoing major projects but continues to encounter significant project management challenges, cost increases, and schedule delays on others. In addition, even though we removed nonmajor projects from our High-Risk List, we continue to monitor how DOE manages these projects to ensure that DOE sustains progress in this area. Finally, DOE’s recent reforms do not address contract management, and our work since the last high-risk report has identified several significant challenges with DOE contract management on which DOE has taken little action. Specifically, in May 2015, we found that NNSA had not established policies or guidance specific to using information from CAS to evaluate management and operations (M&O) contractor performance.

Congress has taken several actions related to this high-risk area. For example, the fiscal year 2016 National Defense Authorization Act (NDAA) was enacted with several provisions on the basis of our recommendations, including modifications to requirements for cost-benefit analyses for competing management and operating contracts and additional requirements related to the oversight of the Hanford Waste Treatment and Immobilization Plant (WTP). In addition, the Senate Armed Services Committee report accompanying the fiscal year 2017 NDAA included requirements for DOE relevant to many issues highlighted in our high-risk report, including specific provisions for the Mixed Oxide (MOX) Fuel Fabrication Facility, the Chemistry and Metallurgy Research Replacement (CMRR) project, and the WTP. The Senate Armed Services Committee also held hearings in 2015 and 2016 on challenges identified in this high-risk area. We testified on our observations on DOE’s management challenges and the steps taken to address them. The House Energy and Commerce Committee also held a hearing in 2015 in which we testified on the actions needed to improve DOE and NNSA oversight of management and operating contracts.

What Remains to Be Done

Capacity: DOE will need to commit sufficient people and resources to resolve its project, program, and contract management problems. DOE must develop a strategy to address these needs. We note that the initiatives DOE established in 2015, some of which we described in our last high-risk report, are not yet complete. NNSA’s issuance of a new Supplemental Directive on NNSA Site Governance is a good first step toward addressing the recommendations we made with regard to the agency’s capacity to conduct oversight activities using information from CAS. Specifically, the Supplemental Directive includes requirements for NNSA’s Office of Safety, Infrastructure and Operations to develop training for NNSA organizations to assist their implementation of the site governance model and to annually review and update the training as needed to ensure continuous improvement. However, NNSA has not yet established comprehensive guidance, beyond the general framework described in the new Supplemental Directive, to consistently implement the described governance model across the nuclear security enterprise, and this is needed to ensure that the training developed is aligned with the specifics of that governance model.

In addition, significant additional action is required by both EM and NNSA to fully address our recommendations. DOE must implement program management policies and develop a strategy for enhancing the role of program managers, including for training, as required by the Program Management Improvement Accountability Act, and address our and others’ recommendations on whistleblower protection to ensure a safety- conscious work environment where staff are encouraged to use their expertise, identify risks, and proactively mitigate them without fear of workplace retaliation.

Action Plan: DOE will need to ensure that its corrective action plan is comprehensive and addresses all root causes—including all front-end planning challenges and contract and program management, as well as capacity issues. To be considered a corrective action plan, DOE’s plan must also set milestones and timelines, assign responsibilities for implementing and completing corrective measures, and identify mechanisms to monitor progress and provide measurable outcomes. DOE must also ensure the corrective action plan includes steps necessary to implement solutions we and others have recommended. address acquisition planning for its major contracts, the quality of enterprise-wide cost information, and how DOE’s new requirements will be applied to major legacy projects. Finally, we will monitor how DOE applies—enterprise-wide—the standards, policies and guidelines for program management that are to be established at federal agencies in response to the Program Management Improvement Accountability Act.

Monitoring: DOE will need to continue to monitor and independently validate the effectiveness and sustainability of its corrective measures, particularly for major projects. Meeting the monitoring criterion will require a comprehensive corrective action plan—as described above—against which progress can be monitored. DOE has created the PMRC to track progress of projects across the agency, but it is too early to assess its effectiveness, especially on major projects. As a next step, DOE should create a framework in which the PMRC and programs use existing and other tools as needed to track progress against a comprehensive corrective action plan and regularly update the plan with progress and any newly identified root causes based on the PMRC’s validation of completion.

DOE should also ensure it has the reliable, enterprise-wide cost information that is needed to effectively monitor projects and programs. DOE will also need to ensure that EM’s operations activities that are currently outside of project management requirements are included in this framework and are subject to comparable monitoring and oversight by the PMRC or another body.

Demonstrated Progress: DOE will need to demonstrate progress in implementing corrective measures, especially measures intended to improve the performance of major projects and contracts. For example, for projects, DOE must continue to show improvements on meeting cost and schedule targets and a commitment to applying new requirements to all of its major projects. DOE should also continue to monitor progress and apply corrective measures to nonmajor projects. For contracts, once DOE’s corrective action plan addresses contract management, DOE must apply these measures to address its longstanding contract management problems. More specifically, DOE should address some of the problems we found, such as developing a contract management framework addressing the use of CAS so that DOE staff have the ability to evaluate contractor performance.

Additional Details on What GAO Found

Leadership Commitment

The department continued to meet the criterion for demonstrating a strong commitment and top leadership support for improving project management in EM and NNSA. The Secretary of Energy issued two memorandums, in December 2014 and June 2015, that lay out a series of changes to policies and procedures to improve project management. The Secretary’s changes were included in DOE’s revised project management order, DOE Order 413.3B, issued in May 2016. As noted in the memorandums, some of these changes are in response to recommendations we made in prior years, as shown in the following examples:

DOE added requirements for program offices to conduct a root cause analysis if a major project is expected to exceed its approved cost or schedule.

DOE added requirements for program offices to ensure that major projects’ designs and technologies are sufficiently mature before contractors are allowed to begin construction.

DOE added a requirement to its revised project management order for program offices to conduct analyses of alternatives consistent with industry best practices, independent of the contractor organization responsible for managing the construction or constructing a capital asset project.

DOE added a requirement to its project management order that projects’ cost estimates be developed, maintained, and documented in a manner consistent with industry best practices. DOE also required that its cost estimating guidance and Acquisition Regulations be consistent with cost estimating best practices reflected in our Cost Estimating and Assessment Guide. responsible for reviewing all capital asset projects with a total project cost of $100 million or more. DOE officials told us that the ESAAB met 16 times in fiscal year 2015 and 14 times in fiscal year 2016 after not meeting at all during fiscal years 2013 and 2014. The Secretary also created the PMRC, which includes senior DOE officials and is chaired by a new departmental position—the Chief Risk Officer (CRO). According to its charter, the committee meets biweekly to assess the risks of projects across the department, as well as to advise DOE senior leaders and the ESAAB on cost, schedule, and technical issues for projects.

We also continue to monitor nonmajor projects, and we note that the Secretary’s December 2014 and June 2015 memorandums applied project management reforms to nonmajor projects previously not subject to such requirements. For example, DOE’s new project management reforms require full upfront funding for projects costing $50 million or less—a reform that should help deliver such projects on time and within costs. Notably, DOE’s performance in meeting cost and schedule milestones for nonmajor projects continues to improve, with nearly 95 percent of such projects meeting cost and schedule milestones over the last 3 years, according to DOE officials.

Capacity

DOE did not meet the criterion for having the capacity to mitigate risks with project and contract management. The department has long faced challenges in ensuring it has the right number of qualified individuals in crucial oversight areas. For example, we first noted capacity shortfalls in the department’s contract management in our 1994 high-risk report. At that time, we noted that the department did not have the necessary staff expertise and information systems to monitor contractors. In our February 2015 high-risk report, we found that DOE did not meet this criterion and noted that an internal DOE review determined that the department had an extremely low number of contract specialists. We noted in our 2015 high- risk report that DOE had established the Acquisition Fellows Program to recruit, acquire, develop, and retain contract specialists, and NNSA had signed an agreement with the U.S. Army Corps of Engineers (USACE) to supplement NNSA’s capacity needs.

Since 2015, DOE has taken the following steps to improve capacity:

DOE increased its number of contract specialists by 4, from 550 to 554. In November 2016, DOE officials told us that the department still faces shortfalls of contract specialists. They noted that there are statutory caps on the number of staff DOE can hire.

The Acquisition Fellows Program’s first class of 11 participants is expected to graduate in January 2017. DOE is analyzing lessons learned from the program’s first cohort and determining ways to improve the program for the second cohort.

NNSA officials stated that they continue to use USACE specialists because it helps NNSA manage its workload within the statutory workforce caps. DOE officials also stated that, on the basis of a USACE staffing model, NNSA recently increased the number of staff on certain major projects, in some cases more than doubling the number of staff responsible for project management activities.

Even with these recent steps, capacity challenges remain. The Secretary’s December 2014 and June 2015 memorandums—which DOE has stated serve as its corrective action plan—were generally silent on capacity issues. The Secretary’s memorandums required the department to create a Project Leadership Institute and both the ESAAB and PMRC are to evaluate, among other things, issues related to organization and staffing if such factors present a risk to a project; however, other capacity issues, such as those related to contract oversight, were not explicitly addressed.

In several recently issued reports, we found capacity shortfalls in key contract management functions, including cost and schedule performance evaluation, as well as in oversight of major projects and programs, as shown in the following examples: In May 2015, we found that NNSA had not determined whether it has sufficient, qualified personnel to ensure it used information from CAS consistently, which include information on contractors’ cost and schedule performance. Federal field office officials raised concerns that staffing levels and the mix of staff skills may not be adequate to use information from CAS to conduct appropriate oversight, potentially resulting in NNSA staff over relying on this information without the ability to ensure it is reliable. project, field office, and functional managers, it appears that the scope of this staffing assessment may not address all aspects covered by the supplemental directive itself.

In May 2015, we found that DOE faced persistent and significant technical and management challenges at its WTP at Hanford and, consequently, we recommended that DOE take steps to augment its capacity to oversee the contractor. External reviews found that technical challenges continue to affect the facilities needed to treat radioactive waste, and the extent of the challenges was beyond the capacity of DOE to monitor and prevent recurrence. Under the WTP construction contract, and as recommended by an external DOE advisory group, DOE can employ an owner’s agent to help the department review the contractor’s approach to design management and mitigate design challenges.

We recommended that DOE enlist the services of another agency or external entity to serve as an owner’s agent in reviewing and evaluating the WTP contractor’s design and approach to mitigating design challenges. Congress also included a provision in the 2016 NDAA requiring DOE to enlist the services of an owner’s agent who was to have certain oversight responsibilities independent of the contractor. In 2016, DOE instituted an owner’s representative, but the responsibilities of the owner’s representative do not include key elements of an owner’s agent’s responsibilities that we discussed in our report, such as independence and authority to oversee the contractor’s approach to design management.

In February 2016, we found that the B-61-12 Life Extension Program faced staff shortfalls. We reported that NNSA may need about two or three times more personnel in the federal program manager’s office to ensure sufficient federal oversight. NNSA’s federal program office employs about 20 people—8 federal FTEs and about 12 FTE- equivalent contractors—to manage NNSA activities. In contrast, the Air Force office—the armed service office responsible for air-delivered weapons such as the B61—employs about 80 federal FTEs and contractors to manage comparable Air Force activities. with about $287 million in contract spending, compared with a federal government average of $9 million per procurement employee.

In November 2016, we found that DOE faced capacity challenges in program management. Program management can help ensure that a group of related projects and activities are managed in a coordinated way to obtain benefits not available from managing them individually. This approach helps federal agencies get what they need, at the right time, and at a reasonable price. We found that DOE and NNSA had not established training programs, such as a career development program, for program managers. In contrast, DOE has established a training program for project managers, which the department said is open to program managers. In the absence of a current DOE or NNSA training program for program managers, most of the NNSA program managers we interviewed did not have training related to program management. As a result, NNSA may have difficulty developing and maintaining a cadre of professional, effective, and capable program managers. We recommended that DOE establish a training program for program managers.

Notably, a new federal law may help NNSA address some of its capacity challenges in program management. In December 2016, the President signed the Program Management Improvement Accountability Act. The act, among other things, requires the Director of the Office of Personnel Management, in consultation with the Director of the Office of Management and Budget, to issue regulations that identify key skills and competencies needed for program and project managers; establish a new job series, or update and improve an existing job series; and establish a new career path for program and project managers. The act also requires that each agency head appoint a Program Management Improvement Officer, who must develop a strategy for enhancing the role of program managers within the agency that includes enhanced training and educational opportunities for program managers. that several factors may limit the use and effectiveness of mechanisms for contractor employees to raise concerns and seek whistleblower protections. We also found that DOE infrequently used its enforcement authority to hold contractors accountable for unlawful retaliation against whistleblowers, issuing just 2 violation notices in the past 20 years. Additionally, in 2013, DOE determined that it does not have the authority to enforce a key aspect of policies that prohibit retaliation for nuclear safety-related issues—despite having taken such enforcement actions previously.

We made several recommendations, including that DOE independently assess the environment for raising concerns, evaluate whether the whistleblower pilot program will mitigate challenges with the existing program, expedite time frames for clarifying regulations, and clarify policies to hold contractors accountable. DOE concurred with most of these recommendations. In August 2016, DOE issued a proposed rule to change DOE’s nuclear safety rules to clarify the department’s authority to assess civil penalties against certain contractors and subcontractors for violating the prohibition against retaliating against whistleblowers. The comment period closed in September 2016, and DOE is now considering the comments that were submitted.

In September 2016, DOE also updated its Order 221.1B that establishes the requirements and responsibilities for reporting fraud, waste, and abuse. The revised order provides some additional specificity to its Office of Inspector General’s role in processing employee allegations and provides additional language intended to prohibit contractors from deterring or dissuading employees from reporting concerns.

Action Plan

DOE partially met the criterion for having a corrective action plan that defines root causes and identifies effective solutions. In issuing two memorandums to improve project management, the Secretary required project management reforms that—if fully implemented—will help ensure that future projects are not affected by the challenges that have persisted for DOE’s major projects. According to DOE officials, the memorandums serve as DOE’s corrective action plan to address the root causes DOE identified in its November 2014 report. DOE codified the memorandums’ reforms in its revised project management order, DOE Order 413.3B, which includes instituting best practices we and industry have identified for cost estimating, schedule estimating, and applying an analysis of alternatives (AOA) framework to the early stages of project planning.

DOE also plans to publish a guide to instruct DOE staff on how to conduct an AOA.

We are encouraged by DOE’s project management reforms but note that the memorandums and the November 2014 report, as well as associated changes to DOE’s project management order, do not fully include all important elements of a corrective action plan. For example, these documents do not identify goals and performance measures, establish milestones and metrics for implementing plan goals, or establish processes for reporting progress. In addition, DOE’s corrective action plan does not appear to be comprehensive. For example, DOE’s plan does not address challenges with (1) acquisition planning for its major contracts, (2) the quality of enterprise-wide cost information, or (3) the policy on program management. It also does not fully address how DOE will apply these new requirements to major legacy projects. Specifically:

DOE’s corrective action plan does not address acquisition planning for its major contracts—a phase during which critical contract decisions are made that have significant implications for the cost and overall success of an acquisition. In August 2016, we found that DOE did not consider acquisition alternatives beyond continuing its longstanding M&O contract approach for 16 of its 22 M&O contracts. Without considering broader alternatives, DOE cannot ensure that it is selecting the most effective scope and form of contract, raising risks for both contract cost and performance. The size and duration of DOE’s M&O contracts—22 M&O contracts with an average potential duration of 17 years, representing almost three-quarters of the agency’s spending in fiscal year 2015—underscore the importance of planning for each M&O acquisition.

DOE’s corrective action plan does not address the quality of enterprise-wide cost information available to DOE managers and key stakeholders. Reliable enterprise-wide cost information is needed to identify the cost of activities, to ensure the validity of cost estimates, and to provide information to Congress to make budgetary decisions. In January 2017, we found that NNSA’s recently developed plan to improve and integrate financial data to better understand and compare costs across NNSA programs, contractors, and sites did not fully incorporate leading strategic planning practices, which limits its usefulness as a planning tool as well as the effectiveness of NNSA’s effort to provide meaningful financial information to Congress and other stakeholders. NNSA’s plan also contains few details for all the elements it must include, such as its feasibility assessment, estimated costs, expected results, and an implementation timeline.

Consequently, NNSA’s plan does not provide a useful roadmap for guiding NNSA’s effort. We recommended that NNSA develop a plan for producing cost information that fully incorporates leading planning practices. NNSA agreed with our recommendation.

DOE’s corrective action plan does not address its need for a program management policy. For example, in November 2016, we found that DOE had not established a department-wide program management policy, and that NNSA had cancelled its program management policy in 2013 without establishing a new policy in its place. We concluded that having a policy that incorporates existing key internal control standards and leading industry program management practices may help ensure that EM and NNSA program offices are better able to achieve their missions, goals, and objectives. For example, in an August 2016 report examining NNSA’s plans to build the CMRR, we found that the agency had not clarified whether the project would satisfy the mission needs of other NNSA and DOE programs.

NNSA might have been better able to clarify this project’s mission needs if DOE and NNSA had been operating under a DOE-wide program management policy incorporating leading practices. DOE and NNSA officials said they recognize the importance of establishing a program management policy, but at the time DOE had not taken steps to develop such a policy. We recommended that DOE establish a program management policy addressing internal control standards and leading practices. DOE had no comments on our recommendation. After our report was issued, the President signed the 2016 Program Management Improvement Accountability Act, also requiring the development of standards, policies, and guidelines for program and project management across the federal government. As required in the act, we will continue to monitor and report on its implementation in connection with our biennial high-risk updates, including on the effectiveness of the standards, policies, and guidelines that will be developed.

DOE’s corrective action plan also does not fully address how DOE’s new requirements will be applied to the department’s major legacy projects, which receive billions of dollars in annual funding and often present the most intractable project management challenges. For example, we found in May 2015 that DOE continues to allow construction of certain WTP facilities before designs are 90 percent complete and other facilities before establishing updated cost and schedule baselines. before establishing cost and schedule baselines and (2) cost and schedule estimates that meet industry best practices. The WTP is DOE’s largest project, and it has faced numerous technical and management challenges that have added decades to its schedule and billions of dollars to its cost. We recommended in 2015 that DOE consider limiting construction for certain waste treatment facilities until technical challenges are addressed, but DOE did not implement our recommendation. For DOE to fully meet the corrective action criterion, it must demonstrate its willingness to apply project management reforms to the projects that need them the most.

Moreover, the department still may not understand all of the root causes of its contract and project management problems. The most recent corrective actions taken by DOE represent the third such cycle since 2008, and the root causes DOE identified in November 2014 included some issues that the department had declared it previously mitigated, such as difficulties with front-end planning. Specifically, DOE acknowledged in its November 2014 root cause analysis its longstanding problems with front-end planning, stating that insufficient front-end planning has consistently contributed to DOE projects not finishing on budget or schedule. objectively consider all alternatives, without preference for a particular solution, as it proceeds with its AOA process. NNSA neither agreed nor disagreed with our recommendation.

In August 2016, we found problems with DOE’s front-end project planning at the Waste Isolation Pilot Plant (WIPP) for the new permanent ventilation system. This system is being built to enable DOE to resume full operations of the geological nuclear waste repository, which were suspended after a radiological release accident in February 2014. DOE did not follow all best practices in analyzing and selecting an alternative for the new ventilation system at WIPP, which DOE estimated will cost between $270 million and $398 million to build and will be completed by the end of March 2021.

For example, DOE did not select the preferred alternative based on assessing the difference between the life-cycle costs and benefits of each alternative, as called for by best practices and required by DOE’s revised project management order. We recommended that DOE require projects, including the WIPP ventilation system, to implement recommendations from independent AOA reviews or document the reasons for not doing so. DOE concurred with the recommendation and planned to incorporate guidance in its updated project review guide on how DOE offices should address recommendations from independent reviews.

Monitoring

DOE made significant efforts to improve its performance in monitoring and independently validating the effectiveness and sustainability of corrective measures and now partially meets our monitoring criterion. Changes DOE has made are important and can substantively improve how DOE oversees and executes its major projects and programs. We have not evaluated the effectiveness of the new monitoring measures because it will take time for DOE to employ them, and we note that they do not cover all aspects of contract management or certain EM activities and depend upon the availability of reliable enterprise-wide cost information. and it meets on a biweekly basis. According to DOE officials, during 2015, the committee reviewed 19 project milestones, 2 proposals for updating major projects’ cost and schedule, and received 15 briefings from independent project review teams. Also in 2015, the PMRC reviewed multiple major projects, such as the Uranium Processing Facility (UPF), the MOX facility, the CMRR project, WTP, and the Salt Waste Processing Facility. The PMRC also prepared information on these projects for ESAAB meetings in which most of these major projects were discussed. In addition, according to senior DOE officials, the PMRC focuses on all elements of project risk, not just those elements related to DOE’s project management order but also projects’ contract terms and regulatory compliance.

DOE has included the role of the PMRC in its updated project management order, issued in May 2016, and created the CRO position, which DOE plans to institutionalize. The CRO’s primary function is to independently oversee capital asset projects and alert the Secretary to any particular risks that may threaten projects’ on- time or on-budget delivery.

DOE enhanced oversight of projects during the commissioning phase—the phase after construction is complete but before operations begin. DOE did so in response to its experience with the Sodium-Bearing Waste Treatment Facility at its Idaho site. In March 2016, DOE’s Office of Inspector General found major design and construction problems during the commissioning phase of this facility. The Inspector General’s investigation found that DOE had moved the scope of work associated with the comprehensive performance test, which demonstrates that the facility would perform its mission as designed, from the construction phase of the project to the operations phase of the project. The project modification prevented DOE from rigorously testing the facility before construction was declared complete. The Inspector General’s investigation concluded that the total actual construction cost for this facility was likely understated by about $181 million, and additional future costs to make the facility operational could exceed $40 million. will be the Sodium-Bearing Waste Treatment Facility. Officials also stated that the department intends to provide guidance to project managers through a new Commissioning Guide to be issued in fiscal year 2017.

DOE established project assessment offices, independent of line management, which review projects at least annually. Through a May 2015 memorandum, NNSA elevated its Office of Project Assessment to report directly to the Under Secretary, increasing the prominence of this function and the likelihood that problems, if encountered, will receive senior-level attention within NNSA. According to EM officials, EM uses its Office of Project Management to conduct regular independent project reviews for projects under $100 million, and since July 2016, DOE’s Office of Project Management, Oversight, and Assessments has reviewed EM projects with a cost greater than $100 million. key waste treatment facilities. DOE’s cost performance data shows that the approved total project cost of $16.8 billion is underestimated, and a senior DOE official recently informed Congress that the WTP’s cost will increase significantly.

DOE’s efforts to improve monitoring are encouraging, but additional time is needed for us to assess how effectively these recent monitoring improvements will validate the sustainability of corrective measures. We have not yet evaluated the operations of the PMRC, but according to its charter this committee serves in an advisory role to the ESAAB and the programs, while the program offices remain responsible for delivering projects. DOE officials stated that the PMRC provides a list of its recommendations for the ESAAB meetings, but DOE does not track which PMRC recommendations are implemented. In our ongoing work, we have identified an example that raises questions about whether the programs are following the guidance of the PMRC. For the Tank Waste Characterization and Staging facility at Hanford, DOE estimated a cost range of $390 million to $690 million. However, we reported in May 2015 that this cost range was not reliable. We also found that EM officials had estimated that the cost for this facility would range from $1 billion to $1.5 billion, making it a major project and subject to more rigorous oversight requirements. The PMRC reviewed the cost estimates showing that this facility should be classified as a major project, but the program office responsible for the facility did not modify the cost range for the project at inception, raising questions about the extent of the PMRC’s influence.

DOE’s new oversight and monitoring efforts are not comprehensive, as certain activities within EM are not subject to review by the PMRC, even though together they cost billions of dollars and last for numerous years. Specifically, the PMRC does not review the cost and schedule performance of operations activities within EM. These operations activities include programs such as groundwater treatment at the Hanford site, which has annually cost between about $140 million and $185 million in recent years. of about $64 million and a schedule delay of nearly 9 months, in part because DOE’s initial estimates to complete the recovery activities did not follow all best practices and were therefore unreliable. Notably, DOE estimated it would restart waste operations based on a schedule that gave DOE less than a 1 percent chance of meeting its restart date. We recommended that EM revise its protocol to require it to use best practices in developing cost and schedule estimates. DOE concurred with our recommendation and stated that EM plans to transition from the operations activities protocol to a new directive for operations activities, which will include guidance on using cost and schedule best practices.

Finally, the effectiveness of DOE’s monitoring of its contracts, projects, and programs depends upon the availability of reliable enterprise-wide cost information on which to base oversight activities. Such information is needed to, among other things, identify the costs of activities and ensure the validity of its cost estimates. However, meaningful cost analysis— including comparisons across programs, contractors, and sites—is not possible because NNSA’s contractors use different methods of accounting for and tracking costs. NNSA developed a plan to improve and integrate its cost reporting structures; however, we found in our January 2017 report that the plan did not provide a useful roadmap for guiding NNSA’s effort. Until a plan is in place that incorporates leading strategic planning practices, NNSA cannot be assured that its efforts will result in a cost collection tool that produces reliable enterprise-wide cost information that satisfies the information needs of Congress and program managers, and enables DOE to effectively monitor its progress in improving how it manages its contracts and programs.

Demonstrated Progress

As noted earlier, DOE implemented a series of changes to policies and procedures to improve project management, but the department does not yet meet the criterion for demonstrating progress. DOE’s recent reforms are in the early stages, and more time is needed to assess the effectiveness of corrective measures and associated progress, especially with respect to ongoing major projects. DOE has taken significant actions regarding two of its six ongoing major projects but continues to encounter significant project management challenges, cost increases, and schedule delays on others. In addition, DOE’s recent reforms do not address contract management, and our work since the last high-risk report has identified several significant challenges with DOE contract management on which DOE has taken little action.

For two major projects, DOE has taken significant steps to address cost and schedule problems. For example, NNSA proposed, in its fiscal year 2017 budget request, to terminate the MOX project and pursue an alternative path for disposing of plutonium, under which DOE would dilute plutonium for disposal in a geologic repository. For the UPF, NNSA has cancelled its plans for a large uranium facility, and proposed to use both existing and new smaller facilities and new technologies to meet its needs. It is too early to determine the effects of these changes. DOE has not developed a complete, reliable cost estimate for its new approaches at the MOX or UPF facilities. NNSA officials believe the new approaches will allow the agency to meet its mission needs at lower costs to the taxpayer.

Our recent work has identified continuing challenges for two major projects that DOE’s recent project management reforms in theory should have addressed. For example, In May 2015, we found that DOE continues with its design build approach at the WTP, which is not consistent with DOE’s revised project management order. DOE’s revised project management order requires a facility’s design to be at least 90 percent complete before establishing cost and schedule baselines. We found that construction had outpaced design at some facilities at WTP, and external reviews had identified hundreds of vulnerabilities in the waste treatment facilities after assessing only half of the facilities’ systems. However, EM has not applied DOE’s requirement to the WTP. We recommended that DOE (1) limit construction on the WTP until risk mitigation strategies are developed to address known technical challenges, and (2) determine the extent to which the quality problems exist, in accordance with its quality assurance policy, for the facilities’ systems that have not been reviewed to determine if additional vulnerabilities exist. DOE neither agreed nor disagreed with these recommendations and has not implemented them. analyzing plutonium for the revised CMRR project. NNSA neither agreed nor disagreed with the recommendations.

As noted earlier, DOE’s corrective action plan does not address problems with DOE’s oversight of major contracts. These problems have been longstanding. For example, we noted in 1991 that DOE lacked assurance that its oversight and control of contract expenditures will deter and detect potential fraud, waste, and abuse. In addition to the contract management issues noted earlier, such as acquisition planning for major contracts and the quality of enterprise wide-cost information, our recent work identifies additional challenges DOE continues to face in contract management. In May 2015, we found that NNSA had not established policies or guidance specific to using information from CAS to evaluate M&O contractor performance. NNSA did not have policy or guidance on how or to what extent NNSA officials should use information from CAS in evaluating M&O contractors’ performance. We recommended that NNSA revise its policy, guidance, and procedures for evaluating performance to fully address how and under what circumstances those responsible for evaluating M&O contractors’ performance should use information from CAS. NNSA agreed with this recommendation and revised the policy in 2016. NNSA also created a website and held a summit to share CAS lessons learned and strengthen the CAS community of practice. However, NNSA has not established comprehensive guidance for implementing this policy consistently.

Even though we removed nonmajor projects from our High-Risk List, we continue to monitor how DOE manages these projects to ensure that DOE sustains progress in this area. We note that the Secretary’s December 2014 and June 2015 memorandums applied project management reforms to nonmajor projects previously not subject to such requirements, and DOE’s performance in meeting cost and schedule milestones for nonmajor projects continues to improve, with nearly 95 percent of such projects meeting cost and schedule milestones over the last 3 years, according to DOE officials. Our recent work, however, shows that several nonmajor projects exhibit some of the challenges that have long persisted for DOE’s major projects, such as incomplete front-end planning and unreliable cost and schedule estimates, which means that nonmajor projects still warrant our observation. waste in the tanks and (2) a tank waste characterization and staging facility to stage, mix, sample, and characterize high-level waste from the tanks prior to delivery to the pretreatment facility. They have a combined total estimated cost of $633 million to at least $1 billion. We found DOE excluded from its estimates the costs of some major activities necessary to construct these facilities, and did not sequence activities to complete them in accordance with schedule estimating best practices. We recommended, among other things, that DOE revise cost and schedule estimates for these two facilities in accordance with industry best practices. DOE generally agreed with our recommendations but has not yet implemented them.

Benefits Achieved from Implementing Our Recommendations

In 2014, we reviewed DOE’s request for fiscal year 2015 funding for the WTP. We found that DOE requested an additional $23 million for the design of a system to address technical problems the WTP had recently encountered. We noted that because engineering and construction at key WTP facilities had been stalled or slowed in fiscal year 2013, it was unclear whether DOE needed the full funding for WTP plus the additional amount to address technical problems. In the fiscal year 2015 appropriations bill, Congress provided $667 million for work at the WTP, which was $23 million less than DOE’s budget request for the WTP for that year.

DOE achieved some benefits by implementing several of our recommendations in fiscal years 2015 and 2016. Specifically

DOE instituted requirements for projects and programs to follow cost- estimating best practices.

DOE instituted requirements for projects and programs to follow analysis of alternatives best practices.

DOE analyzed root causes of the Plutonium Disposition Program cost increases and instituted a department-wide requirement for root cause analysis of cost and schedule breaches.

DOE’s Office of Environmental Management developed a consolidated workforce plan.

DOE provided independent reviews of nonmajor projects, and defined and tracked performance targets for nonmajor projects.

GAO Contact

For additional information about this high-risk area, contact David Trimble at (202) 512-3841 or trimbled@gao.gov.

Related GAO Products

National Nuclear Security Administration: A Plan Incorporating Leading Practices Is Needed to Guide Cost Reporting Improvement Effort, GAO-17-141, Washington, D.C.: January 19, 2017.

Program Management: DOE Needs to Develop a Comprehensive Policy and Training Program. GAO-17-51. Washington, D.C.: November 21, 2016.

Department of Energy: Actions Needed to Strengthen Acquisition Planning for Management and Operating Contracts. GAO-16-529. Washington, D.C.: August 9, 2016.

DOE Project Management: NNSA Needs to Clarify Requirements for Its Plutonium Analysis Project at Los Alamos. GAO-16-585. Washington, D.C.: August 9, 2016.

Nuclear Waste: Waste Isolation Pilot Plant Recovery Demonstrates Cost and Schedule Requirements Needed for DOE Cleanup Operations. GAO-16-608. Washington, D.C.: August 4, 2016.

Department of Energy: Whistleblower Protections Need Strengthening. GAO-16-618. Washington, D.C.: July 11, 2016.

Department of Energy: Observations on Efforts by NNSA and the Office of Environmental Management to Manage and Oversee the Nuclear Security Enterprise. GAO-16-422T. Washington, D.C.: February 23, 2016.

Nuclear Weapons: NNSA Has a New Approach to Managing the B61-12 Life Extension, but a Constrained Schedule and Other Risks Remain. GAO-16-218. Washington, D.C.: February 4, 2016.

DOE Project Management: NNSA Should Ensure Equal Consideration of Alternatives for Lithium Production. GAO-15-525. Washington, D.C.: July 13, 2015.

Department of Energy: Actions Needed to Improve DOE and NNSA Oversight of Management and Operating Contractors. GAO-15-662T. Washington, D.C.: June 12, 2015.

National Nuclear Security Administration: Actions Needed to Clarify Use of Contractor Assurance Systems for Oversight and Performance Evaluation. GAO-15-216. Washington, D.C.: May 22, 2015.

Hanford Waste Treatment: DOE Needs to Evaluate Alternatives to Recently Proposed Projects and Address Technical and Management Challenges. GAO-15-354. Washington, D.C.: May 7, 2015.

National Nuclear Security Administration: Observations on Management Challenges and Steps Taken to Address Them. GAO-15-532T. Washington, D.C.: April 15, 2015.

National Nuclear Security Administration: Reports on the Benefits and Costs of Competing Management and Operating Contracts Need to Be Clearer and More Complete. GAO-15-331. Washington, D.C.: March 23, 2015.

Nuclear Waste: DOE Needs to Improve Cost Estimates for Transuranic Waste Projects at Los Alamos. GAO-15-182. Washington, D.C: February 18, 2015.

NASA Acquisition Management

Why Area Is High Risk

The National Aeronautics and Space Administration (NASA) plans to invest billions of dollars in the coming years to explore space, understand Earth’s environment, and conduct aeronautics research. We designated NASA’s acquisition management as high risk in 1990 in view of NASA’s history of persistent cost growth and schedule delays in the majority of its major projects. Our work has shown that NASA has made progress over the past 5 years in a number of key acquisition management areas, but it faces significant challenges in some of its major projects largely driven by the need to improve the completeness and reliability of its cost and schedule estimating, estimating risks associated with the development of its major systems, and managing to aggressive schedules.

What GAO Found

NASA has continued to strengthen and integrate its acquisition management functions, resulting in the agency continuing to meet three criteria for removal from our High-Risk List: leadership commitment, a corrective action plan, and monitoring. For example, NASA has established metrics to monitor progress in improving acquisition management, and in recent years, we have found that many of the projects within the agency’s major project portfolio have improved their cost and schedule performance. NASA’s metrics include cost and schedule performance indicators and we have found that NASA’s performance metrics generally reflect improved performance. These actions have helped NASA to create better baseline estimates and track performance such that NASA has been able to launch more projects on time and within cost estimates.

Although NASA has taken steps toward meeting our criteria for capacity by issuing guidance and implementing tools to reduce acquisition risk, our reviews have found that these efforts have not always been consistent with best practices in areas such as cost and schedule estimating and earned value management (EVM). Finally, while the agency has taken steps to demonstrate progress toward improving acquisition outcomes overall, we found that NASA continues to face significant challenges in its ability to manage and oversee its most expensive and complex projects, most notably its human spaceflight development programs. NASA must ensure that it conducts adequate and ongoing assessments of risks and understands the long-term costs for its larger human exploration programs, as the effects of any potential miscalculations could be felt across NASA’s portfolio. Such efforts should help maximize improvements and to demonstrate that the improved cost and schedule performance will be sustained, even for the agency’s most expensive and complex projects.

In our 2015 high-risk update, we found that NASA has satisfied our high- risk criteria for the areas of leadership commitment, monitoring, and an action plan. We believe NASA’s progress in these areas is reflected in the improved cost and schedule performance of NASA’s portfolio of major acquisition projects, which includes projects with a life-cycle cost of more than $250 million. For example, in 2016, overall development cost growth for the portfolio of 12 development projects fell to 1.3 percent and launch delays averaged 4 months. Both of these measures are at or near the lowest levels we have reported since we began our annual assessments in 2009. These measures exclude the James Webb Space Telescope (JWST), which NASA rebaselined in September 2011 with significant cost increase and schedule delays. As of December 2016, we found that program continues to meet its revised cost and schedule commitments.

What Remains to Be Done

NASA manages a portfolio of projects that will always have inherent technical, design, and integration risks because its projects are complex, specialized, and often push the state of the art in space technology. NASA has already taken steps to reduce acquisition risk from both a technical and management standpoint. The next few years will certainly test the extent to which these measures have taken hold in NASA’s largest programs. However, more needs to be done with respect to anticipating and mitigating risks—especially with regard to large programs, estimating and forecasting costs for its largest projects, and implementing management tools. Actions that will be critical to improving NASA’s acquisition outcomes include the following:

Ensure that NASA conducts adequate and ongoing assessments of risks for larger programs—JWST, Space Launch System (SLS), Orion Multi-Purpose Crew Vehicle (Orion), and Exploration Ground Systems (EGS)—especially since each of these programs is at a different critical point in development and implementation, and the impacts of any potential miscalculations will be felt across NASA’s portfolio.

Ensure that NASA understands long-term human exploration program costs. While the three major exploration programs have been baselined, none of the three programs have a baseline that covers activities beyond the second planned flight. Long-term estimates, which could be revised as potential mission paths are narrowed and selected, would provide decision makers with a more informed understanding of costs and schedules associated with potential agency development paths.

Ensure that the Orion program analyzes the cost of deferred work in relation to levels of management reserves and unallocated future expenses, and actual contractor performance, and report the results of that analysis to NASA management.

Ensure that rebaselined projects report cost and schedule growth from original baselines in order to provide stakeholders and Congress with a more accurate view of project performance and to enhance accountability.

Ensure that program offices regularly and consistently update their Joint Cost and Schedule Confidence Levels (JCL) across the portfolio. As a project reaches the later stages of development, especially integration and testing, its risk posture may change. An updated project JCL would provide both project and agency management with data on relevant risks that can guide project decisions.

Ensure that NASA continues its efforts to build capacity in areas such as cost and schedule estimating, and measuring contractor performance.

Revisit schedules to ensure programs have fully considered the effects of managing programs in order to meet aggressive schedule dates.

Our ongoing work assessing Commercial Crew, EGS, Orion, SLS, JWST, and the performance of the portfolio as a whole will provide insight into how well NASA is performing over the next several years.

Additional Details on What GAO Found

Leadership Commitment

We determined in our 2015 update that NASA had met our criteria in the area of leadership commitment, which the agency continues to meet. We believe that the agency’s efforts in this area—including the strengthening of its acquisition policy and oversight functions—have resulted in improvement of major acquisition projects’ cost and schedule performance.

Capacity

NASA has partially met our high-risk criteria for capacity. While NASA has taken steps to issue guidance and implement tools to reduce acquisition risk, our reviews have found that these efforts have not always been consistent with best practices in areas such as estimating costs and schedules and EVM surveillance.

In February 2015, NASA published a new version of its Cost Estimating Handbook that includes an appendix on JCL analysis. But NASA does not require its projects to update JCLs. Our prior work has found that projects do not regularly update cost risk analyses to take into account newly emerged risks. Our Cost Estimating and Assessment Guide recommends that cost estimates should be updated to reflect changes to a program or kept current as it moves through milestones. As new risks emerge for a project, updating the cost risk analysis can provide realistic estimates to decision makers, including Congress.

Further, we have found that NASA’s three costliest acquisition programs—JWST, SLS, and Orion—did not fully follow best practices when developing their JCLs. For example, in July 2016 we found that the Orion program’s cost estimate met or substantially met 7 of 20 best practices and its schedule estimate met only 1 of 8 best practices. The cost estimate lacked necessary support and the schedule estimate did not include the level of detail required for high-quality estimates. Without sound cost and schedule estimates, decision makers do not clearly understand the cost and schedule risk inherent in the program and lack important information they need to make programmatic decisions. In October 2015, NASA decided to decentralize its independent assessment function and deploy the staff to the agency’s centers, in part, to better use its workforce to meet program needs in areas such as program management, cost estimating, and resource analysis, and to fill gaps in program analysis skills at the center level. It is too early to tell whether this change will address skills gaps and ultimately improve the quality of JCLs in the future as programs will need to hold reviews under this organization of the assessment function, and compare those reviews to actuals in order to assess the change.

NASA has made progress implementing EVM analysis—another key project management tool— but the agency has not yet fully implemented a formal EVM surveillance plan in accordance with best practices. NASA has made significant progress rolling out EVM to its centers and supported these efforts with training, including classroom and online training to projects. In November 2012, we recommended that NASA update its procedural requirements to include a formal EVM surveillance program in order to improve the reliability of EVM data collected by NASA programs. While NASA agreed with our conclusion that EVM data reliability needed improvement, it has yet to implement a formal surveillance requirement due to resource constraints. In our December 2015 review of JWST, we found EVM data anomalies and recommended that project officials require the contractors to explain and document all such anomalies in their monthly EVM reports. A continuous surveillance program could have identified these anomalies earlier, allowing the project to pursue corrective action with its contractors. NASA has since implemented this recommendation for the JWST program. Proper surveillance of EVM contractor data is a best practice in the NASA Earned Value Management Handbook and our Cost Estimating and Assessment Guide.

Action Plan

In our 2015 high-risk update, we found that NASA had satisfied our high- risk criteria for an action plan and it continues to do so. NASA, which reports its action plan metrics to us on a semiannual basis, continues to perform within the parameters outlined in the plan—such as meeting metrics for cost and schedule performance, and mission success measures. These and other steps have enabled NASA to launch more projects on time and within cost estimates.

Monitoring

We found in 2015 that NASA had met our high-risk criteria for monitoring and it continues to do so. NASA has established metrics to monitor progress in improving acquisition management, and we have found that those metrics generally reflect improved performance. The NASA Systems Engineering Handbook includes several technical indicators for design maturity, and the agency’s project management policy and systems engineering policy have been updated to require projects to track these metrics. In March 2016, we found that NASA had sustained prior improvement in design stability for its major acquisition projects.

Demonstrated Progress

NASA has partially met our criteria for demonstrating progress. The agency has taken steps to improve acquisition outcomes, but we continue to find that the agency faces significant challenges in its ability to manage and oversee its most expensive and complex projects, most notably regarding human spaceflight development. Other programs demonstrate that NASA continues to face challenges accurately estimating or quickly responding to risks. Also, NASA inconsistently reports on the performance of some programs, which masks the full extent of cost and schedule growth.

Together, NASA’s three human spaceflight efforts constitute more than half of NASA’s portfolio development cost baseline, and helped make the 2016 portfolio the most expensive collection of NASA projects in development since we began our annual assessment in 2009. Although NASA’s human spaceflight programs are generally better positioned for success than the agency’s most recent effort to replace the space shuttle, managing weaknesses—including unreliable cost estimating, overly ambitious internal deadlines, limited reserves, and operating for extended periods of time without definitized contracts—have increased the likelihood that it will incur overruns and schedule delays, particularly when coupled with the broad array of technical risks that are inherent in any human spaceflight development.

Moreover, all three human spaceflight projects will be significantly challenged in the next 2 years as NASA aims to launch its first exploration mission by November 2018. This mission, which will not have a crew, will fly some 70,000 kilometers beyond the moon—using the SLS launch vehicle, Orion, and EGS. During this time, the human spaceflight programs will need to resolve a multitude of technical and design challenges, complete fabrication and testing, and be delivered to the Kennedy Space Center where they will be integrated with each other and prepared for launch. Numerous activities along this development path are sequential and cannot be rearranged to gain back time lost from prior delays. Other activities can be deleted or performed concurrently, but not without more risk to the program. If delays materialize during individual systems integration and testing, they could cause a cascading effect of cross-program problems. NASA has already made these later phases more complicated by postponing key activities in order to keep pace with internal deadlines. In addition, because the agency will be in the final throes of other major programs, such as JWST, senior leaders’ attention may be divided amongst many programs in the months leading up to the first exploration mission.

Examples of management risk for human spaceflight programs that we have recently identified include:

As we found in July 2016, each program manages to an aggressive internal NASA launch readiness date, which creates an environment for programs to make decisions based on reduced knowledge to meet a date that is not realistic. For example, the EGS program has consolidated future schedule activities to prepare the mobile launcher—the vehicle used to bring SLS to the launch pad—to meet this internal goal. The program acknowledged that consolidating activities—which includes conducting verification and validation concurrent with installation activities—increases risk because of uncertainties about how systems not yet installed may affect the systems already installed. Officials added, however, that this concurrency is necessary to meet the internal schedule.

All three programs are operating with limited cost reserves, which limit each program’s ability to address risks and unforeseen technical challenges. For example, we found in July 2016 that the Orion program will maintain very low levels of annual cost reserves until 2018. The lack of currently available cost reserves has caused the program to defer work to address technical issues to stay within budget. As a result, the Orion program’s reserves in future years could be overwhelmed by deferred work—a practice that contributed to the rebaseline of the JWST program, which included a $3.6 billion cost increase and a 52-month schedule delay.

We found in July 2016 that the SLS program has not positioned itself well to accurately assess progress with the core stage—SLS’s structural backbone and fuel tank—because it did not have a performance measurement baseline for that contract. Such a baseline is necessary to support EVM reporting that can provide early warning signs of impending schedules delays and cost overrun, and provide unbiased estimates of anticipated costs at completion. The lack of an accurate performance measurement baseline stemmed from different assumptions between NASA and the contractor about when funding would be available to start different work and ultimately led to a contract modification. NASA and the contractor signed the contract replan in May 2016—with a cost increase of approximately $1 billion—and the program began receiving contractor EVM data in July 2016, more than 4.5 years after NASA awarded the contract.

The cost and schedule baselines NASA has established for these three programs provide little visibility into long-term planning and costs. The baselines for SLS and EGS are applicable through the first exploration mission, and the baseline for Orion extends through the second exploration mission. However, the limited scope that NASA has chosen for constructing these cost estimates means that these estimates are unlikely to serve as a way to measure progress and track cost growth over the life of the projects which are expected to extend well beyond these first missions.

In addition to these human spaceflight programs, NASA plans to reestablish a domestic capability to fly astronauts to the International Space Station through its Commercial Crew program by the end of 2018. This is also proving to be an aggressive schedule and NASA’s two contractors are concurrently developing, testing, and producing their vehicles in an effort to maintain schedule. Significant delays could lead to a gap in U.S. access to the International Space Station as NASA has acquired seats on the Russian Soyuz vehicle only through 2018.

NASA also continues to have trouble demonstrating progress in executing two projects that we found in our 2015 high-risk update illustrated instances in which the agency had either underestimated risks and potential effects or had not reacted quickly enough to risks when they worsened: The Ice, Cloud, and Land Elevation Satellite-2 (ICESat-2) project—also scheduled to launch in 2018—continues to experience issues with its sole instrument, a laser altimeter. The project may require an additional 10 months or more to resolve technical challenges. The project already underwent one rebaseline in 2014, resulting in a 37 percent higher development cost than its original baseline—from $558.9 million to $763.7 million—which NASA officials at the time primarily attributed to underestimating the technical complexity of the project’s design.

The Space Network Ground Segment Sustainment (SGSS) project’s contractor provided overly optimistic estimates, which—despite project officials being aware of this issue during project confirmation— necessitated a rebaseline shortly after the project was confirmed. NASA approved a new baseline in June 2015, which increased its estimated cost by $345 million and delayed its estimated completion by 27 months. In February 2016, NASA reclassified SGSS as a sustainment project rather than a major project, which reduces reporting and oversight requirements.

Finally, as we highlighted in the 2015 high-risk update, the inconsistent way NASA measures its progress toward reducing acquisition risk masks true cost and schedule growth for some programs. When NASA reports on cost and schedule performance for individual projects or across its portfolio, it uses rebaseline data rather than original project baseline data for measuring outcomes. Cost and schedule growth that occurred prior to the rebaseline of a troubled project are excluded from calculations of overall progress. As a result, when the agency reports program performance in this manner—as it has for JWST, ICESat-2, and others— it makes it difficult to track cost and schedule growth compared to the agency’s original commitment levels.

Benefits Achieved by Implementing Our Recommendations

In November 2012, we found that NASA employee skill sets available to analyze and implement EVM vary widely from center to center, and we recommended that NASA conduct an EVM skills gap analysis to identify areas requiring augmented capability across the agency, and, based on the results of the assessment, develop a workforce training plan to address any deficiencies. NASA developed an EVM training plan in 2014 based on the results of an EVM skills gap analysis that was conducted in 2013.

In November 2012, we found that NASA faced cultural and technical challenges that it must overcome to successfully implement an EVM system and to use this data on a regular basis to inform decision making. We recommended that the agency develop an EVM change management plan to assist managers and employees throughout the agency with accepting and embracing earned value techniques while reducing the operational effect on the agency. In response to our recommendation, in 2014, NASA developed an EVM change management plan. This plan was approved by the EVM Steering Committee, which is comprised of senior-level NASA officials who provide guidance to the agency on implementing EVM. In addition, the plan was briefed to the EVM Focal Points who are responsible for implementing the plan within their respective organizations.

In November 2012, we found that 10 NASA major spaceflight projects had not yet fully implemented EVM. As a result, NASA was not taking full advantage of an important tool that could help reduce acquisition risk. We recommended that NASA establish a time frame by which all new spaceflight projects will be required to implement NASA’s newly developed EVM system to ensure that in-house efforts are compliant with ANSI/EIA-748, accounting for the need to increase NASA’s institutional capability for conducting EVM and analyzing and reporting the data. In fiscal year 2013, NASA started a phased rollout at selected centers to increase the agency’s EVM capacity by implementing its EVM Capability process at projects at those centers. According to NASA officials, as future projects at those centers implement EVM, they expect centers will follow the agency EVM process, which will better ensure that they are using systems which are compliant with ANSI/EIA-748.

In August 2014, NASA addressed concerns we raised about the SLS by taking actions to balance the program’s cost and schedule risk in line with agency policies. At the time of our report in July 2014, we found that NASA’s funding plan for the first test flight of SLS in December 2017 was insufficient to meet needs. We recommended that the program match resources to requirements that would result in a level of risk in line with NASA policy by—for example—establishing cost and schedule baselines that supported a joint cost and schedule confidence level (JCL) of 70 percent. We indicated that NASA could, for example, increase funding or delay the scheduled launch date to reduce risks and meet the 70 percent JCL. In August 2014, the program addressed our concerns by establishing its agency cost and schedule baselines at a 70 percent JCL of $9.7 billion with a launch readiness date of November 2018.

GAO Contact

For additional information about this high-risk area, contact Cristina T. Chaplain at (202) 512-4841 or chaplainc@gao.gov.

Related GAO Products

James Webb Space Telescope: Project Meeting Cost and Schedule Commitments but Continues to Use Reserves to Address Challenges. GAO-17-71. Washington, D.C.: December 7, 2016.

Orion Multi-Purpose Crew Vehicle: Action Needed to Improve Visibility into Cost, Schedule, and Capacity to Resolve Technical Challenges. GAO-16-620. Washington, D.C.: July 27, 2016.

NASA Human Space Exploration: Opportunity Nears to Reassess Launch Vehicle and Ground Systems Cost and Schedule. GAO-16-612. Washington, D.C.: July 27, 2016.

NASA: Assessments of Major Projects. GAO-16-309SP. Washington, D.C.: March 30, 2016.

James Webb Space Telescope: Project on Track but May Benefit from Improved Contractor Data to Better Understand Costs. GAO-16-112. Washington, D.C.: December 17, 2015.

Space Launch System: Management Tools Should Better Track to Cost and Schedule Commitments to Adequately Monitor Increasing Risk. GAO-15-596. Washington, D.C.: July 16, 2015.

NASA: Assessments of Selected Large-Scale Projects. GAO-15-320SP. Washington, D.C.: March 24, 2015.

DOD Contract Management

Why Area Is High Risk

The Department of Defense (DOD) obligated $273.5 billion in fiscal year 2015 on contracts for goods and services, including major weapon systems, support for military bases, information technology, consulting services, and commercial items. Contracts also include those supporting contingency operations, such as those in Afghanistan. DOD is, by far, the single largest contracting agency in the federal government, typically accounting for about two-thirds of all federal contracting activity. Our work and that of others, however, has identified challenges DOD faces within three segments of contract management: (1) the acquisition workforce, (2) service acquisitions, and (3) operational contract support (OCS). Ensuring DOD has the people, skills, capacities, tools, and data needed to make informed acquisition decisions is essential if DOD is to effectively and efficiently carry out its mission in an era of more constrained resources. We added this area to our High-Risk List in 1992.

What GAO Found

Senior DOD leadership remains committed to addressing its contract management challenges and, in particular, has made significant progress in addressing OCS issues since 2015. For example, DOD held meetings of its senior executive level governance forum to institutionalize OCS, issued revised guidance, and made progress in incorporating OCS concepts into operational plans. Further, DOD has taken steps to address education and training shortfalls and has dedicated additional training resources to enhance OCS. DOD also updated its action plan for OCS, which includes both revised and new tasks with measurable metrics and milestones. As a result of these actions, for the OCS subarea, we have raised our assessments for capacity to partially met and consider DOD to have met our criterion for having an action plan.

DOD has also made some progress in managing its acquisition workforce. Specifically, in October 2016, DOD issued its updated acquisition workforce strategic plan which, among other things, assessed the current capability of the workforce and identified risks that DOD needed to manage to meet future needs. As a result of these actions, we have raised the action plan criterion for the acquisition workforce subarea to partially met. DOD acknowledged, however, that it will need to develop and implement metrics to track progress toward meeting the four strategic goals identified in its October 2016 strategic workforce plan. Further, the workforce plan does not establish specific career field goals or targets, which will hinder efforts to ensure DOD has the right people with the right skills to meet future needs.

Congress has also taken action to help improve the acquisition workforce. In the National Defense Authorization Act for Fiscal Year 2016, Congress made permanent the requirement for the military departments and defense agencies to remit $500 million for each fiscal year to the Defense Acquisition Workforce Development Fund (DAWDF)—a fund used by DOD to increase hiring and provide additional training. This enabled critical support for acquisition workforce development initiatives for DOD.

While DOD continues to take action to improve how it manages services acquisitions, demonstrated progress was more limited. In January 2016, DOD issued a new instruction for service acquisitions that provides a management structure for acquiring services and identifies the roles and responsibilities of key leadership positions, but DOD still lacks an action plan that will enable it to assess progress toward achieving its goals, and efforts to identify goals and associated metrics are still in the early stages of development.

One critical element in improving services acquisition is to know what the department is buying today and what it intends to buy in the future. We found that while data on future service acquisitions are generally maintained by DOD program offices, DOD and military department guidance does not require that data to be specifically identified in DOD’s budget forecasts. In that regard, DOD’s January 2016 service acquisition instruction includes requirements to generate data on anticipated future service acquisition spending, but this requirement does not clearly identify what level of detail should be collected, leaving DOD at risk of developing inconsistent data between each military department.

What Remains to Be Done

To further improve outcomes on the billions of dollars spent annually on goods and services, DOD needs to take the following actions.

Continue efforts, including strategic planning and aligning funding, to increase the department’s capacity to negotiate, manage, and oversee contracts by ensuring that its acquisition workforce is appropriately sized and trained to meet the department’s needs.

Determine the appropriate mix of military, civilian, and contractor personnel. To assist with this, DOD needs to make decisions about the department’s approach for compiling its inventory of contracted services and defining the roles and responsibilities of those involved with the inventory.

Strategically manage how it acquires services by defining desired outcomes, establishing goals and measures, and obtaining data needed to measure progress. To enhance available information on service acquisitions, the military departments should revise programming guidance to collect information on how contracted services will be used to meet requirements beyond the budget year.

Sustain efforts throughout the department to integrate OCS through policy, planning, training, and application of necessary resources for both current and future contingency operations.

Listed below are additional recommendations that need to be addressed: In December 2015, we recommended that DOD update its acquisition workforce plan, including revising career field goals. DOD concurred with our recommendation. In October 2016, DOD issued an updated acquisition workforce strategic plan which, among other things, assessed the current capacity and capability of the workforce and identified the risks that DOD needed to manage to meet future needs. The updated workforce plan also established four strategic goals, approved by the Defense Acquisition Workforce Senior Steering Board, to guide future efforts, including shaping the acquisition workforce to achieve current and future acquisition requirements. The October 2016 plan did not, however, establish specific career field goals or targets for its 13 career fields, including priority career fields where it has not met its targets, such as contracting, business, and auditing, which will hinder efforts to ensure that DOD has the right people with the right skills to meet future needs.

In June 2013, we recommended that DOD identify baseline data on the status of service acquisitions, develop specific goals associated with their actions to improve service acquisitions, and establish metrics to assess progress in meeting these goals. DOD concurred with our recommendations and is developing service acquisition goals and metrics as well as an action plan for improving service acquisition.

In relation to strategic sourcing—a process of moving away from numerous individual procurements to a broader aggregate approach—in September 2012, we recommended that the department issue direction that sets goals for spending managed through strategic sourcing vehicles, establishes procedures for tracking strategic sourcing efforts, and establishes metrics to track progress toward these goals. We also recommended that DOD identify and evaluate the best way to strategically source DOD’s highest spending categories. DOD concurred with these two priority recommendations and has been working with the Office of Management and Budget’s Category Management Leadership Council to determine appropriate strategic sourcing goals, but specific goals and corresponding metrics have not yet been established. DOD officials stated that appointing senior officials to manage the acquisition of services should help DOD further expand strategic sourcing efforts for high-spend service categories. As of October 2016, however, many of these efforts are in the early stages of implementation.

We noted in our 2015 high-risk report that DOD’s top leadership has taken significant steps to plan and monitor progress in the management and oversight of contracting techniques and approaches. For example, we noted that DOD had been using its Business Senior Integration Group—the Under Secretary of Defense for Acquisition, Technology, and Logistics’ executive-level leadership forum for providing oversight in the planning, execution, and implementation of DOD’s Better Buying Power initiatives—as a mechanism to review ongoing and emerging issues, including competition. It is important for DOD to continuously promote competition, which is a critical tool for achieving the best possible return on investment for taxpayers.

In addition, congressional action is needed to enhance visibility into DOD’s planned spending on contract services. In February 2016, we found that, unlike DOD budget exhibits for weapon systems, DOD’s other budget exhibits which contain information on contracted services do not include data on projected spending beyond the current budget year. Without a roadmap of future projected service contract spending needs, Congress has limited visibility into an area that constitutes more than half of DOD’s annual contract spending. Given that the intent of section 235 of Title 10 United States Code was to provide both DOD and Congress with increased oversight of the procurement of services, we suggested that Congress should consider amending reporting requirements to include estimated spending on services beyond the budget year.

Additional Details on What GAO Found

DOD’s Management of Its Acquisition Workforce

Leadership Commitment

DOD has met this criterion by implementing its Better Buying Power initiative—which included specific actions to improve the professionalism of the acquisition workforce—and through continued efforts to sustain and train the workforce in times of budget constraints and cost-cutting pressures. For example, in June 2016, the Under Secretary of Defense for Acquisition, Technology and Logistics stated that DOD intends to sustain the acquisition workforce at current levels and continue to improve its professionalism. Similarly, DOD’s October 2016 acquisition workforce strategic plan stated that DOD must sustain the acquisition workforce size, factoring in workload demand and requirements; ensure its personnel continue to increase their professionalism, and continue to expand talent management programs to include recruitment, hiring, training, development, recognition, and retention incentives by using DAWDF and other appropriate tools. DOD components plan to spend more than $3.0 billion in DAWDF funding between fiscal years 2018 through 2022 in support of these objectives.

Capacity

DOD has partially met this criterion. Since 2015, DOD has continued to increase the size of the acquisition workforce by about 2,000 acquisition personnel. Overall, the size of its military and civilian acquisition workforce grew by about 26 percent—from close to 126,000 to more than 158,000 between September 2008 and March 2016—or about 12,000 more than the target identified in DOD’s April 2010 acquisition workforce plan. While DOD met the overall acquisition growth goal, it did not accomplish the goals set for some career fields. The plan indicated that targeted growth in 5 of these priority career fields—auditing, business, contracting, engineering, and program management—would help DOD strategically reshape its acquisition workforce. As of March 2016, our analysis shows that DOD met or exceeded its planned growth for 8 career fields by about 12,500 personnel, including the priority career fields of program management and engineering, but fell short by about 2,800 personnel in 5 other career fields, including the priority career fields of contracting, business, and auditing. DOD has also used DAWDF to increase hiring and provide for additional training. In the National Defense Authorization Act for Fiscal Year 2016, Congress further enabled critical support for acquisition workforce development initiatives by making permanent the requirement for the military departments and defense agencies to remit $500 million for each fiscal year to the fund.

Increasing the number of people performing acquisition work is only part of DOD’s strategy to improve the capability of its workforce; another part is ensuring that the workforce has the requisite skills and tools to perform their tasks. DOD developed a five-phase process that included surveys of its employees to assess the skills of its workforce and to identify and close skill gaps. DOD completed competency assessments for 12 of its 13 career fields and is developing new training classes to address some skill gaps. However, DOD has not determined the extent to which workforce skill gaps identified in initial career field competency assessments have been addressed and what workforce skill gaps currently exist. In our December 2015 report, we recommended that DOD establish time frames to conduct follow-up career field competency assessments so that it can determine if skill gaps are being addressed. DOD agreed with the recommendation. The department’s October 2016 acquisition workforce strategic plan stated that career field competency assessments should be conducted at a minimum of every 5 years, but it is too soon to tell whether DOD will conduct these assessments as recommended in its workforce plan.

Action Plan

DOD has now partially met this criterion. The National Defense Authorization Act for Fiscal Year 2010 required DOD to develop and submit to Congress a strategic plan for DOD’s acquisition workforce, to be updated biennially. In a December 2015 report, we found that DOD had exceeded its workforce growth target established in 2010 and was focused on sustaining the size of its acquisition workforce. We noted that an updated workforce plan that included revised career field goals, coupled with guidance on how to use DAWDF, could help DOD components focus future hiring efforts on priority career fields. Without an integrated approach, we concluded that the department would be at risk of using the funds to hire personnel in career fields that currently exceed their targets or are not considered a priority. Therefore, we recommended that DOD update its acquisition workforce plan, including revising career field goals, so that it could ensure that the most critical acquisition needs are being met. DOD officials agreed with our recommendation. In October 2016, DOD issued an updated acquisition workforce strategic plan which, among other things, assessed the current capacity and capability of the workforce and identified the risks that DOD needed to manage to meet future needs. The updated workforce plan also established four strategic goals, approved by the Defense Acquisition Workforce Senior Steering Board, to guide future efforts, including shaping the acquisition workforce to achieve current and future acquisition requirements. The October 2016 plan did not, however, establish specific career field goals or targets, which will hinder efforts to ensure that DOD has the right people with the right skills to meet future needs.

We also continue to find that DOD faces challenges in meeting its statutory requirement to prepare an annual inventory of contracted services—one that could help it make more strategic decisions about the right workforce mix of military, civilian, and contractor personnel and better align resource needs through the budget process to achieve that mix. Specifically, in October 2016, we found DOD faced continued delays in (1) deciding on the path forward for its underlying data collection system for the inventory of contracted services, (2) staffing its inventory management support office, and (3) formalizing roles and responsibilities of that office and stakeholders. These continued delays hinder DOD’s ability to use the inventory to inform workforce and budget decision- making processes.

Monitoring

DOD has partially met this criterion. DOD acknowledged that it will need to develop and implement metrics to track progress toward meeting the four strategic goals identified in its October 2016 strategic workforce plan, including those related to shaping the future acquisition workforce. DOD, however, has been tracking workforce growth against targets established in 2010, as well as other metrics, such as those related to education and training.

Demonstrated Progress

DOD has partially met this criterion. The metrics show that the department has exceeded its overall acquisition workforce growth target and education and training rates have increased significantly since 2008. For example, in its October 2016 acquisition workforce plan, DOD reported that the number of personnel with bachelor’s degrees or higher increased from 77 percent in fiscal year 2008 to 84 percent in fiscal year 2015, while those with graduate degrees increased from 29 percent to 39 percent over the same period. DOD also reported that more than 96 percent of the acquisition workforce either met or was on track to meet certification requirements within required time frames. DOD has not, however, verified that the current composition of the workforce will meet its future workforce needs.

Improving DOD’s Acquisition of Services

Leadership Commitment

DOD has demonstrated sustained leadership commitment in improving its approach to managing the acquisition of services, which accounted for more than 50 percent of DOD’s contract obligations in fiscal year 2015, and has met this criterion. This commitment is reflected in DOD’s issuance in January 2016 of a service acquisition instruction, which established policy, assigned responsibilities, and provided procedures for defining, assessing, reviewing, and validating requirements for the acquisition of services. This instruction, which provides a management structure for acquiring services, builds on DOD’s efforts to improve how it acquires services that were contained in its Better Buying Power initiative. We are currently assessing the actions the military departments are taking to implement the service acquisition instruction.

Capacity

DOD has partially met this criterion by establishing a number of management and oversight positions intended to address its capacity for strategically managing the acquisition of services. These include designating the Principal Deputy Under Secretary of Defense for Acquisition, Technology, and Logistics as the department’s senior manager for service acquisition in 2013, as well as building capacity to address service acquisition issues by designating a senior manager for service acquisitions in each military department. We are currently assessing the effects of these new positions.

Action Plan

DOD has not met this criterion. DOD does not have an action plan that would enable it to assess progress toward achieving its goals, and its efforts to develop goals and associated metrics unique to each category of service it acquires are also in the early stages of development.

Monitoring

DOD has partially met this criterion. Because DOD lacks an action plan, it is not yet positioned to fully assess its progress in improving service acquisition. A key element to being more strategic in acquiring services is knowing how and where service acquisition dollars are currently being spent and how those dollars will be spent in the future. We found in February 2016 that program offices within each of the military departments that we met with maintained data on current and estimated future spending needs for contracted service requirements, but they did not identify service contract spending needs beyond the next year, as they were not required to do so. We recommended that the military departments revise their programming guidance to collect information that is already available on how contracted services will be used to meet requirements beyond the budget year.

We also recommended that DOD establish a mechanism, such as a working group of key stakeholders, to coordinate these efforts. DOD partially concurred with these two priority recommendations, citing challenges in estimating future spending, but as of July 2016, had generally not taken action to address them. In February 2016, however, the Army included service contract reporting requirements in its Command Program Guidance Memorandum for fiscal years 2018-2022. The memorandum instructs Army commands and operating agencies to document all current and future requirements for contracted services for fiscal years 2018-2022. In its memorandum, the Army noted that this data will provide transparency over contracted services funding and requirements and enable the Army to track dollars programmed for services. Further, the Army stated that this effort will provide data that can be used to make resource decisions and inform processes that determine workload requirements and assess the appropriate mix of military, civilian, and contractors to execute workload requirements.

In addition, DOD has made progress in acquiring services through strategic sourcing but has more to do to improve monitoring. For example, in September 2015, we found that each of the military departments we reviewed had designated officials responsible for strategic sourcing and created offices to identify and implement strategic sourcing opportunities, including those specific to information technology services. The military departments did not monitor spending or establish savings goals and metrics for the use of their preferred strategic sourcing contracts for information technology services, which resulted in most of their dollars for information technology services being obligated through hundreds of potentially duplicative contracts that diminished the government’s buying power and resulted in missed opportunities to achieve savings and obtain other benefits.

Demonstrated Progress

DOD has partially met this criterion. The January 2016 DOD services acquisition instruction included additional requirements to generate data on past and anticipated future service acquisition spending, but did not clearly identify what level of detail should be collected, leaving the department at risk of developing inconsistent data between each military department and limiting DOD leadership’s insight into future spending on contracted services. DOD plans to develop service acquisition related goals and metrics in fiscal year 2017 to develop additional baseline data to gauge progress. As DOD and the military departments mature efforts to develop more refined data on past and future service contract spending and develop specific goals related to each, DOD will be better positioned to assess its progress.

Addressing Challenges Related to Operational Contract Support

Leadership Commitment

DOD has met this criterion by continuing to demonstrate sustained commitment and strong leadership support in addressing OCS issues. DOD held its first OCS Summit in October 2015, attended by senior leaders from across the department, to review and discuss strategies to better formalize capability and capacity in the Joint Force. DOD officials are planning to host a similar forum in 2017. Additionally, the Functional Capabilities Integration Board serves as a single senior executive-level governance forum for OCS issues. It convenes quarterly, or as required, providing strategic leadership to multiple stakeholders working to institutionalize OCS.

Capacity

DOD has partially met this criterion. Specifically, DOD has made progress toward addressing agency capacity by identifying several actions to develop its personnel and training resources since our last high-risk update. The July 2014 update to the Joint Staff’s primary OCS guidance, according to DOD officials, changed doctrine and obviated the results of an earlier study that had found capacity shortfalls in OCS positions. Subsequently, according to officials, in September 2016 the Office of the Secretary of Defense established a joint OCS Policy Working Group to clarify and refine OCS policy. Also, DOD officials told us, in October 2016, that DOD is pursuing a joint OCS capacity review process to implement corrective actions to address OCS shortfalls in personnel, education, training, and materiel and to better incorporate OCS requirements. Joint Staff also identified priority items that combatant commanders should consider emphasizing in their training and exercise programs to improve OCS capacity.

Action Plan

DOD has made significant progress in addressing the action plan criterion and has met this criterion. In September 2016, DOD issued its fourth iteration of the OCS Action Plan, which is organized around 10 capability gaps that needed to be closed in order to effectively institutionalize OCS capability and is DOD’s primary mechanism for monitoring and validating the effectiveness and sustainability of those tasks. We found, in February 2015, that the 2014 Action Plan lacked performance measures or metrics to evaluate if actions taken had filled the capability gaps. DOD’s 2016 action plan, however, revised tasks and added new tasks to include measurable metrics and provided a cross-walk to show the status of the tasks. For example, the 2016 plan shows 90 tasks completed or deleted from the preceding years. Further, the 2016 plan highlighted a number of other ongoing efforts, such as initiating a new joint capability requirements document and process that, if approved, may accelerate significant changes across DOD.

Monitoring

DOD has partially met this criterion. Each task identified in the 2016 Action Plan has a deliverable or outcome measured against a target completion date, and a senior-level board serves as the primary monitor for these performance targets. Moreover, the 2016 Action Plan included a new annex managed by the Joint Staff logistics directorate to capture subtasks that supplement the 36 overarching tasks in the DOD action plan. However, some of these subtasks are not clearly defined and will be difficult to monitor. For example, one subtask associated with a gap— personnel being insufficiently aware of the significance of OCS—suggests the need for an enduring culture change, but it is unclear how DOD will monitor this effort.

Demonstrated Progress

DOD has partially met this criterion. DOD continues to make progress in incorporating OCS concepts into plans and addressing education and training shortfalls. For example, we found, in December 2015, that U.S. Africa Command developed some annexes to plans that generally contained key considerations discussed in Joint Staff and other DOD guidance such as force protection, host nation agreements, and contractor oversight. Additionally, Joint Staff has revised the Universal Joint Tasks—which support DOD in conducting training and exercises— incorporating lessons learned related to OCS and new doctrine identified in Joint Publication 4-10.

However, DOD has not implemented several priority recommendations related to OCS guidance. For example, we reported, in February 2013, that the Navy, Marine Corps, and Air Force have not developed comprehensive guidance, limiting the military departments’ planning efforts to accurately reflect how they use contract support. We recommended that DOD direct the Navy and Air Force to provide service- wide guidance for the Navy, Marine Corps, and Air Force that describes how each service should integrate OCS into its respective organization to include planning for contingency operations. DOD concurred with this priority recommendation.

Since that time, the Marine Corps has developed guidance and definitions within the Marine Corps Capabilities List, and the Air Force has issued a memorandum on OCS integration and updated existing guidance to include OCS concepts. OSD officials told us, in December 2016, that Navy planners are drafting an OCS instruction for internal review, which they estimate will be completed in the summer of 2017. However, the September 2016 OCS Action Plan reflects the target publication date as the first quarter of fiscal year 2017.

In March 2015, we recommended that DOD revise existing guidance to detail the roles and responsibilities of the military departments in collecting OCS lessons learned. We also recommended that DOD direct the Navy and Air Force to include the military departments’ roles and responsibilities to collect OCS lessons learned in military department specific guidance on how the Navy, Marine Corps, and Air Force should integrate OCS. DOD concurred with these priority recommendations, and, according to senior DOD officials, the department is revising a DOD instruction and directive to address these recommendations.

In addition, the 2016 action plan identified foreign vendor vetting as a significant issue that should replace base access as a capability gap. DOD also noted that addressing this potential gap will likely require support from beyond the OCS community. Specifically, according to DOD officials, the OCS community of interest determined that the issue of vendor vetting is outside the responsibility and expertise of the OCS community. DOD established a separate working group on vendor vetting to address this issue. However, DOD has not developed comprehensive guidance on foreign vendor vetting, as we previously recommended.

In December 2015, we recommended that the department develop guidance that clarifies the conditions under which combatant commands should have a foreign vendor vetting process or cell in place to determine whether potential vendors actively support any terrorist, criminal, or other sanctioned organization. DOD concurred with this priority recommendation, stating that the Office of the Secretary of Defense in collaboration with the Joint Staff had established a joint working group to identify key stakeholders and develop DOD policy requiring combatant commands to develop processes for vetting foreign vendors. As of December 2016, the department was in the process of preparing a directive type memorandum to the military departments and combatant commands with additional information. According to officials, DOD continues to gain stakeholder support and assess and analyze vendor vetting issues, in order to develop comprehensive guidance, as we previously recommended.

Benefits Achieved by Implementing Our Recommendations

In February 2016, we recommended that the military departments revise their programming guidance to collect information on how contracted services will be used to meet requirements beyond the budget year. DOD partially concurred with this recommendation, citing challenges with accurately quantifying service contract requirements beyond the budget year. In its February 2016 Command Program Guidance Memorandum, the Army required all its organizations to provide contract service requirements data for fiscal years 2018-2022, including all current and planned requirements. The Army recognized that this will enable the Army and its commands to analyze contract service requirements and execution trends and allow the Army to prioritize growth or reductions to specific contract service requirements.

In March 2010, we recommended that DOD update its planning guidance to address the potential need for contractor support where appropriate. DOD concurred with this recommendation. In October 2012, the Chairman of the Joint Chiefs of Staff issued updated guidance on operational planning which contains information related to planning for contracted support. As a result of this change in guidance, senior DOD leaders will have a better understanding of how the department relies on contractors as it undertakes contingency operations, and will be more attuned to the potential risks of using contractors and better prepared to manage those risks.

GAO Contact

For additional information about this high-risk area, contact Timothy J. DiNapoli at (202) 512-4841 or dinapolit@gao.gov.

Related GAO Products

DOD Inventory of Contracted Services: Timely Decisions and Further Actions Needed to Address Long-Standing Issues. GAO-17-17. Washington, D.C.: October 31, 2016.

DOD Service Acquisition: Improved Use of Available Data Needed to Better Manage and Forecast Service Contract Requirements. GAO-16-119. Washington, D.C.: February 18, 2016.

Operational Contract Support: Additional Actions Needed to Manage, Account for, and Vet Defense Contractors in Africa. GAO-16-105. Washington, D.C.: December 17, 2015.

Defense Acquisition Workforce: Actions Needed to Guide Planning Efforts and Improve Workforce Capability. GAO-16-80. Washington, D.C.: December 14, 2015.

DOD Inventory of Contracted Services: Actions Needed to Help Ensure Inventory Data are Complete and Accurate. GAO-16-46. Washington, D.C.: November 18, 2015.

DOD Contract Services: Improvements Made to Planning and Implementation of Fiscal Controls. GAO-15-780. Washington, D.C.: September 30, 2015.

Strategic Sourcing: Opportunities Exist to Better Manage Information Technology Services Spending. GAO-15-549. Washington, D.C.: September 22, 2015.

Operational Contract Support: Actions Needed to Enhance the Collection, Integration, and Sharing of Lessons Learned. GAO-15-243. Washington, D.C.: March 16, 2015.

Contingency Contracting: Contractor Personnel Tracking System Needs Better Plans and Guidance. GAO-15-250. Washington, D.C.: February 18, 2015.

Enforcement of Tax Laws

Why Area Is High Risk

The Internal Revenue Service (IRS) continues to demonstrate top leadership support for improving tax compliance and addressing the tax gap. However, IRS’s capacity to implement new initiatives, carry out ongoing enforcement and taxpayer service programs, and combat identity theft (IDT) refund fraud under an uncertain budgetary environment remains a challenge. Enforcement of the tax laws helps fund the U.S. government. IRS enforcement collects revenue from noncompliant taxpayers and, perhaps more importantly, promotes voluntary compliance by giving taxpayers confidence that others are paying their fair share. In 2016, IRS estimated that the average annual gross tax gap—the difference between taxes owed and taxes paid on time—was $458 billion for tax years 2008-2010. IRS is able to recover a portion of the tax gap. In 2016, IRS estimated that it will eventually collect $52 billion of the tax gap through enforcement actions and late payments, leaving an annual estimated net tax gap of $406 billion for tax years 2008-2010.

In 2015, we expanded the enforcement of tax laws high-risk area to include IRS’s efforts to address tax refund fraud due to IDT, which occurs when an identity thief files a fraudulent tax return using a legitimate taxpayer’s identifying information and claims a refund. According to IRS, it estimates that at least $14.5 billion in IDT tax refund fraud was attempted in tax year 2015, of which it prevented at least $12.3 billion (85 percent). Of the amount attempted, IRS estimated that at least $2.2 billion (15 percent) was paid.

What GAO Found

As previously mentioned, IRS continues to demonstrate top leadership support for improving tax compliance and addressing the tax gap. For example, it continues to research the extent and causes of taxpayer noncompliance, and released an updated tax gap estimate in April 2016. The agency has also taken steps to address IDT refund fraud, such as increasing the number of staff and resources dedicated to combating this issue. IRS has now partially met the criterion for capacity with respect to combating IDT refund fraud. But as also cited above, IRS’s capacity to implement new initiatives, carry out ongoing enforcement and taxpayer service programs, and combat IDT refund fraud under an uncertain budgetary environment remains a challenge. Annual appropriations increased by $290 million between fiscal years 2015 ($10.9 billion) and 2016 ($11.2 billion), but remain about $900 million (about 7 percent) below fiscal year 2011 levels ($12.1 billion).

IRS continues to take actions toward meeting three other criteria for removal from our High-Risk List: developing a corrective action plan, monitoring, and demonstrating progress. For example, IRS’s strategic plan includes general approaches to make voluntary compliance easier for taxpayers. IRS also has a strategic plan that identifies refund fraud and IDT as challenges facing the nation’s tax system over the next several years. However, IRS has not yet implemented some of our recommendations highlighted in the 2015 high-risk report that could help it improve its corrective action plan, such as better measuring return-on- investment (ROI), better leveraging automated processes, and improving enforcement data. Also, for some compliance initiatives, such as those related to the Foreign Account Tax Compliance Act or the Patient Protection and Affordable Care Act (PPACA), IRS will need to continue to focus on measuring results and the effect of these initiatives on the tax gap.

While IRS has developed research efforts to assess its IDT defense effectiveness, the agency needs to do more to demonstrate progress. Due in part to substantial methodological changes used to estimate the amount of IDT refund fraud prevented, year over year comparisons in IRS’s estimates of IDT refund fraud prevented and paid are not comparable. In addition, the agency has yet to address key weaknesses in authenticating taxpayers. While IRS is taking steps to improve authentication, it will still be vulnerable until it completes and uses the results of its analysis of costs, benefits, and risk to inform decision- making.

Although more needs to be done, Congress and IRS have taken steps to implement a number of our recommendations that have resulted in benefits. For example, Congress passed legislation targeted at further strengthening tax law enforcement, including the Tax Equity and Fiscal Responsibility Act (TEFRA), which will improve the efficiency of partnership audits. Congress also passed legislation that will increase tax compliance through improved third-party reporting requirements, strengthened controls over higher education tax benefits to reduce inaccurate claims, and provided IRS with authority to correct errors related to the First-Time Home Buyer’s Credit. IRS and congressional actions based on our work in this area resulted in a total financial savings of approximately $7.8 billion between 2011 and 2016 and an estimated $12.5 billion in additional revenue over the next 8 years.

What Remains to Be Done

Enforcing Tax Laws

IRS should implement our open recommendations, especially those that focus on improving audit effectiveness, taxpayer services, and resource investment decision making and oversight. Specifically, IRS should: continue to develop and implement a long-term strategy to address operations amidst an uncertain budget environment; determine resource allocation strategies for its enforcement efforts such as large partnership audits; assess the performance of its information technology (IT) investments as well as improve its IT security and online web services; develop a strategy for better identifying partnership noncompliance and assessing the effectiveness of exam selection; strengthen referral programs so whistleblowers and other stakeholders can more easily submit information to IRS about tax noncompliance; and enhance taxpayer services by developing a long-term strategy for providing web-based services to taxpayers, and improve telephone service by establishing a customer service standard and identifying resources needed to achieve that standard.

IDT Refund Fraud

With regard to IDT refund fraud, IRS should implement our open recommendations, including identifying and addressing authentication risks associated with the Taxpayer Protection Program; estimating and documenting the costs, benefits, and risks of possible options for taxpayer authentication; and improving third-party partnership programs.

Congressional Actions Needed

Given that the tax gap has been a persistent issue, we have previously reported that reducing it will require targeted legislative actions, including the following:

Additional third-party information reporting. Taxpayers are much more likely to report their income accurately when the income is also reported to IRS by a third party. In 2008 and 2009, we suggested Congress consider expanding third-party information reporting to include payments for services to rental real estate owners and payments for services provided by corporations, respectively. In 2010, the Joint Committee on Taxation estimated that, for a 10-year period, tax compliance could potentially increase by $2.5 billion if third parties reported rental real estate service payments, and $3.4 billion if third parties reported service payments to corporations. Congress enacted a more expansive regime in 2010 covering reporting of payments for goods as well as services, and subsequently repealed these provisions.

Enhanced electronic filing. Requiring additional taxpayers to electronically file tax and information returns could help IRS improve compliance efficiently. Current law requires entities that file more than 250 returns during a year or partnerships with more than 100 partners to file electronically. In 2014, we suggested that Congress consider expanding the mandate for partnerships and corporations to electronically file their tax returns, as this could help IRS reduce return processing costs, select the most productive tax returns to examine, and examine fewer compliant taxpayers.

Increased electronic filing would also allow IRS to obtain timely, accurate data from a significant number of additional employers, and could further enhance the benefits IRS could obtain from the accelerated Wage and Tax Statement (W-2) deadline and prerefund W-2 matching. Treasury has requested authority to reduce the current 250-return threshold for employers electronically filing information returns. In 2014, we suggested that Congress consider authorizing Treasury to lower the threshold for electronic filing of W-2s from 250 returns annually to between 5 to 10 returns, as appropriate.

Math error authority. Providing IRS with correctible authority with appropriate safeguards to permit it to correct errors in cases where information provided by the taxpayer does not match information in government databases, among other things, could help IRS correct additional errors and avoid burdensome audits and taxpayer penalties. Congress enacted legislation in December 2015 that expands the circumstances in which IRS may use math error authority in some situations for selected refundable tax credits. While expanding math error authority is consistent with what we have previously suggested, we had suggested that math error authority be authorized on a broader basis with appropriate controls rather than on a piecemeal basis, and that controls may be needed to ensure that this authority is used properly. Our prior work identified potential controls, such as requiring IRS to report on its use of math error authority.

Paid preparer regulation. Establishing requirements for paid tax return preparers could improve the accuracy of the tax returns they prepare. In 2014, we suggested Congress consider granting IRS the authority to regulate paid tax preparers, if it agrees that significant paid preparer errors exist. The Joint Committee on Taxation estimated that legislation to regulate paid preparers would increase tax compliance by $135 million in revenue through fiscal year 2025.

Tax reform and simplification. A broader opportunity to address the tax gap involves simplifying the Internal Revenue Code, as complexity can confuse taxpayers and provide opportunities to hide willful noncompliance. Fundamental tax reform could result in a smaller tax gap if the new system has fewer tax preferences or complex tax code provisions; such reform could reduce IRS’s enforcement challenges and increase public confidence in the tax system. Short of fundamental reform, targeted simplification opportunities also exist. Amending the tax code to define terms more consistently across tax provisions could help taxpayers more easily understand and comply with their obligations and get the maximum tax benefit for their situations. For example, there are several provisions in the tax code benefiting taxpayers’ educational expenses, but the definition of what qualifies as a higher-education expense varies between these tax expenditures.

Additional Details on What GAO Found

Enforcement of Tax laws

Leadership Commitment

IRS has met the criterion of demonstrating a strong commitment to, and top leadership support for, improving tax compliance and addressing the tax gap. Some steps IRS has taken include the following: IRS adopted a new, more strategic approach to identifying and selecting budget program priorities. IRS prioritized a subset of its 19 strategic objectives for action and established six themes that represent its “future state” vision for tax administration. In the fiscal year 2017 congressional justification, IRS linked requests for increased funding to the themes and included details on how much would be funded by each appropriation account. IRS also identified enterprise goals to guide the IRS toward the future state. However, as of December 2016, IRS has yet to set targets for meeting the goals, but plans to have targets in place by June 2017.

IRS has continued to research the extent and causes of taxpayer noncompliance. We have consistently stressed the importance of IRS conducting tax compliance research.

IRS extended a program to encourage taxpayers to voluntarily report their previously undisclosed foreign accounts and assets. IRS has collected over $10 billion since this program was initiated in 2009, and has implemented some of our recommendations on better managing the program.

Capacity

IRS has not met the criterion of having the capacity to demonstrate progress toward improving compliance and addressing the tax gap. IRS’s ability to carry out ongoing enforcement programs and implement new initiatives to improve tax law enforcement, such as those required by PPACA, could be challenged under an uncertain budget environment. IRS is further challenged because it does not calculate ROI estimates for each enforcement program— information IRS could use to inform resource allocation decisions. IRS has also not determined how to best leverage automated processes and stakeholders such as whistleblowers.

Between fiscal years 2011 and 2016, IRS’s annual appropriations declined about $900 million. Likewise, staffing has declined: full-time equivalent staff members funded by annual appropriations declined by 12,000 between fiscal year 2011 and fiscal year 2016, a 13 percent reduction. At the same time, IRS’s enforcement performance has declined. For example, the individual examination (or audit) coverage rate declined by 20 percent from fiscal years 2013 to 2015—the most recent years available. Reductions in examinations can reduce revenue collected and may indirectly reduce voluntary compliance. These declines have also contributed to fluctuations in taxpayer service and longer wait times on the phones than taxpayers have historically experienced.

Action Plan

IRS partially meets the criterion for having a corrective action plan to improve tax compliance and address the tax gap. Specifically, IRS has a strategic plan that discusses general approaches to make voluntary compliance easier for taxpayers and to ensure taxes owed are paid. However, in some areas, the plan does not include specific tactics for improving compliance strategies. We have identified and made recommendations in several areas that could help IRS improve its corrective action plan. We subsequently designated several of these as priority recommendations, because if implemented, they could yield significant improvements to IRS’s operations.

Better measure return on investment. IRS’s budget environment and increased workload underscore the importance of IRS maximizing its resources in fulfilling its mission. By further refining direct revenue ROI measures of its enforcement programs, IRS could improve how it allocates resources across its programs. In 2012, we made various recommendations advising IRS to make better use of ROI measures, subject to other considerations of tax administration, such as minimizing compliance costs and ensuring equitable treatment across different groups of taxpayers.

IRS is taking steps to implement these priority recommendations. For example, IRS has made progress developing a methodology for estimating marginal ratios for a limited subset of cases within the correspondence examination program. IRS officials are working to apply this methodology more broadly; however, they expect this effort will be complex and time consuming. As of November 2016, officials do not have a timeline for full implementation. Until IRS takes into account some measure of revenue yield per dollar of cost when making allocation decisions, it may be missing opportunities to collect significant amounts of additional revenue.

Better leverage automated processes. Taking greater advantage of automated processes could enhance some IRS enforcement programs. For example, IRS does not routinely match the K-1 information return—on which partnerships and S corporations report income distributed to partners or shareholders—to income information on tax returns for partners and shareholders that are themselves partnerships and S corporations. Matching such information might be another tool for detecting noncompliance by these types of entities. In 2014, we recommended that IRS test the feasibility of such matching. IRS stated it would consider studying such testing if resources become available.

Likewise, continuing to enhance automated taxpayer services, such as web services, could result in lower-cost methods of interacting with taxpayers. In 2013, we made various recommendations for IRS to improve web services provided to taxpayers. IRS has made progress in addressing these priority recommendations but has not yet completed its efforts. IRS’s strategy has evolved from a singular focus on online services to a more comprehensive strategy of taxpayer interaction—the Future State Initiative—through all service channels.

We will continue to assess the new initiative as IRS continues its development.

Improve enforcement data. More complete enforcement data could help IRS better allocate resources across programs. For example, in 2014, we found that IRS did not know the full extent to which partnerships and S-corporations misreported income, and that IRS examinations and automated document matching have not been effective at finding most of the estimated misreported income. Further, IRS does not know how partnerships misreporting income affects taxes paid by partners. We recommended, among other things, that IRS (1) develop and implement a strategy to improve its information on the extent and nature of partnership misreporting, and (2) use the information to potentially improve how it selects partnership returns to examine. IRS agreed with these priority recommendations and developed a strategy, which will involve a multiyear examination effort to collect audit data from a representative, statistical sample of partnerships. Information from the full study will help IRS make better- informed data-based decisions on enforcement decisions. IRS officials also reported that in January 2016, IRS launched a research study on a subset of the population of partnerships with three or fewer individual partners. The results of this study could improve IRS’s ability to estimate the extent and nature of partnership misreporting, and the effectiveness of partnership examinations in detecting misreporting. However, as of December 2016, IRS had not fully implemented the strategy or the research study on small partnerships.

Monitoring

IRS partially meets the criterion of having a program to monitor corrective measures. As previously mentioned, IRS continues to research the extent of taxpayer noncompliance, and periodically estimates the voluntary compliance rate—the amount of tax for a given year that is paid on time. However, IRS does not adequately measure the impact of some specific compliance programs, such as the following:

Correspondence examinations. IRS does not have information to determine how its program of examining tax returns via correspondence affects the agency’s broader strategic goals for compliance, taxpayer burden, and cost. Thus, it is not possible to tell whether the program is performing better or worse from one year to the next. In 2014, we made several recommendations, including a priority recommendation, related to monitoring program performance. IRS officials provided documents intended to establish correspondence audit program objectives and measures, and link them to the overall IRS goals and objectives; but the objectives, measures, and links were not clear. As of January 2017, officials had no planned date by which to clearly document the objectives, measures, and links. They said they expect to describe the objectives in program guidance changes anticipated in the next 12 to 18 months.

Compliance Assurance Process. IRS does not fully assess the savings it achieves through its Compliance Assurance Process (CAP)—through which large corporate taxpayers and IRS agree on how to report tax issues before tax returns are filed. In 2013, we recommended that IRS track savings from CAP and develop a plan for reinvesting any savings to help insure the program is meeting its goals. Although IRS has taken steps to track savings by analyzing and comparing the workload inventory of account coordinators who handle CAP cases against team coordinators who handle non-CAP cases, it did not show how such a workload comparison demonstrated savings from CAP. IRS has also not developed a plan for reinvesting any savings. Without a plan for tracking savings and using the savings to increase audit coverage, IRS cannot be assured that the savings are effectively invested in either CAP or non-CAP cases with high compliance risk. As of November 2016, IRS is evaluating the CAP program to determine how it fits with IRS’s future vision for examinations, but it has no timetable for completing this evaluation. Also, IRS did not accept new CAP applications for 2016.

Demonstrated Progress

IRS has partially met the criterion of demonstrating progress in implementing corrective measures to improve compliance and reduce the tax gap. For example, IRS is taking steps to better leverage stakeholders by strengthening its nine public referrals programs—which enable individuals to submit information to IRS about tax noncompliance—but has not yet determined how to measure results for other programs intended to leverage third-party information to improve compliance. Specifically,

Public Referral Programs. Public referral programs are an important piece of IRS’s overall enforcement strategy and can help reduce the tax gap. We made several recommendations to IRS, including that it establish a coordination mechanism to communicate across the multiple referral programs, develop an online referral submission process, streamline the review process, and improve external communication. IRS has taken some actions to establish a mechanism to coordinate on a plan and timeline for developing a consolidated, online referral submission, which is also a priority recommendation. For example, IRS established a cross-functional team in February 2016 to conduct a comprehensive review of IRS’s referral programs. In November 2016, the cross-functional team proposed creating an online submission referral application to simplify access and filing of information referrals by the public. The team also requested information technology resources for fiscal year 2019 to develop an online system which it said could potentially replace four separate referral forms, filter out incomplete referrals, and electronically route referrals for further IRS action. IRS assessed options for consolidating all forms for the various referral programs and determined that a consolidated single form was not feasible at this time due to the technical nature and complexity of the various referral types. As of December 2016, IRS said it will consider further consolidation of the referral programs once the online application is in place.

Whistleblower Office. We also identified key problems specific to the whistleblower program, which is the largest of IRS’s nine referral programs. For example, few large awards have been paid, claims take years to process, and communication with whistleblowers is limited. IRS agreed with our 10 recommendations to strengthen the whistleblower program, has already implemented several of them, and is in the process of implementing the rest. Until IRS completes these actions, it may be missing opportunities to assist the public, collect billions in uncollected taxes owed, and leverage resources to streamline processes, which could help it to better coordinate and identify possible efficiencies, as well as better manage fragmentation and overlap among its referral programs.

Efforts to Encourage Voluntary Compliance. Also, as previously mentioned, IRS has collected more than $10 billion through its program to encourage taxpayers to voluntarily report their previously undisclosed foreign accounts and assets. However, for some initiatives—such as those related to the Foreign Account Tax Compliance Act or using payment data from credit card companies to improve compliance among small businesses—IRS is still determining how to best measure results, including the effect on the tax gap.

Refund Fraud Related to Identity Theft

Leadership Commitment

IRS has met the criterion for demonstrating leadership commitment for combating IDT refund fraud. The agency has taken steps to address IDT refund fraud, including recognizing the challenge of IDT refund fraud in its fiscal year 2014-2017 strategic plan, and expanding its automated fraud filters to detect IDT and prevent fraudulent refunds. The IRS Commissioner has testified numerous times about the challenges from IDT refund fraud and the agency’s progress on the issue. Further, the IRS Commissioner convened a Security Summit in March 2015 to bring together representatives of the tax preparation and software industry and state tax administrators to launch a collaborative effort to combat IDT refund fraud. According to IRS officials, this collaboration has resulted in enhanced authentication procedures and data sharing. IRS’s Identity Theft Tax Refund Fraud Information Sharing and Analysis Center—where IRS, states, and industry can share information—is intended to become operational at the start of the 2017 Filing Season in January.

Capacity

IRS has partially met the criterion for having the capacity to combat IDT refund fraud. In fiscal year 2016, IRS reported that it staffed more than 4,000 full-time equivalents (FTE) and spent about $516 million on all refund fraud and IDT activities. Under the Consolidated Appropriations Act 2016, IRS received an additional $290 million to improve customer service, IDT identification and prevention, and cybersecurity efforts. The agency requested an additional $90 million and an additional 491 FTEs for fiscal year 2017 to help prevent IDT refund fraud and reduce other improper payments. At the same time, IRS’s ability to combat IDT refund fraud will continue to be challenged by “adaptive adversaries” that continuously change their methods as IRS improves its defenses. For example, recent schemes have involved fraudsters targeting sources of personal and financial information—such as payroll providers and IRS’s Get Transcript service—in order to file returns that look like past returns filed by legitimate taxpayers. IRS is also constrained in its ability to combat IDT refund fraud because it must balance the need to prevent fraud against increasing the burden on legitimate taxpayers filing their taxes.

Action Plan

IRS has met the criterion for having an action plan to address IDT refund fraud. IRS has a strategic plan that identifies refund fraud and IDT as major challenges facing the nation’s tax system over the next several years. IRS has also identified several strategic objectives relevant to its efforts to combat IDT, including balancing the speed of refund delivery with the need to verify taxpayers’ identities; and using third-party data, risk modeling, and a historical view of taxpayer interactions to prevent fraud before issuing refunds. In addition, IRS developed a more detailed Refund Fraud & IDT Strategy in January 2015 and updated it in January 2016. The strategy identifies and assesses the costs and benefits of actions IRS can take to combat IDT refund fraud (both with and without legislative change or a significant change in taxpayer expectations). The strategy has not been updated to reflect new, earlier W-2 filing deadlines enacted in December 2015 as part of the 2016 Consolidated Appropriations Act. However, officials told us that the agency is working with the Social Security Administration to accommodate earlier W-2 data, and plans to use the data, when available, to match to information reported on tax returns. According to IRS, prerefund matching using earlier W-2 data would potentially save a substantial part of the billions of taxpayer dollars currently lost to fraudsters.

Monitoring

IRS has partially met the criterion of having a program to monitor corrective measures. IRS’s Identity Theft Taxonomy (Taxonomy) is a research-based effort to provide information to internal and external stakeholders about the effectiveness of IRS’s IDT defenses and help IRS identify IDT trends and evolving risks. While IRS has implemented a new methodology to improve its 2014 estimates in response to our past recommendations, additional action is needed. We will analyze the 2015 Taxonomy estimates to determine the extent to which our recommendations have been implemented.

Demonstrated Progress

IRS has partially met the criterion for demonstrating progress in implementing corrective measures to address IDT refund fraud. IRS has developed tools and programs to further detect and prevent IDT refund fraud. IRS has also enhanced its authentication efforts for some online services, such as the Get Transcript application. However, IRS could further demonstrate progress by, for example, implementing our previous priority recommendation related to authentication weaknesses. While IRS has taken steps to address this recommendation, the agency has not used cost-benefit-risk analysis to select which authentication tools to use for certain taxpayer interactions. Without analysis of costs, benefits, and risks, IRS and Congress may not have quantitative information that could inform decisions about whether and how much to invest in the various authentication options.

While IRS has developed research efforts to assess the effectiveness of its IDT defenses, it is unclear whether yearly changes in the amount of estimated IDT refund fraud prevented and paid are due to: methodological changes (i.e., using a different data source); overall changes in fraud patterns (i.e., an increase or decrease in improvements in IRS IDT defenses; or fraudsters’ ability to file returns using schemes IRS has not yet learned to detect.

Specifically, IRS’s 2014 estimates cannot be compared to 2013 estimates because of substantial methodology changes that better reflect new IDT refund fraud schemes and improve the accuracy of its estimates, according to IRS officials.

Benefits Achieved by Implementing our Recommendations

Improving Efficiency of Partnership Audits. Congress enacted legislation that alters the Tax Equity and Fiscal Responsibility Act (TEFRA) audit procedures, as we suggested in September 2014. The Bipartisan Budget Act of 2015, which was enacted in November 2015, repeals TEFRA audit procedures and mandates audit procedures that require partnerships with more than 100 partners to pay audit adjustments at the partnership level, among other changes. The legislative changes enacted to TEFRA we suggested could help with the time constraints of large partnership audits as well as reduce the resource demands of those audits. The Joint Committee on Taxation estimates this should raise $9.3 billion in additional revenue from fiscal years 2019 to 2025.

Increasing Tax Compliance through Third-Party Reporting. Our past work underscored that data reported to IRS by third parties about taxpayers’ income is a powerful tool to improve taxpayer compliance. In response, Congress passed legislation in 2008—effective in 2011, which required banks and others to report income that merchants received through certain payment methods such as credit cards or third-party networks like PayPal. IRS compares this information to the merchants’ tax returns to help verify taxpayer compliance, which the Joint Committee on Taxation estimated would increase tax compliance by $3.9 billion between 2013 and 2016.

Improving Tax Reporting on the Sale of Securities. We reported that many taxpayers misreported their capital gains or losses from the sale of securities. This often happened because taxpayers failed to accurately report the cost of the securities they sold. We suggested that Congress require brokers to report to both taxpayers and IRS the adjusted cost of the securities sold by taxpayers. In response, Congress enacted this requirement in 2008, which the Joint Committee on Taxation estimated would increase tax compliance by $3.2 billion between 2012 and 2016.

Reporting Additional Mortgage Debt Information to Increase Tax Compliance. In 2015, Congress enacted the Surface Transportation and Veterans Health Care Choice Improvement Act. Section 2003 of the act requires taxpayers receiving mortgage interest payments to report the origination date of the mortgage, the amount of outstanding principal at the beginning of the calendar year, and the property’s address. In response to the legislation, IRS updated Form 1098 Mortgage Interest Statement for 2016, which is available for the 2017 filing season. The Joint Committee on Taxation estimated that this change would increase tax compliance by $1.8 billion between 2015 and 2025.

Strengthening Controls Over Higher Education Tax Benefits. Congress enacted three provisions in 2015 to strengthen controls over higher education tax benefits to reduce inaccurate claims. These provisions: 1) require educational institutions to report only the aggregate amount of qualified tuition and related expenses actually paid to the educational institution during the calendar year; 2) require taxpayers to receive a completed Form 1098-T to claim a credit or deduction for education expenses for tax years beginning after the date of enactment; and 3) require educational institutions to provide their employer identification number on the Form 1098-T, and taxpayers claiming a credit for qualified tuition and educational expenses to provide this employer identification number. The Joint Committee on Taxation estimated that these changes would increase tax compliance by $2 million, $576 million, and $837 million, respectively, between fiscal years 2016 and 2025.

Reducing Funding Requests by Modifying Cost Calculation of New Hires. Prior to the fiscal year 2015 budget request, IRS assumed all new staff requested for new initiatives in the budget request would be hired at the start of the fiscal year, although actual hiring patterns indicated new staff were brought on throughout the fiscal year and primarily in the 3rd and 4th quarters. As a result, IRS modified its calculation for new hires using a later estimated hire date. In the fiscal year 2015 and 2016 request, the estimated hire date was January 1st—the end of the 1st quarter. In the fiscal year 2017 request, the estimated hire date was April 1st—the start of the 3rd quarter. As a result, the funding requests for fiscal years 2015, 2016 and 2017 were approximately $518 million less than if IRS used its prior methodology for calculating FTE costs associated with new initiatives.

Expanding Math Error Authority to Enforce First-Time Homebuyer Credit (FTHBC) Repayment Provision. In 2009, we found that IRS lacked math error authority, which must be provided by statute, to automatically correct tax returns on which taxpayers claimed the 2008 version of the FTHBC but did not repay it as required. We suggested that IRS be granted math error authority to enforce the FTHBC repayment provision. In response, Congress enacted legislation in 2009 granting IRS math error authority for this purpose, which we estimate has increased tax compliance by approximately $206 million between 2011 and 2014, after accounting for IRS costs.

Redirecting Resources to Improve Taxpayer Services. In December 2012, we reported that IRS had made incremental efficiency gains in delivering taxpayer services, but the agency needed to do more to combat the imbalance between taxpayer demand for services and available resources. IRS acknowledged it needed to adjust its taxpayer service delivery because the agency lacked sufficient resources to answer every telephone call and serve every taxpayer who visits a walk-in site. Consistent with our finding that a more dramatic revision in providing service was necessary, IRS implemented six service initiatives in fiscal year 2014 that shifted taxpayers from using telephone and walk-in services to more cost- effective self-service options. As a result of these initiatives, IRS realized about $50.6 million of IRS resources in fiscal year 2016 dollars.

Identifying Taxpayers Using Quiet Disclosures to Circumvent Taxes. In March 2016, IRS officials reported completing research to determine and implement the best option for identifying and pursuing potential quiet disclosures, as we recommended in March 2013. IRS reported that it identified more than 350 cases using its new methodology and as of October 2016 had completed examinations of 179 taxpayers, resulting in approximately $9.1 million in additional tax assessments.

Using Data to Improve Taxpayer Services. IRS officials analyzed correspondence response timeliness data through the end of fiscal year 2014 and found that delays were continuing and more improvements were needed, including further revisions to notices and a revised automated recorded telephone message for taxpayers calling about the status of an audit. By analyzing the data as we recommended in June 2014, and using that data to change outgoing recorded messages starting in January 2015, IRS is better able to improve taxpayer service, reduce the need for taxpayer calls, and more efficiently use IRS resources.

Taking Steps to Improve Claims Process and Communications to Encourage Tax Whistleblowers. Our 2015 review of the IRS whistleblower program resulted in ten recommendations. IRS concurred with these recommendations and has already implemented several of them. Both whistleblowers and IRS stand to benefit greatly as a result of actions IRS has taken such as streamlining the intake and initial review process of whistleblower claims and improving communications. For example, having a more streamlined staffing strategy will allow the Whistleblower Office to review more claims in a timely manner and get information to examiners more quickly to help IRS collect additional revenue. Also, communicating relevant information earlier to whistleblowers will help address a common complaint of the whistleblower community about the lack of timely communication from the Whistleblower Office and could encourage more whistleblowers to come forward with information.

Using Employer Wage Data to Prevent Identity Theft Fraud. In 2014, we found that fraudsters take advantage of IRS’s “look back” compliance model, where the agency issues refunds before completing all compliance checks. If IRS matched employer wage data to tax returns earlier, before issuing refunds, it could help prevent fraud. We recommended that IRS assess the costs and benefits of accelerating W-2 deadlines and provide this information to Congress. Based on our review, in September 2015, IRS presented Congress with a document detailing the costs and benefits of W-2 acceleration. The document discusses the IRS systems and work processes that will need to be adjusted to accommodate earlier, prerefund matching of W-2s, the time frames for when these changes could be made; potential impacts on taxpayers, IRS, other parties; and what other changes will be needed (such as delaying refunds) to ensure IRS can match tax returns to W-2 data before issuing refunds. Congress accelerated W-2 filing deadlines to January 31 as part of the 2016 Consolidated Appropriations Act. This change will provide IRS with earlier access to W-2 data. According to IRS, prerefund matching would potentially save a substantial part of the billions of taxpayer dollars currently lost to fraudsters.

Improving IRS’s estimates of IDT refund fraud. Based on our review, in August 2014 IRS changed its methodology for counting fraudulent IDT refunds paid, which increased the estimate of IDT refunds paid in 2013 by about $1 billion (from its original estimate of $4.8 billion to $5.8 billion).The research IRS used to develop these refund fraud estimates is important as it helps IRS better understand how IDT refund fraud is bypassing agency defenses to improve IDT controls. In June of 2016, we made additional recommendations that IRS improve its IDT cost estimates by removing refund thresholds and using return-level data where available.

Improving the design and implementation of exempt organization examination selection. The Exempt Organizations Exam unit within IRS completed an action plan for the process of reviewing and updating its Internal Revenue Manual sections on an ongoing basis, as we recommended in July 2015. Implementation of the plan began at the end of 2015. Updated and accurate procedures help ensure that employees follow correct procedures and consistently administer tax laws.

GAO Contact

For additional information about this high-risk area, contact James R. McTigue, Jr., or Jessica Lucas-Judy at 202-512-9110 or mctiguej@gao.gov or lucasjudyj@gao.gov.

Related GAO Products

Refundable Tax Credits: Comprehensive Compliance Strategy and Expanded Use of Data Could Strengthen IRS’s Efforts to Address Noncompliance. GAO-16-475. Washington, D.C.: May 27, 2016.

GAO Series of Reports on Identity Theft: Identity Theft and Tax Fraud: IRS Needs to Update Its Risk Assessment for the Taxpayer Protection Program. GAO-16-508; Washington, D.C.: May 24, 2016; Identity Theft and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, but IRS Lacks an Estimate of Costs, Benefits and Risks. GAO-15-119. Washington, D.C.: January 20, 2015; and Identity Theft: Additional Actions Could Help IRS Combat the Large, Evolving Threat of Refund Fraud. GAO-14-633. Washington, D.C.: August 20, 2014.

IRS Referral Programs: Opportunities Exist to Strengthen Controls and Increase Coordination across Overlapping Programs, GAO-16-155. Washington, D.C.: February 23, 2016. 2015 Tax Filing Season: Deteriorating Taxpayer Service Underscores Need for a Comprehensive Strategy and Process Efficiencies. GAO-16-151. Washington, D.C.: December 16, 2015.

IRS Whistleblower Program: Billions Collected, but Timeliness and Communication Concerns May Discourage Whistleblowers. GAO-16-20. Washington, D.C.: October 29, 2015.

Small Businesses: IRS Considers Taxpayer Burden in Tax Administration, but Needs a Plan to Evaluate the Use of Payment Card Information for Compliance Efforts. GAO-15-513. Washington, D.C.: June 30, 2015.

Large Partnerships: With Growing Number of Partnerships, IRS Needs to Improve Audit Efficiency. GAO-14-732. Washington, D.C.: September 18, 2014.

IRS Correspondence Audits: Better Management Could Improve Tax Compliance and Reduce Taxpayer Burden. GAO-14-479. Washington, D.C.: June 5, 2014.

Partnerships and S Corporations: IRS Needs to Improve Information to Address Tax Noncompliance. GAO-14-453. Washington, D.C.: May 14, 2014.

Medicare Program

Current State of the Medicare Program

Overview of Medicare’s Challenges

We designated Medicare as a high-risk program in 1990 due to its size, complexity, and susceptibility to mismanagement and improper payments. Addressing Medicare’s short-term and long-term challenges is vitally important, not only for the millions of aged and disabled individuals who depend upon the program for health care coverage, but also for the families of these individuals who might otherwise bear the cost of their health care, the taxpayers who finance the program, and the health care providers who depend upon receiving fair compensation for their services. The aging of the population, coupled with the growth in per capita health care costs, will magnify these challenges over time. Therefore, continued close attention will be necessary to ensure that Medicare is sustainable for generations to come.

Ongoing Challenges

Medicare continues to pose challenges to the federal government for many of the same reasons we designated it a high-risk program. Specifically, Medicare’s substantial size and scope result in the current program having wide ranging effects on beneficiaries, the health care sector, and the overall U.S. economy. In 2016, Medicare was projected to spend $696 billion and provide health care coverage to over 57 million beneficiaries. Medicare pays about 60 percent of the health care costs of beneficiaries enrolled in fee-for-service (FFS) who do not reside in institutions. Over 1 million health care providers, contractors, and suppliers—including private health plans, physicians, hospitals, skilled nursing facilities, durable medical equipment (DME) suppliers, ambulance providers, and many others—receive payments from Medicare. Every year, Medicare pays over a billion claims submitted by these health care providers. Consequently, Medicare must be closely monitored because even relatively small changes can have large short-term effects in the aggregate. For example, Medicare provider payment rates that are set too high unnecessarily financially burden beneficiaries—through higher premiums and cost sharing—taxpayers, and the federal budget. Payment rates that are set too low may diminish providers’ willingness to treat Medicare beneficiaries and adversely affect their access to appropriate, high-quality health care.

Medicare also has an outsize effect on the federal budget, which creates challenges when the federal government is determining how to prioritize its spending. The program’s expenditures currently account for about 3.6 percent of the country’s gross domestic product (GDP).The Congressional Budget Office (CBO) projects that in fiscal year 2016, Medicare outlays will total more than is projected to be spent on defense ($579 billion) and almost double federal spending on Medicaid ($365 billion). Medicare spending will account for approximately 17.8 percent of the approximately $3.9 trillion in federal outlays.

Long-Term Challenges

Medicare also poses substantial long-term financial challenges for the federal government. Program spending is expected to increase significantly over time as the number of beneficiaries grows and per capita health care costs increase. CBO projects that, in just 10 years (in 2026) under current law, Medicare spending will reach almost $1.3 trillion. The Medicare Trustees 2016 report stated that, under current law, Medicare’s share of GDP would rise to 5.6 percent by 2040. As Medicare spending grows disproportionately to other federal spending and the economy, it will put increasing pressure on the federal budget and tend to squeeze out spending for other programs.

However, the Trustees have stated that Medicare spending projections, especially those stretching out over decades, are highly uncertain and cautioned that future Medicare spending could be substantially higher than projected. In their 2016 report, they noted that some Medicare cost- reduction provisions may be difficult to sustain. For example, one set of Medicare provisions affecting many types of health care providers reduces the annual payment rate updates to account for economy-wide productivity growth. However, the productivity growth rates historically achieved by health care providers have been lower than the economy- wide rates. If health care providers do not realize sufficiently high productivity growth and these cost-reduction measures are not sustained, Medicare projected spending could rise to 6.2 percent of GDP in 2040 and 9.1 percent in 2090, according to the Trustees.

Another uncertainty is whether advances in medical technology will tend to slow or accelerate Medicare spending growth. Technological advances may enhance the ability of providers to diagnose, treat, or prevent health problems. Examples include new drugs, devices, procedures, and therapies, as well as new applications of existing technologies. Although new technologies may decrease or increase health care costs, in 2013 we reported that technological change had likely been the dominant cause (accounting for 36 to 55 percent) of the increases in overall U.S. health care per capita spending over the past several decades. It should be noted, however, that a complete assessment of health care spending for new technologies should also consider the associated value for individuals, often measured by improved health functioning, increased life expectancy, or improved economic productivity.

In the past few years, growth in Medicare spending has slowed, as overall health care spending has also slowed. Analysts debate whether this slowdown can be attributed to transitory effects, such as the recent economic turndown, or broader changes in the health care system that may be longer lasting. Nonetheless, Medicare’s historical trends, the aging of the population, and the uncertainties associated with recent reforms and the effects of advances in medical technology all underscore the need for continued efforts to moderate spending growth while ensuring that beneficiaries have appropriate access to high-quality health care. Achieving these goals will likely remain an important challenge and require a continued focus on the Medicare program.

Highlights of Recent Key Legislation and Significant Reform Efforts

In March 2010, the Patient Protection and Affordable Care Act (PPACA) was enacted, which, among other things, made numerous statutory changes to Medicare. CBO estimated that PPACA would reduce Medicare spending by about $400 billion over 10 years from fiscal year 2010 to fiscal year 2019. Major savings were expected from several actions, including constraining annual payment updates to certain Medicare providers, tying Medicare Advantage (MA)—Medicare’s private plan alternative to the traditional Medicare FFS program—maximum payment amounts to near or below FFS spending, reducing payments to hospitals that serve a large number of low-income patients—reflecting the expectation that PPACA’s health insurance expansion provisions would result in far fewer uninsured hospital patients—and modifying the high- income threshold for adjusting beneficiary Part B premiums, among other changes.

Some PPACA provisions sought to establish financial incentives for providers to increase the efficiency and quality of Medicare services, or to test new ways of achieving those goals. For example, PPACA required the establishment of a national, voluntary pilot program to bundle payments for physician, hospital, and post-acute care services to improve patient care and reduce spending. Another provision modified payments to hospitals that experience patient readmissions related to certain potentially preventable conditions. Certain PPACA payment changes seek to provide a strong financial incentive for health care providers to enhance productivity, improve efficiency, or otherwise reduce their costs per service. Notably, several of PPACA’s changes seek to implement value-based purchasing of health care and transform the program into one that encourages efficiency and quality, instead of simply compensating providers for the volume of health care services.

In April 2015, the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) was enacted, bringing additional changes to the way Medicare reimburses physicians, among other changes to Medicare. MACRA repealed the sustainable growth rate (SGR) system—which was first implemented in 1998 to moderate spending for physician services—and established a new payment framework to encourage efficiency in the provision of health care and to reward health care providers for higher quality of care. Specifically, MACRA created a Merit-based Incentive Payment System (MIPS) that will be used to increase or decrease certain physicians’ payments based on their performance. Under MIPS, the Centers for Medicare & Medicaid Services (CMS) will assess physician performance in four categories: quality; cost; clinical practice improvement activities; and advancing care information through the meaningful use of electronic health records technology. MACRA also included provisions to incentivize Medicare providers to participate in alternative payment models, such as qualifying accountable care organizations. In addition to reforming physician payment, MACRA made several other changes to Medicare, including making income-related adjustments to premiums in Medicare Parts B and D.

It is too early to tell the extent to which these changes in PPACA and MACRA may help constrain Medicare spending over the long run, as the changes have only recently been implemented, or their implementation is ongoing. Moreover, future legislation could modify payment reforms, such as those established by PPACA and MACRA, and affect their impact on program spending. In addition, uncertainty about PPACA’s and MACRA’s effects on spending exists because future spending may also depend on changes in the rest of the health care system. For example, provisions of PPACA are designed to increase the number of individuals with health insurance and reduce the number of uninsured. In 2013, we found that Medicare beneficiaries who had continuous health insurance coverage before enrollment in Medicare reported being in better health in the 6 years after Medicare enrollment and, in the first year of Medicare coverage, had significantly lower Medicare spending.

Additional spending uncertainty stems from concerns raised by the Medicare Trustees, CBO, and the Office of the Actuary (OACT) about whether some of the Medicare cost-containment mechanisms included in PPACA can be sustained over the long term, such as the provider productivity payment adjustment, and physician payment updates and incentives included in MACRA. For example, additional payments for alternative payment models provided under MACRA will expire in 2025, and physician payment update amounts, which are not tied to economic conditions, are not expected to keep pace with average physician cost increases. The Medicare Trustees report for 2016 projected that, beginning in 2048, physician payment rates will be lower than they would have been under the SGR formula and will continue to be lower after that. CBO and OACT both produced alternative projections of future spending that assume that certain cost-containment mechanisms are not fully maintained over the long term.

Our Work Suggests the Need for Continued Attention in Five Principal Areas

Payments and Provider Incentives in Traditional Medicare

Medicare is transitioning from a payment system that largely rewards the volume and complexity of health care services provided to a system that explicitly rewards quality and efficiency. Many of the broad-based reforms being implemented to Medicare’s payment systems in the traditional FFS program have introduced financial incentives into payment structures to explicitly reward quality and efficiency, such as creating the Merit-based Incentive Payment System discussed previously. To help ensure that physicians are able to respond to these new incentives and are able to improve their performance, CMS recently began to provide more frequent feedback to physicians on their performance, as we recommended, to help them identify opportunities to reduce costs and pinpoint high-cost beneficiaries who may benefit from enhanced care coordination. MACRA also required that CMS consider physician and other providers’ improvement and their opportunity for continued improvement when establishing benchmarks for Merit-based Incentive Payment System performance measures. As CMS progresses toward fully implementing its value-based payment system, it will be important for the agency to use reliable quality and cost measures and methodological approaches that maximize the number of physicians for whom value can be determined.

As CMS implements these broad-based payment reforms, we have identified additional areas where continued monitoring of payment methods is warranted to encourage efficiency and reduce the risk of overspending.

Payment methods for cancer hospitals. Currently, 11 cancer hospitals, designated in the 1980s and 1990s, that meet certain statutory criteria are exempt from Medicare’s inpatient prospective payment system (PPS) and are also receiving payment adjustments under the outpatient PPS. The Medicare PPS introduced better control over program spending and provided hospitals with an incentive for efficient resource use. Yet for decades, as required by law, Medicare has paid these cancer hospitals differently than PPS hospitals in recognition of their specialized focus and concerns that reimbursements under PPS would be inadequate to cover costs for the types of care provided at cancer hospitals. This has remained the case even as the inpatient PPS methodology has been refined to better account for variation in the severity and complexity of beneficiaries and the resource intensity of hospital care.

The 11 cancer hospitals currently exempted from the inpatient PPS and receiving payment adjustments under the outpatient PPS are reimbursed largely based on their reported costs and as such have little incentive for containing costs. In 2012, we estimated that PPS-exempt cancer hospitals received, on average, about 42 percent more in Medicare inpatient payments per discharge than what Medicare would have paid a local PPS teaching hospital to treat cancer beneficiaries with the same level of complexity. Similarly, Medicare outpatient payment adjustments to these cancer hospitals resulted in overall payments that were about 37 percent higher, on average, than payments Medicare would have made to PPS teaching hospitals for the same set of services. Had beneficiaries of PPS-exempt cancer hospitals received services at nearby PPS teaching hospitals in 2012, the Medicare program may have saved almost $500 million. We suggested that Congress require Medicare to pay PPS- exempt hospitals as it pays PPS teaching hospitals, or provide the Secretary of Health and Human Services the authority to otherwise modify how Medicare pays these PPS-exempt hospitals. To generate cost savings, we also suggested that Congress provide that all forgone outpatient payment adjustment amounts be returned to the Supplementary Medical Insurance Trust Fund, which funds Medicare Part B services, such as physician visits, and Medicare Part D services, such as prescription drugs. The 21st Century Cures Act, enacted in December 2016, slightly reduces the additional payments cancer hospitals receive for outpatient services and returns savings to the Supplementary Medical Insurance Trust Fund. However, the law keeps in place the payment system for outpatient services that differs from how Medicare pays PPS teaching hospitals. Moreover, the law does not change how PPS-exempt cancer hospitals are paid for inpatient services. Until Medicare pays PPS-exempt cancer hospitals in a way that encourages efficiency, rather than largely on the basis of reported costs, Medicare remains at risk for overspending.

Hospital-physician consolidation. Because Medicare often pays more for services when they are performed in a hospital outpatient department than when they are performed in a physician’s office, hospitals may have an incentive to acquire physician practices, hire physicians as salaried employees, or both—financial arrangements commonly referred to as vertical consolidations. After hospitals and physicians vertically consolidate, the same services that were once reimbursed by Medicare at a lower total payment rate could be classified as hospital outpatient department services and reimbursed at a higher rate. In our work, we found that the number of vertically consolidated hospitals increased by about 20 percent from 2007 through 2013 and the number of physicians in these arrangements nearly doubled. Some have questioned whether or to what extent vertical consolidations have contributed to the rapid rise in Medicare expenditures for hospital outpatient departments, which increased by more than eight percent annually from 2007 through 2013. We found that the percentage of evaluation and management (E/M) office visits performed in hospital outpatient departments was generally higher in counties with higher levels of vertical consolidation.

The rise in vertical consolidation exacerbates a financial vulnerability in Medicare’s payment policy—paying different rates for the same service, depending on where the service is performed. Estimates from entities such as the Bipartisan Policy Center and the Medicare Payment Advisory Commission suggest that equalizing payments rates for E/M office visits could save nearly $1 billion to $2 billion a year for the Medicare program and beneficiaries. We suggested that Congress direct the Secretary of Health and Human Services to equalize payment rates between settings for E/M office visits and other services as appropriate. Until the disparity in payment rates for E/M office visits is addressed, Medicare could be expending more resources than necessary.

Payments for hospital uncompensated care. Hospital uncompensated care costs are a long-standing concern because of their potential to weaken hospitals’ financial stability and thereby hospitals’ abilities to serve their communities. Both Medicare and Medicaid provide funds to help offset hospitals’ uncompensated care costs. In fiscal year 2014, Medicare made over $14 billion in payments to hospitals for uncompensated care through a variety of payment types, including a relatively new type of payment called Medicare Uncompensated Care (UC) payments. We have raised concerns that Medicare UC payments are largely based on hospitals’ Medicaid workload rather than hospitals’ actual uncompensated care costs, which can result in poor alignment between payments and uncompensated care costs. This may be particularly true in states that have expanded Medicaid—that is, coverage expanded through PPACA to nearly all adults with incomes up to 133 percent of the poverty level—and therefore where lower uncompensated care costs are expected.

In an April 2016 proposed rule, CMS announced that it is considering making hospitals’ actual uncompensated care costs the sole basis for making Medicare UC payments by fiscal year 2020. Another concern, however, is that when making Medicare UC payments, CMS does not account for payments hospitals received from Medicaid, even though the bulk of Medicare’s payments are made on the basis of Medicaid workloads, for which hospitals may have also received Medicaid payments. We recommended that CMS improve the alignment of Medicare UC payments with hospital uncompensated care costs and account for Medicaid payments received when making Medicare UC payments to individual hospitals. HHS concurred with these recommendations and in its final rule indicated that it planned to implement them beginning in fiscal year 2021 to allow time for hospitals to collect and report reliable uncompensated care cost data.

Physician self-referral. Our work has identified opportunities for CMS to introduce additional payment method refinements and controls in Medicare FFS to encourage appropriate use of services. For example, self-referral—when a provider refers patients to entities in which the provider or the provider’s family members have a financial interest— continues to be a concern in relation to the rapid growth of Medicare FFS expenditures. In recent years, we found that certain services—including diagnostic imaging, certain cancer treatments, and diagnostic pathology services—performed by self-referring groups have increased dramatically. For example, from 2004 through 2010, the number of self- referred magnetic resonance imaging (MRI) services increased by more than 80 percent; in comparison, the number of non-self-referred MRI services increased by 12 percent during this time period. We have recommended that CMS determine and implement an approach to ensure providers appropriately self-refer for advanced imaging services. HHS did not concur with this recommendation but is in the process of establishing an appropriate use criteria program for advanced imaging services that would apply to all physicians—including those that self-refer—and which, depending on implementation, could address our recommendation. CMS has yet to take definitive steps to monitor physician self-referral for certain cancer treatment and diagnostic pathology services, and until it does so, the Medicare FFS program and its beneficiaries will continue to be at risk for these rapidly increasing expenditures.

High-expenditure Part B drugs. In 2014, Medicare spent over $24 billion on drugs covered under Part B. Part B drugs are those commonly administered by a physician or under a physician’s close supervision, such as vaccines or some oral cancer drugs. The vast majority of these expenditures ($21 billion) were based on the drug’s average sales price (ASP), the amount physicians and other purchasers pay manufacturers for the drug, which CMS calculates based on sales data reported by drug manufacturers. Ensuring the accuracy of the data on which CMS bases payment rates for part B ASP drugs is important given Medicare’s substantial expenditures for these drugs and given beneficiaries’ general responsibility to cover 20 percent of Medicare’s payment for these drugs via cost-sharing requirements, which amounted to about $4 billion in 2014. We found, however, that CMS is not able to assess the accuracy of all sales price data because not all manufacturers are required to submit these data. Further, while CMS conducts certain checks to assess the completeness of the sales data it does receive, the agency does not verify the accuracy of the data by tracing it to source documents, such as sales invoices. We suggested that Congress require all manufacturers of Part B drugs to submit sales price data to CMS and to ensure CMS has the authority to request source documentation and periodically validate such data.

Additionally, the ASP does not account for drug coupon discounts that manufacturers provide to privately insured patients, which reduce the effective market price for these drugs. In our work, we found that the ASP for several part B drugs with drug coupon discounts exceeded the effective market price that manufacturers ultimately received. As a result, Medicare may be paying more than necessary for these drugs. Regular monitoring of the implications of coupon programs for Medicare’s payment methodology for part B drugs is needed as CMS works to propose an alternative payment system. CMS, however, lacks the authority to collect data from drug manufacturers on coupon discounts to patients because the authority to collect information relating to ASP is based on manufacturer sales to purchasers. We suggested that Congress consider granting CMS authority to collect data from drug manufacturers on coupon discounts for Part B drugs based on ASP and require the agency to periodically collect these data and report on the implications of coupon programs for Part B drug payment rate methodology.

Low-volume payment adjustments. Medicare’s payment adjustment for low-volume dialysis facilities is one of several modifications in Medicare’s payment systems designed to help maintain beneficiaries’ access to care. Low-volume providers in areas where other care options are limited may warrant higher payments, and CMS intended this low-volume payment adjustment (LVPA) to encourage small dialysis facilities to continue operating in areas where beneficiary access might be jeopardized if such facilities closed. However, in 2013 we found that, as designed, the LVPA did not effectively achieve this goal because it did not target all relatively low-volume, high-cost facilities that were in areas where beneficiaries may have lacked other dialysis care options, and it targeted some facilities that appeared unnecessary for ensuring access to dialysis, such as dialysis facilities located in close proximity to other facilities. In response to our report, CMS revised the LVPA, beginning in 2016, to more effectively target low-volume facilities necessary for ensuring access to care; and in 2015, CMS issued clarifying guidance on the LVPA in a final rule and held outreach calls to dialysis facilities and Medicare contractors to ensure their understanding of the guidance. The agency has not acted, however, to implement an improvement we recommended to change the design of LVPA to reduce the incentive for facilities to restrict the services they provide in order to avoid reaching treatment thresholds that determine eligibility for the program.

Physician payment rates. The accuracy of Medicare’s payment rate for physician services has major implications for the health care system given spending on these services—$70 billion in fiscal year 2015—and the fact that other payers, such as private insurers, base their payment rates at least in part on Medicare rates. Inaccurate payment rates can create distorted incentives for physicians to either over- or underprovide services or to pursue certain specialties. We and others have identified several weaknesses in CMS’s processes for setting physician payment rates. This process involves CMS assigning relative values to each service by taking into account recommendations made by the American Medical Association’s Specialty Society Relative Value Scale Update Committee (RUC).

Some of our concerns with this process include issues with the survey data the RUC uses in part to develop relative value recommendations, including low survey response rates. In 2015, the median survey response rate for over 200 physician services was about 2 percent. Additionally, although CMS officials state that all Medicare services are reviewed every 5 years as required by statute, the agency does not maintain a database to track when services were last valued. CMS officials acknowledge that the agency relies heavily on RUC recommendations. Given the process and data-related weaknesses associated with the RUC’s recommendations, this process could potentially result in inaccurate payment rates. To address these concerns, we recommended that CMS incorporate data and expertise from physicians and other relevant stakeholders into the process for establishing relative values. CMS concurred with this recommendation and has begun to research ways to develop an approach for validating relative values, but until it develops a timeline and a plan for determining its approach, CMS risks continuing to use payment rates that may be inaccurate.

Medicare Advantage and Other Medicare Health Plans

The MA program, an alternative to the traditional Medicare FFS program, provides health care coverage to Medicare beneficiaries through private health plans. The number and percentage of Medicare beneficiaries enrolled in MA has grown steadily over the past several years, increasing from 8.1 million (20 percent of all Medicare beneficiaries) in 2007 to 15.8 million (30 percent of all Medicare beneficiaries) in 2014. Congress has taken a number of steps to introduce financial incentives to explicitly reward quality and efficiency in the MA program. For example, PPACA provided that MA plans with a quality rating of four or more stars—with five stars indicating the highest quality—receive bonus payments, and required MA maximum payment amounts to be adjusted to near or below FFS spending. Moreover, in January 2013, Congress enacted the American Taxpayer Relief Act of 2012 (ATRA), which increased the statutory minimum for the annual MA coding intensity adjustment in order to account for differences in the comprehensiveness with which MA plans and FFS providers code medical diagnoses. CBO estimated that this change alone would save Medicare about $1.4 billion over 5 years. The recently enacted 21st Century Cures Act also includes several changes to the MA risk adjustment model that must be implemented beginning in 2019. For example, the MA risk adjustment model will be required to take into account the number of diseases or conditions of enrollees and allows CMS to use 2 years of diagnosis data when determining the health condition of beneficiaries.

CMS has yet to take action to improve the accuracy of its payments to MA programs or to ensure that MA beneficiaries have sufficient access to providers. We have identified additional opportunities for CMS to improve the accuracy of MA payments, such as adjusting its methodology to account for diagnostic coding differences between MA and FFS, and improve CMS’s oversight of MA network adequacy.

MA plan payment adjustments. Concerns remain about the discrepancy between FFS and MA payments because CMS has yet to improve the accuracy of the adjustment to account for excess payments due to differences in how MA plans and FFS providers code medical diagnoses. We have found that CMS’s risk adjustment model—which uses one year’s diagnoses to predict the following year’s health care costs for each MA enrollee—has led it to overpay MA organizations because of different diagnostic coding patterns between the FFS and MA programs. In 2013, we estimated that these overpayments ranged from at least $3.2 billion to $5.1 billion from 2010 through 2012. We have recommended that CMS take steps to improve the accuracy of its risk score adjustments by, for example, accounting for additional beneficiary characteristics such as sex, health status, and Medicaid enrollment status, as well as including the most recent data available. In April 2016, CMS indicated that after analyzing MA data, the agency planned to implement the statutory minimum for the annual MA coding adjustment mandated in ATRA. However, as of October 2016, CMS had not provided documentation of its analysis to determine, for example, the extent to which the agency’s methodology accounted for additional beneficiary statistics, as we recommended.

In addition, CMS has taken steps to collect encounter data—information on the services and items furnished to enrollees—which are more comprehensive than the beneficiary diagnosis data the agency currently uses to risk adjust payments to MA organizations, and has reported that it will use these data in calculating risk adjustments. However, CMS has not fully developed plans for validating and using MA encounter data, missing an opportunity to detect potentially inaccurate or unreliable data that is being used to direct billions of federal dollars. We recommended that CMS fully validate the MA encounter data it is collecting before using these data for payment purposes. In 2015, CMS began using encounter data as an additional source of diagnostic data in calculating beneficiary risk scores but acknowledged that the agency had yet to complete all steps to validate the data before using them for payment purposes, as we had recommended. Without fully validating the completeness and accuracy of MA encounter data, CMS and MA organizations would be unable to confidently use the data for risk adjustment or any other program management purpose.

Provider network adequacy. CMS is responsible for ensuring adequate access to care for MA enrollees, but reports that some MA organizations have been narrowing their provider networks raise questions about CMS oversight of MA plans’ network adequacy. In 2015, we reported on shortcomings in CMS’s criteria for determining network adequacy, how the agency oversees MA organizations’ adherence to its requirements, and how it ensures enrollees are properly notified about provider network changes. For example, unlike other managed care programs, CMS’s network adequacy criteria do not consider measures of provider availability, such as appointment wait times and whether providers are accepting new patients. CMS also assesses very few networks (less than one percent) each year against its network adequacy criteria and does little to evaluate the accuracy of the network data MA organizations submit. We made several recommendations, including that CMS augment MA network adequacy criteria to address provider availability. HHS concurred with this recommendation, and in early 2016, officials stated that they will review how to augment the MA network adequacy criteria to address provider availability in future years. However, until this happens, provider networks may appear to regulators and beneficiaries as more robust than they actually are.

Program Design Effects on Beneficiaries, Including Those Eligible for Medicaid

The Medicare Trustees estimate that Medicare spending will grow at a faster rate than workers’ earnings or the economy overall, which will impose a significant burden on Medicare beneficiaries and the U.S. economy over time. Because most Medicare beneficiaries pay their Part B premium by having it withheld from their monthly Social Security benefits, and because growth in Medicare premiums and cost sharing has outpaced growth in Social Security benefits, beneficiaries and their families may increasingly need to draw on other income or resources to help pay for necessary medical care. Moving forward, it will be important to find approaches that help avert or mitigate this growing financial burden, particularly for those beneficiaries with high health care needs and few economic resources. For example, understanding how beneficiaries make medical decisions and what information would help them identify and use providers that efficiently deliver appropriate, high- quality care could lead to savings for both beneficiaries and taxpayers.

Our work has identified additional opportunities to improve how the Medicare program ensures that beneficiaries, including those who are also eligible for Medicaid, receive the appropriate services they need.

Care for dual-eligible beneficiaries. The federal government, states, and others have been focusing on care coordination as a key strategy for improving the quality of care for dual-eligible beneficiaries—individuals who qualify for both Medicare and Medicaid—while also reducing costs. Dual-eligible beneficiaries, who are often in poorer health compared with other Medicare and Medicaid beneficiaries, typically receive benefits through each program separately, which can lead to fragmented care due to different program rules for receiving benefits and reimbursing providers. In 2013, CMS began implementing the Financial Alignment Demonstration to integrate Medicare and Medicaid services and financing, and to improve coordination for dual-eligible beneficiaries. While CMS established a framework of monitoring activities to oversee the demonstration, the extent of care coordination is not entirely clear from the information being collected. For example, CMS monitors two core measures related to care coordination, but because these are being used in only one of two models being tested in the demonstration, CMS cannot compare the two demonstration models using these measures. Similarly, demonstration states had state-specific measures that explored aspects of care coordination, but they were not comparable across states. We recommended, among other things, that CMS align existing state- specific measures of the extent to which individualized care plans are being developed to make them comparable. The agency agreed with this recommendation, and CMS officials said they plan to develop a care plan measure that more closely aligns specifications across demonstrations, but data collection is not expected to begin until January 2018.

Dual-eligible special needs plans. Special needs plans are MA private plans designed to address the unique needs of certain Medicare populations, and among these plans are those targeted specifically to dual-eligible beneficiaries. CMS and Congress have taken steps to coordinate care for those enrolled in dual-eligible special needs plans to increase benefit integration and care coordination. For example, PPACA established a type of plan referred to as a fully integrated dual-eligible special needs plan, which is designed to integrate program benefits for dual-eligible beneficiaries through a single managed care organization. In addition, dual-eligible special needs plans that meet certain performance and quality-based standards may seek CMS approval to offer benefits beyond what other MA plans offer if such benefits would help bridge the gap between Medicare- and Medicaid-covered services. Although a large percentage of dual-eligible beneficiaries (43 percent in 2012) were under age 65 and qualified for Medicare because they were disabled, we found that few fully integrated dual-eligible special needs plans serve disabled dual-eligible beneficiaries or report lower costs for Medicare services. In addition, moderately better health outcomes for disabled dual-eligible beneficiaries in dual-eligible special needs plans do not necessarily translate into lower levels of costly Medicare services—that is, inpatient stays, readmissions, and emergency room visits.

Access to preventive services. Over the past several years, researchers have found that certain preventive services are effective in early diagnosis or reduced prevalence of diseases that contribute to the growth in Medicare spending. To encourage beneficiary use, PPACA removed beneficiary cost-sharing requirements for many Medicare- covered preventive services, such as mammograms and colorectal cancer screening. However, in our work we found that while Medicare beneficiaries’ use of some preventive services—cardiovascular disease screening and cervical cancer screening—generally aligned with clinical recommendations, the use of other preventive services, such as osteoporosis screening and immunizations, did not. Medicare beneficiaries who did not receive certain preventive services commonly reported that they had limited information on prevention; had concerns about discomfort, side effects, or efficacy; or their doctor did not recommend the services. Furthermore, we found better use of preventive services by beneficiaries is unlikely without appropriate Medicare coverage. For instance, low use of some recommended services—such as osteoporosis screenings—may result, in part, from limiting which beneficiaries are covered or how frequently the service is covered. Conversely, the absence of required cost sharing for certain services that are not recommended, such as prostate-specific antigen testing for prostate cancer for men aged 75 or older, may contribute to the inappropriate use of those services. In 2012, we suggested Congress require beneficiaries to share the cost when they receive services that the U.S. Preventive Services Task Force recommends against.

Program Management

CMS has overcome some challenges in managing the Medicare program as it implemented some program improvements in recent years, including a competitive bidding program for durable medical equipment (DME). However, more could be done to improve how CMS manages the Medicare program, including its handling of the growing number of appeals for denied claims.

Competitive bidding program. We had previously reported that Medicare sometimes overpaid for DME items relative to other payers. Congress required that CMS implement a competitive bidding program for DME suppliers, which the agency began in 2009. In early assessments, we found that beneficiary access and satisfaction appeared stable and the competitive bidding program has led to savings. More recently in 2016, we found that the number of beneficiaries receiving DME items covered under the competitive bidding program generally decreased after implementation of phases of the program that began in July 1, 2013. Available evidence from CMS’s monitoring efforts indicates no widespread effects on beneficiary access, but some beneficiary advocacy groups have reported specific access issues, such as difficulty locating contract suppliers and delays in delivery of DME items. Changes such as expanding the program into additional competitive bidding areas; using pricing from competitive bidding areas to set prices in non-competitive bidding areas (which was fully phased in as of July 2016); and selecting new contract suppliers for contracts for new rounds of bidding will provide significant new data to further assess the effect of the program. Continued monitoring of the competitive bidding program experience is important to determine the full effects it may have on Medicare beneficiaries and DME suppliers.

Appeals process. Medicare has seen significant growth in the number of appeals submitted by providers, beneficiaries, and others dissatisfied with the program’s decisions to deny or reduce payment for claims. The Department of Health and Human Services (HHS) attributes the increase in appeals to several factors, including for example, CMS’s recent increased focus on program integrity activities, which has resulted in more denied claims and more appeals. In fiscal year 2014, Medicare denied 128 million FFS claims, or 10.5 percent of claims submitted. Medicare’s administrative appeals process for FFS claims consists of 4 levels of review (Levels 1 through 4) and allows appellants who are dissatisfied with decisions at one level to appeal to the next level, with separate appeals bodies making decisions at each level. From fiscal year 2010 to 2014, the number of appeals at all levels of Medicare’s administrative appeals process increased significantly but varied by level. The largest rate of increase (over 900 percent) was experienced at Level 3, in which cases are reviewed by administrative law judges. The large volume of appeals has resulted in backlogs in decisions; in fiscal year 2014, more than 90 percent of Level 3 decisions were issued after the 90- day statutory time frame.

We recommended that HHS take additional steps to improve its oversight of the appeals process, including collecting more complete and consistent data that would assist in monitoring efforts and addressing inefficiencies in the way certain repetitious claims—such as those for monthly oxygen equipment rentals—are adjudicated. HHS has taken some actions to reduce the backlog of appeals. For instance, CMS has offered administrative agreements to eligible hospitals that are willing to withdraw their pending appeals in exchange for timely partial payments, in order to more quickly reduce the volume of claims pending in the appeals process. As of August 2016, CMS has executed settlements amounting to nearly $1.5 billion with 2,022 hospitals, representing approximately 346,000 claims that were in the appeals system. In September 2016, CMS announced it would execute another round of settlements for hospitals with inpatient claims in appeals. In addition, in July 2016, HHS issued a proposed rule that would revise certain appellate procedures in an effort to improve the Medicare appeals process and reduce the backlog. However, HHS has not yet taken actions to address our specific recommendations, and the backlog shows no signs of abating, as the number of incoming appeals continues to surpass adjudication capacity at certain review levels. For fiscal year 2016, the average length of time to process Level 3 appeals was 877 days, compared with the 90 days generally required by statute, and up from the 662 days for fiscal year 2015.

Oversight of Patient Care and Safety

CMS has made progress in improving the health and safety of millions of Medicare beneficiaries, which represent a significant portion of the U.S. population. According to CMS, Medicare Quality Improvement Organizations—which work with providers, beneficiaries, and others to improve health care delivery systems to achieve better care for lower costs—-supported efforts that from fiscal year 2011 through fiscal year 2014 helped to prevent tens of thousands of beneficiaries from being admitted or readmitted to hospitals; reduce the number of health care associated infections; and reduce the number of nursing home patients who experienced pressure ulcers or the use of restraints. CMS has also improved its oversight of quality of care. In 2012, in response to our recommendation, CMS included long-term care hospitals in its validation surveys, which are used to measure the effectiveness of surveys conducted by accrediting organizations on the extent to which facilities meet federal standards for quality of care. However, CMS can further improve how it oversees patient care and safety, as described below.

Clinical data registries. Clinical data registries (CDR) have the potential to improve the quality and efficiency of care for all Medicare beneficiaries by collecting extensive, standardized data and providing feedback to physicians on their performance based on their peers. CDRs are entities that collect detailed information on the therapies that patients receive and changes in their clinical condition over time in order to evaluate and improve care practices and outcomes. In 2013, we recommended that HHS adopt several key requirements to ensure qualified CDRs actually improve the quality and efficiency of care that beneficiaries receive. For example, CMS should require qualified CDRs to demonstrate improvements on key measures of quality and efficiency for their target population and establish a process for monitoring qualified CDRs’ compliance with requirements. HHS should also enhance the effect of qualified CDRs on quality and efficiency by making it easier to develop them by promoting the use of health information technology. HHS concurred with each of our recommendations, but also noted some challenges it expects, for example in establishing a set of core measures for qualified CDRs, as we recommended, given the number of clinical specialties on which qualified CDRs may focus. We maintain, however, that a minimum set of core measures—even if small—could help CDRs promote national-level quality improvement initiatives.

End-stage renal disease. In 2013, Medicare spent about $11.7 billion on dialysis care for about 376,000 Medicare patients. Dialysis is the most common treatment for individuals with end-stage renal disease, and while the vast majority of dialysis treatments are performed in dialysis facilities, dialysis treatments received at home may increase autonomy and health- related quality of life for some patients. Physicians and other stakeholders estimate that between 15 and 25 percent of patients needing dialysis could realistically be on home dialysis. In 2012, about 11 percent of patients needing dialysis received home dialysis.

A number of factors can affect the type of dialysis patients receive, including patients’ preference and clinical factors, but Medicare payment policy may also play a role. In 2015, we found that dialysis facilities have financial incentives in the short term to increase dialysis treatments provided in facilities. Medicare’s monthly payments to physicians for managing the care of home patients are often lower than those for managing in-center patients, which may also discourage physicians from prescribing home dialysis. Further, just a small fraction of Medicare patients have used the Kidney Disease Education benefit—which provides pre-dialysis education and is designed to help patients make informed decisions related to their treatment. Limited use of this benefit may be due to statutory limitations on the types of providers who are permitted to furnish the benefit and on the patients eligible to receive it. We recommended that CMS examine and, if necessary, revise policies for paying physicians to manage the care of dialysis patients, and examine the Kidney Disease Education benefit, and if appropriate, seek legislation to revise the categories of providers and patients eligible for the benefit. HHS concurred with the first recommendation but did not agree with the second, stating that CMS must prioritize its activities to improve care for dialysis patients. We maintain the importance of ensuring that Medicare patients with chronic kidney disease understand their condition and the implications of various treatment options; however, the limited use of the Kidney Disease Education benefit suggests it may be difficult for patients to receive this education.

What Remains to Be Done

Congress, HHS, and CMS have taken steps to improve the fiscal integrity of Medicare, and CMS has implemented some of our recommendations, such as providing more frequent feedback to physicians so they can identify opportunities to reduce costs and rebasing payments for end- stage renal disease services using more recent data, which resulted in per treatment payment reductions. However, continued federal improvements to the oversight of Medicare are warranted given the size and complexity of the program as well as the number and scope of ongoing changes to the program.

We have a number of Matters for Congressional Consideration for addressing Medicare payments, costs, and quality of care. Specifically:

To increase beneficiaries’ awareness of providers’ financial interest in a particular treatment, Congress should consider directing the Secretary of Health and Human Services to require providers who self-refer intensity-modulated radiation therapy services—a type of cancer treatment—to disclose to their patients that they have a financial interest in the service.

To further align Medicare beneficiary use of preventive services with U.S. Preventive Task Force recommendations, Congress should consider requiring beneficiaries who receive services that the Task Force recommends against to share the cost, notwithstanding that cost sharing may not be required for beneficiaries with different characteristics or under different circumstances.

To help HHS better control spending and encourage efficient delivery of care, Congress should consider requiring Medicare to pay PPS- exempt cancer hospitals as it pays PPS teaching hospitals, or provide the Secretary with the authority to otherwise modify how Medicare pays these providers. To generate cost savings from any reduction in outpatient payments to PPS-exempt cancer hospitals, Congress should also provide that all forgone outpatient payment adjustment amounts be returned to the Supplementary Medical Insurance Trust Fund.

In order to prevent the shift of services from physician offices to hospital outpatient departments from increasing costs for the Medicare program and beneficiaries, Congress should consider directing the Secretary of Health and Human Services to equalize payment rates between the settings for evaluation and management office visits—and other services that the Secretary deems appropriate—and to return the associated savings to the Medicare program.

To help HHS ensure accuracy in Part B drug payment rates, Congress should consider requiring all manufacturers of Part B drugs paid at ASP, not only those with Medicaid drug rebate agreements, to submit sales price data to CMS, and ensure that CMS has authority to request source documentation to periodically validate all such data.

To determine the suitability of Medicare’s Part B drug payment rate methodology for drugs with coupon programs, Congress should consider (1) granting CMS the authority to collect data from drug manufacturers on coupon discounts for Part B drugs paid based on ASP, and (2) requiring the agency to periodically collect these data and report on the implications that coupon programs may have for this methodology.

In addition, we have made a range of recommendations to HHS and CMS intended to improve program management and control costs that remain open, including the following:

To ensure that MA encounter data are of sufficient quality for their intended purposes, the Administrator of CMS should (1) establish specific plans and time frames for using the data for all intended purposes in addition to risk adjusting payments to MA organizations; and (2) complete all the steps necessary to validate the data, including performing statistical analyses, reviewing medical records, and providing MA organizations with summary reports on CMS’s findings, before using the data to risk adjust payments or for other intended purposes.

To ensure that future low-volume payment adjustments (LVPA) are made only to eligible facilities and to rectify past overpayments, the Administrator of CMS should (1) require Medicare contractors to promptly recoup 2011 LVPA payments that were made in error, (2) improve the timeliness and efficacy of CMS’s monitoring regarding the extent to which Medicare contractors determine LVPA eligibility correctly and promptly redetermine eligibility when all necessary data become available, and (3) investigate errors that contributed to facilities not consistently receiving the 2011 LVPA and ensure that such errors are corrected. Additionally, to reduce the incentive for facilities to restrict the services they provide to avoid reaching the LVPA treatment threshold, the Administrator of CMS should consider revisions such as changing the LVPA to a tiered adjustment.

In order to improve CMS’s ability to identify self-referred advanced imaging services and help CMS address the increases in these services, the Administrator of CMS should (1) insert a self-referral flag on its Medicare Part B claims form and require providers to indicate whether the advanced imaging services for which provider bills Medicare are self-referred or not; (2) reduce payments for self- referred advanced imaging services to recognize efficiencies when the same provider refers and performs a service; and (3) determine and implement an approach to ensure the appropriateness of advanced imaging services referred by self-referring providers.

To increase dual-eligible special needs plans’ accountability and ensure that CMS has the information it needs to determine whether dual-eligible special needs plans are providing the services needed by dual-eligible beneficiaries, especially those who are most vulnerable, the Administrator of CMS should evaluate the extent to which dual- eligible special needs plans have provided sufficient and appropriate care to the population they serve, and report the results in a timely manner.

To help ensure appropriate payments to MA plans, the Administrator of CMS should take steps to improve the accuracy of the adjustment made for differences in diagnostic coding practices between MA and Medicare FFS. Such steps could include, for example, accounting for additional beneficiary characteristics, including the most current data available, identifying and accounting for all years of coding differences that could affect the payment year for which an adjustment is made; and incorporating the trend of the impact of coding differences on risk scores.

GAO Contact

For additional information about this high-risk area, contact James Cosgrove at (202) 512-7114 or cosgrovej@gao.gov, or Kathleen King at (202) 512-7114 or kingk@gao.gov.

Related GAO Products

Medicare: CMS’s Round 2 Durable Medical Equipment and National Mail- Order Diabetes Testing Supplies Competitive Bidding Programs. GAO-16-570. Washington, D.C.: September 15, 2016.

Medicare Part B: Data on Coupon Discounts Needed to Evaluate Methodology for Setting Drug Payment Rates. GAO-16-643. Washington, D.C.: July 27, 2016.

Medicare Part B: CMS Should Take Additional Steps to Verify Accuracy of Data Used to Set Payment Rates for Drugs. GAO-16-594. Washington, D.C.: July 1, 2016.

Hospital Uncompensated Care: Federal Action Needed to Better Align Payments with Costs. GAO-16-568. Washington, D.C.: June 30, 2016.

Medicare Fee-For-Service: Opportunities Remain to Improve Appeals Process. GAO-16-366. Washington, D.C.: May 10, 2016.

Medicare Advantage: Action Needed to Ensure Appropriate Payments for Veterans and Nonveterans. GAO-16-137. Washington, D.C.: April 11, 2016.

Medicare: Increasing Hospital-Physician Consolidation Highlights Need for Payment Reform. GAO-16-189. Washington, D.C.: December 18, 2015.

Medicare and Medicaid: Additional Oversight Needed of CMS’s Demonstration to Coordinate the Care of Dual-Eligible Beneficiaries. GAO-16-31. Washington, D.C.: December 18, 2015.

Medicare Part B: Expenditures for New Drugs Concentrated among a Few Drugs; and Most Were Costly for Beneficiaries. GAO-16-12. Washington, D.C.: October 23, 2015.

End-Stage Renal Disease: Medicare Payment Refinements Could Promote Increased Use of Home Dialysis. GAO-16-125. Washington, D.C.: October 15, 2015.

Medicare Advantage: Actions Needed to Enhance CMS Oversight of Provider Network Adequacy. GAO-15-710. Washington, D.C.: August 31, 2015.

Medicare Physician Payment Rates: Better Data and Greater Transparency Could Improve Accuracy. GAO-15-434. Washington, D.C.: May 21, 2015.

Medicare: Payment Methods for Certain Cancer Hospitals Should Be Revised to Promote Efficiency. GAO-15-199. Washington, D.C.: February 20, 2015.

Medicare: Bidding Results from CMS’s Durable Medical Equipment Competitive Bidding Program. GAO-15-63. Washington, D.C.: November 7, 2014.

Medicare Improper Payments

Why Area Is High Risk

We designated Medicare as one of the original high-risk programs in 1990 due to its size, complexity, and susceptibility to mismanagement and improper payments. In 2016, Medicare was projected to finance health services for more than 57 million elderly and disabled beneficiaries at a cost of $696 billion, and account for approximately 17.8 percent of federal spending. Improper payments—payments that are either made in an incorrect amount or should not be made at all—are a significant risk for Medicare and reached an estimated $60 billion in fiscal year 2016. The Centers for Medicare & Medicaid Services (CMS), which administers Medicare for the Department of Health and Human Services (HHS), is responsible for overseeing the program and safeguarding it from loss. While Medicare, the largest federal health program, remains inherently complex and susceptible to improper payments, CMS can continue to take actions to prevent and reduce improper payments in the program. This high-risk rating and assessment focuses on CMS’s efforts to reduce Medicare improper payments. We discuss the broader challenges and risks associated with the Medicare program separately.

What GAO Found

CMS has continued to demonstrate leadership commitment to preventing and reducing Medicare improper payments, but consistently high improper payment rates and unimplemented improvement opportunities have resulted in the agency partially meeting the four remaining criteria for removal from our High-Risk List—capacity, action plan, monitoring, and demonstrated progress. Since our last high-risk update, agency leadership took action to prevent improper payments by strengthening certain provider enrollment and prepayment controls, as we recommended. CMS also implemented our recommendation to improve oversight of contractors that carry out postpayment reviews, such as the Medicare Administrative Contractors (MAC) and Recovery Auditors (RA). The agency also took certain program integrity actions authorized by the Patient Protection and Affordable Care Act (PPACA) and the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA). However, despite these efforts, Medicare improper payment rates remained high in 2016. According to HHS’s Agency Financial Report for 2016, although reported improper payments decreased for Medicare fee-for-service (FFS) from 12.1 percent in fiscal year 2015 to 11.0 percent in fiscal year 2016, this rate remained above the statutorily defined compliance threshold of 10 percent. In addition, the improper payment rates increased for Medicare Part C (9.5 percent in fiscal year 2015 to 10.0 percent in fiscal year 2016) and improved somewhat for Part D (3.6 percent in fiscal year 2015 to 3.4 percent in fiscal year 2016). These rates suggest that additional actions are needed to reduce improper payments in the Medicare program. By implementing our open recommendations, CMS will be able to reduce improper payments and progress toward fulfilling the outstanding criteria to remove Medicare improper payments from our High-Risk List.

Congress has also taken actions aimed at helping CMS address this high-risk issue. For example, Congress passed and the President signed into law MACRA in April 2015, which included several provisions aimed at improving Medicare program integrity, such as requiring and providing funding for CMS to remove beneficiaries’ Social Security numbers (SSN) from Medicare cards, requiring MACs to have improper payments outreach and education programs, and modifying surety bond conditions of participation for home health agencies. Congress has also continued to appropriate discretionary funding for CMS to take action to reduce improper payments. In addition, the House and Senate have held more than 20 hearings in the last 4 fiscal years to identify additional program integrity improvements, including 7 hearings since our 2015 high-risk report.

What Remains to Be Done

Improper payments in all parts of Medicare remain unacceptably high. As Medicare program spending and enrollment are projected to continue to grow under current law, sustained effort will be needed to ensure program integrity and reduce improper payments. If CMS were to effectively implement our numerous recommendations, it could improve program management, make fewer improper payments, and recover more of those it makes. For example, to improve the effectiveness of efforts to reduce and recover improper payments in Part C, CMS should improve the processes for selecting contracts to include in its risk adjustment data validation (RADV) audits—audits of Medicare Advantage (MA) organizations that help CMS recover improper payments in cases where beneficiary diagnoses are unsupported by medical records. We also recommend that CMS enhance the timeliness of these audits and incorporate recovery audit contractors (RAC) into the RADV audit. CMS should also revise its guidance for verifying provider practice locations so that MACs conduct additional research on questionable practice location addresses to help improve Medicare provider and supplier enrollment- screening procedures.

Moreover, CMS should fully implement the following priority recommendations and available procedures authorized by PPACA and MACRA to improve the Medicare improper payment rate and remove this area from our High-Risk List: set clear expectations in contract work statements for Part D RAC, conduct annual RAC performance evaluations, and review the process for developing new audit issues to improve the agency’s Part D RAC program operations and contractor oversight; seek legislative authority to allow the RAs—which typically conduct postpayment reviews—to conduct prepayment claim reviews for Medicare FFS as another means of preventing improper payments before they occur; provide guidance to MACs on how to accurately calculate and report savings from prepayment claim reviews to ensure that CMS has the information it needs to evaluate MAC effectiveness in preventing improper payments and evaluate and compare MACs’ performance to that of other contractors; monitor the database used to track Medicare FFS recovery audit activities to ensure that all postpayment review contractors submit required data and that the data contained in the database are accurate and complete; clarify and standardize as much as possible the requirements for the contents of postpayment claims review contractors’ correspondence with providers and assess regularly whether contractors are complying with content requirements to improve the efficiency of postpayment claims reviews and simplify compliance for providers; and require surety bonds for certain types of at-risk providers and suppliers as authorized by PPACA and MACRA.

Additional Details on What GAO Found

Leadership Commitment

CMS continues to meet our criterion for leadership commitment to reducing Medicare improper payments. Improper payment reduction remains a strategic priority for HHS, and CMS leadership has taken multiple actions that demonstrate its commitment to reducing such payments in the Medicare program, including implementing several of our recommendations. For example, CMS leadership indicated that the agency took steps since our last high-risk update to co-locate all offices whose primary mission is ensuring the integrity of Medicare FFS claims payments, which it believes will improve efficiency for dealing with program integrity issues. CMS also implemented some of our 2012 and 2013 recommendations to improve postpayment reviews and prepayment control efforts. For example, CMS uses several contractors to conduct postpayment reviews for improper payments and the agency has made changes to standardize contractor requirements as we highlighted as a priority recommendation in the 2015 high-risk update. By aligning these contractor requirements, CMS will likely improve the efficiency and effectiveness of its Medicare program integrity efforts by strengthening the control environment, lessening providers’ confusion, and reducing administrative burdens.

In response to our priority recommendations, CMS also began disseminating information about certain contractors’ most successful prepayment edits—controls preprogrammed into payment processing systems—and requested that these contractors share information about their top edits, thereby ensuring more widespread use of effective prepayment controls. In 2015, we also recommended changes to improve CMS’s enrollment screening procedures for Medicare providers and suppliers, and CMS has implemented several updates to its provider enrollment database that will address identified weaknesses.

Capacity

CMS partially met our criterion that it have the capacity to reduce improper payments in the Medicare program. The Medicare integrity program—along with other activities to detect, prevent, and combat factors that contribute to improper payments—is funded through the Health Care Fraud and Abuse Control (HCFAC) program, which has reported returns on investment of $6.10 for every $1 spent from fiscal year 2013 through 2015. In fiscal year 2016, Congress provided more discretionary HCFAC funding than in any prior year. These funds helped CMS implement planned initiatives to protect Medicare dollars. While CMS received increased discretionary funding since 2015, the budgetary environment remains uncertain, as demonstrated by the 6 percent decline in discretionary Medicare integrity funding from fiscal year 2011 to 2014. Given funding uncertainty and projected spending increases, it is even more important for CMS to prioritize its most effective program integrity initiatives and to maximize the effect of those initiatives already underway by implementing our recommendations.

Action Plan

CMS has partially met our action plan criterion. While CMS identifies and reports progress on corrective actions related to Medicare improper payments in HHS’s annual Agency Financial Report, the agency has not implemented all of the recommendations we made that could reduce improper payments nor fully developed an action plan for addressing our high-risk area. HHS’s Agency Financial Report for 2016 identified insufficient documentation and medical necessity errors as root causes of improper payments for Medicare FFS, and insufficient documentation and administrative errors as root causes of improper payments for both Parts C and D. The report also identified actions that CMS has taken or is taking to address these causes. For example:

CMS took action to revalidate existing Medicare providers and suppliers, as required by PPACA. The provider and supplier revalidation is in the second round of a multiyear process to improve enrollment screening that we reported on in 2016. Specifically, we reported that CMS’s revised enrollment screening process resulted in over 703,000 existing enrollment records being deactivated or revoked but that CMS needed to establish performance measures to assess the revised process.

CMS took several corrective actions to address improper payment rates for home health claims, which have historically had improper payment rates over 50 percent. For example, CMS took action to clarify face-to-face requirements for home health providers and implemented prepayment claims reviews in 2015 to help educate home health providers. The improper payment rate for home health claims decreased from 59.0 percent in fiscal year 2015 to 42.0 percent in fiscal year 2016.

CMS also expanded the use of prior authorization to prevent improper payments for various suppliers. For example, CMS published a final rule in December 2015 that established a Master List of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) items that providers frequently bill to Medicare when recipients don’t need them. The rule, which took effect on February 29, 2016, requires prior authorization for certain DMEPOS items on the Master List, which CMS believes will reduce or prevent questionable billing practices and improper payments for these items. In December 2016, CMS announced that it would begin implementing prior authorization for two types of power wheelchairs not previously covered in a demonstration beginning in March 2016.

Despite these efforts, we have found problems with some of the proposed corrective actions. For Part C improper payments, HHS’s 2015 and 2016 Agency Financial Reports identified RADV audits as a primary corrective action. These audits of MA organizations—to which Medicare pays a risk- adjusted monthly amount for each enrolled beneficiary—help CMS recover improper payments from such organizations if they requested CMS to adjust payments based on beneficiary diagnoses unsupported by medical records. However, in April 2016, we reported significant problems with the methods used to select MA contracts for RADV audits and the time it took to complete the audits. For example, using current methods, CMS is unable to select contracts for audit that have the greatest potential for recovering improper payments. These issues limit CMS’s ability to recover the billions of dollars in MA improper payments that occur each year.

In addition, CMS has yet to address some problems including those where we have recommended changes. For example, in 2016, we recommended that CMS seek legislative authority to allow RAs to review Medicare FFS claims before they are paid as another means to prevent improper payments before they occur. Although CMS and RA officials told us that a demonstration of RA prepayment reviews was considered successful, the agency disagreed with our recommendation to seek authority to extend this ability and told us that other claim review contractors conduct prepayment reviews and that CMS has implemented other programs as part of its strategy to move away from the “pay and chase” process of recovering overpayments. We continue to believe that prepayment reviews better protect agency funds compared to postpayment reviews, and that seeking the authority to allow RAs to conduct prepayment reviews is consistent with CMS’s strategy to pay claims properly the first time. In not seeking the authority, CMS may be missing an opportunity to reduce the amount of uncollectable overpayments from RA reviews and save administrative resources associated with recovering overpayments. Finally, CMS officials have indicated that the agency is developing an action plan to address our identified high-risk areas, but as of January 2017, the plan was not yet complete.

Monitoring

CMS has taken steps to monitor the effectiveness of its corrective measures, but only partially met our monitoring criterion due to data and oversight challenges. For example, in response to our 2011 recommendation, CMS implemented changes to the data systems its contractors use to track spending on Medicare integrity efforts, thereby improving the agency’s ability to assess the effectiveness of these activities. However, other weaknesses limit CMS’s ability to monitor activities of the contractors that review Medicare claims before and after payment. In 2016, we reported that CMS does not have reliable data on savings from prepayment claims reviews to evaluate MACs’ performance in preventing improper payments or to compare performance across contractors. In response to our report, CMS is developing methodologies to estimate amounts CMS would have paid providers had claim denials based on prepayment review not occurred. Until CMS completes these activities and calculates and reports savings from prepayment reviews, this remains a priority recommendation.

In 2016, we also found that, although CMS has improved its provider and supplier enrollment screening process, it lacked objectives for monitoring this screening process and performance measures to assess progress toward achieving its goals for revalidating enrollment information. Finally, in 2015, we reported that CMS did not adequately set expectations for the RAC hired to oversee Part D payments, did not conduct timely performance evaluations, and did not have a good process for approving audit work. As a result of these management weaknesses, CMS collected fewer than $10 million in Part D improper payments as of May 2015. Given that Part D improper payments increased from $2.2 billion to $2.4 billion from fiscal year 2015 to 2016, CMS will need to address these issues when it solicits the next Part D RAC contracts.

Demonstrated Progress

CMS has demonstrated some progress, including a decrease in the Medicare FFS and Part D improper payment rates in fiscal year 2016, but the size of the program and persistently high improper payment rates for some parts of Medicare indicate further progress is needed. As noted, CMS has taken various actions to improve Medicare program integrity, such as updating eligibility enrollment software, revalidating existing providers and suppliers, and reducing differences in contractor postpayment review requirements; however, it has yet to be determined how many of these changes will affect CMS’s long-term ability to prevent and collect improper payments. In addition, Congress enacted MACRA, which, among other things, required and provided funding for CMS to remove beneficiaries’ SSNs from Medicare cards and develop a new, unique identifier—which we also recommended in 2012 and have highlighted as a priority recommendation. In 2016, CMS reported that it had begun the process of removing SSNs from Medicare cards and will begin replacing them with randomly generated Medicare Beneficiary Identifiers in 2018; however, such changes will not be fully implemented until 2019. CMS has indicated that certain other corrective actions—like expanding the use of prior authorization—have successfully reduced improper payments in several demonstration projects and provider education initiatives, and as a result, the agency is in the process of expanding such efforts. Moreover, CMS has yet to implement certain PPACA-authorized actions as we encouraged the agency to do in our 2015 high-risk report. For example, PPACA authorized CMS to impose surety bonds on certain at-risk providers to strengthen provider enrollment protections. MACRA also included a provision to require surety bonds for all home health agencies as a condition of Medicare participation. CMS has stated that the agency is working to implement this requirement, but, as of December 2016, CMS had not issued rules to do so. Continued progress in these and other efforts is needed, as Medicare FFS, Part C, and Part D all remained on the Office of Management and Budget’s list of high-error programs in 2015. Sustained control over payments and program integrity management is needed before Medicare improper payments can fully meet our criterion for demonstrated progress.

Benefits Achieved by Implementing Our Recommendations

Our body of work on improper payments has raised the level of attention to this issue, including Medicare improper payments, and contributed to the passage of the Improper Payments Information Act of 2002 (IPIA) and subsequent improper payment legislation. These laws require, among other things, agencies to estimate their annual amount of improper payments and report on actions to reduce them. In part from our continued oversight of CMS’s efforts to meet the requirement of IPIA, both Medicare Part C and Part D have reduced overpayment rates, a component of the total program improper payment rate, since each program began reporting improper payments in 2009 and 2011, respectively. Specifically, we determined that Medicare Part C had cost savings associated with overpayment error rate reductions of $1.2 billion in fiscal year 2010, $5.1 billion in fiscal year 2011, $6.2 billion in fiscal year 2013, and $8.9 billion in fiscal year 2014. Part D had cost reduction of $209.8 million in fiscal year 2014 and $51.1 million in fiscal year 2015.

In 2012, we reported that CMS had not integrated its predictive analytics system, known as the Fraud Prevention System (FPS), with its claims processing and payment systems to allow for the automated prevention of potentially fraudulent Medicare claims payments. We recommended that the agency develop schedules for completing integration of these systems. In response, CMS implemented capabilities which allowed FPS to stop payment of certain improper and non-payable claims including a total of $26.2 million of cost savings in 2014 and 2015.

In 2012, we made several recommendations to CMS to promote greater use of effective prepayment edits and better ensure proper payment, to promote implementation of effective edits based on national policies, and to encourage more widespread use of effective local edits by MACs. In response to these recommendations, CMS began disseminating information about certain contractors’ most successful prepayment edits—controls preprogrammed into payment processing systems—requested that these contractors share their top edits, and made improvements to certain edits that identify services billed in medically unlikely amounts. The agency also revised its standard operating procedures to ensure consideration of automated edits for all new and existing national coverage determinations— which describe the circumstances under which Medicare will cover services nationwide—as we recommended. These changes help CMS ensure Medicare payments are made properly the first time.

Beginning in 2013, CMS took several actions to improve its process for addressing RAC-identified vulnerabilities that led to improper payments as we recommended in 2010. For example, the agency created a protocol to determine the effectiveness of certain corrective actions and established regular meetings to discuss RAC issues. By taking these steps, CMS established monitoring and control activities to ensure that corrective actions are taken that help meet the overall goal of reducing improper payments in the Medicare program.

In response to our 2011 recommendation, CMS implemented changes in 2014 to the data systems MACs use to track spending on Medicare integrity efforts, thereby improving the accuracy of spending estimates. These changes improve the agency’s ability to assess the effectiveness of their Medicare integrity activities.

In 2015, we reported weaknesses in the screening procedures CMS uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling in the Medicare Provider Enrollment, Chain and Ownership System (PECOS). Specifically, we found that the computer software CMS uses to validate applicants’ addresses does not flag potentially ineligible addresses. In addition, we found that CMS’s process for verifying providers’ licenses did not always identify providers’ adverse actions when enrolling, revalidating, or reviewing provider’s licenses unless the provider self-reported the action. In response to recommendations we made to address these issues, CMS updated its address verification software and incorporated information from the Federation of State Medical Boards into its automatic screening process thereby improving the integrity of Medicare provider enrollment.

In 2012 and 2013, we made recommendations to CMS to remove beneficiary SSNs from the Medicare insurance card in order to protect beneficiaries from identity theft. In response to our recommendations and in accordance with MACRA, CMS initiated a project in 2016 to replace beneficiary SSNs with a non SSN-derived Medicare Beneficiary Number. Removing SSNs from Medicare cards better protects Medicare beneficiaries from identity theft and provides CMS with a useful tool in combatting Medicare fraud and medical identity theft.

In 2011, we identified instances of questionable access to prescription drugs in the Part D program and made a recommendation to CMS to improve its efforts to curb overutilization in Part D. In response to our recommendation, CMS conducted a case management pilot in 2012 to improve retrospective drug utilization program controls, developed a drug utilization review methodology to target Part D beneficiaries who are at risk due to high use of opioids, and implemented an overutilization monitoring system to ensure Part D sponsors are implementing effective controls against opioid overutilization. By implementing these changes, CMS has taken an important step toward insuring the safety of Medicare beneficiaries and reducing the abusive practice of doctor shopping for prescription drugs.

GAO Contact

For additional information about this high-risk area, contact Kathleen King at (202) 512-7114 or kingk@gao.gov.

Related GAO Products

Medicare: Initial Results of Revised Process to Screen Providers and Suppliers, and Need for Objectives and Performance Measures. GAO-17-42. Washington, D.C.: November 15, 2016.

Skilled Nursing Facilities: CMS Should Improve Accessibility and Reliability of Expenditure Data. GAO-16-700. Washington, D.C.: September 7, 2016.

Medicare Fee-For-Service: Opportunities Remain to Improve Appeals Process. GAO-16-366. Washington, D.C.: May 10, 2016.

Medicare: Claim Review Programs Could Be Improved with Additional Prepayment Reviews and Better Data. GAO-16-394. Washington, D.C.: April 13, 2016.

Medicare Advantage: Fundamental Improvements Needed in CMS’s Effort to Recover Substantial Amounts of Improper Payments. GAO-16-76. Washington, D.C.: April 8, 2016.

Health Care Fraud: Information on Most Common Schemes and the Likely Effect of Smart Cards. GAO-16-216. Washington, D.C.: January 22, 2016.

Medicare Part D: Changes Needed to Improve CMS’s Recovery Audit Program Operations and Contractor Oversight. GAO-15-633. Washington, D.C.: August 14, 2015.

Medicare Program: Additional Actions Needed to Improve Eligibility Verification of Providers and Suppliers. GAO-15-448. Washington, D.C.: June 25, 2015.

Medicare: Potential Uses of Electronically Readable Cards for Beneficiaries and Providers. GAO-15-319. Washington, D.C.: March 25, 2015.

Medicaid Program

Current State of the Medicaid Program

Overview of Medicaid’s Challenges

The size, growth, and diversity of the Medicaid program presents oversight challenges, and we designated Medicaid as a high-risk program in 2003 due to concerns about the adequacy of fiscal oversight. Medicaid is one of the largest sources of funding for acute health care, long-term care, and other services for low-income and medically needy populations. This federal-state program covered an estimated 72.2 million people in fiscal year 2016 and is the largest health program as measured by enrollment and the second largest as measured by expenditures, second only to Medicare. A source of significant pressure on federal and state budgets, estimated Medicaid outlays for fiscal year 2016 were $575.9 billion, of which $363.4 billion was financed by the federal government and $212.5 billion by the states.

Medicaid allows states significant flexibility to design and implement their programs, resulting in more than 50 distinct programs; this variability complicates program oversight and has contributed to challenges in overseeing program payments and beneficiaries’ access to services. Each state Medicaid program, by law, must cover certain categories of individuals and provide a broad array of benefits. Populations covered include children in low-income families and low-income individuals who are elderly, disabled, or are experiencing high medical needs. Medicaid’s extensive benefit package includes coverage for acute care services, primary care services, long-term care services, and comprehensive screening and treatment services for children.

Within these broad parameters, however, states administer their own programs, deciding whether to cover any health services or populations beyond what are mandated by law, setting provider reimbursement rates, and operating state-specific data systems to enroll eligible beneficiaries and providers and to process and pay claims. For example, states may pay health care providers for each service they provide on a fee-for-service (FFS) basis; contract with managed care organizations (MCO) to provide a specific set of Medicaid-covered services to beneficiaries, and pay them a set amount per beneficiary per month; or rely on a combination of both delivery systems.

Variability among state Medicaid programs also results from key Medicaid reform efforts that states may initiate. For example, under Section 1115 of the Social Security Act, the Secretary of Health and Human Services can waive traditional Medicaid requirements and authorize states to expend funds on Medicaid demonstrations to test new ways to deliver services. State Medicaid programs also differ in whether and how they have elected to expand Medicaid as allowed under the Patient Protection and Affordable Care Act (PPACA), which gave states the option to expand Medicaid eligibility to nearly all adults under age 65 with incomes up to 133 percent of the federal poverty level (hereafter referred to as newly eligible adults). States that elected to expand Medicaid received 100 percent federal funding for this newly eligible population through 2016, with the federal share declining to 90 percent for 2020 and subsequent years. As of October 2016, 31 states and the District of Columbia had opted to expand Medicaid eligibility under PPACA. In 2015, the Centers for Medicare & Medicaid Services (CMS) projected that total spending for Medicaid will rise an average of 6.4 percent per year from 2015 to 2024 (see figure 19).

States also vary in the extent to which they are affected by economic downturns, which in turn can affect their Medicaid programs. The federal government matches most state expenditures using a statutory formula based in part on each state’s per capita income. We and others have noted that states’ efforts to fund Medicaid can be challenged during economic downturns, when Medicaid enrollment can rise and state revenues can decline. To ensure that federal funding efficiently and effectively responds to the program’s countercyclical nature, we have emphasized the need for timely and targeted federal assistance to stabilize states’ funding of Medicaid during such periods. Such assistance would support states with declining revenues or increased enrollment during a national economic downturn, further stabilizing the financing of this important program.

An overarching challenge for the Medicaid program is the lack of accurate, complete, and timely data CMS needs to oversee the diverse and complex state Medicaid programs. Our work has made it clear that insufficient data have affected CMS’s ability to ensure proper payments and beneficiaries’ access to services. CMS’s two primary data sets—the CMS-64, which serves as the basis for calculating the amount of federal matching funds for states, and the Medicaid Statistical Information System (MSIS), which is designed to report individual beneficiary claims data—have the potential to offer a robust view of state financing, payments, and overall spending in the Medicaid program. However, the data’s usefulness is limited because of issues with completeness, timeliness, and accuracy. Improved data would enhance CMS oversight, allowing for improved monitoring of program financing and payments, beneficiary access, and compliance with Medicaid laws and requirements. CMS has acknowledged the need for improved Medicaid data and has undertaken a number of steps aimed at streamlining and improving the quality of data currently reported by states and available to CMS for oversight purposes.

Our Work Suggests the Need for Continued Attention in Five Principal Areas

Financing and Provider Payment Transparency and Oversight

Complete and accurate data on state financing and payments to individual providers is essential for CMS to effectively oversee state Medicaid programs. Without more transparent information on state funding sources and program payments, CMS is unable to determine whether program expenditures are appropriate or to ensure the fiscal integrity of the program. Congress has held multiple hearings on these issues, including a November 2015 hearing at which the House Committee on Energy and Commerce, Subcommittee on Health, examined possible legislative remedies to address concerns we have raised in multiple reports about the transparency of Medicaid financing and payments to individual providers.

Financing transparency and oversight. In recent years, states have increasingly relied on funds from providers and local governments to finance the nonfederal share of Medicaid, with implications for federal costs. While states finance the nonfederal share in large part through state general funds, they also depend on other sources of funds, such as taxes on health care providers and transfers of funds from local governments. Our 2013 survey of states found that, in 2012, states financed over one-quarter—over $46 billion—of the nonfederal share of Medicaid with funds from health care providers and local governments, an increase of over 21 percent since 2008 from these sources. Our work has illustrated that by requiring providers to supply all or more of the nonfederal share of Medicaid payments, states can claim an increase in federal matching funds without a commensurate increase in state expenditures. This shifts costs from the state to the federal government.

Identifying the sources of nonfederal funds is essential to assessing their effect; however, CMS does not collect complete or accurate information on these sources of nonfederal funds. Apart from data on provider taxes and donations, CMS does not require states to provide information on the funds they use to finance Medicaid nor ensure that the data they do collect are accurate and complete. This lack of transparency in states’ sources of funding hinders CMS’s ability to determine whether increasing payments to providers provides fiscal relief to the state or whether increasing payments to providers improves beneficiary access. Without accurate information on how states finance their Medicaid programs, CMS is also unable to ensure that states comply with federal requirements. For instance, under federal law, at least 40 percent of the state share must be from state funds, which includes state general funds, provider taxes and donations, and transfers from other state agencies. CMS disagreed with our recommendation to take action to improve the information available on states’ sources of the nonfederal share of Medicaid payments. In 2015, legislation was introduced that would require CMS to take such action.

Oversight of payments to institutional providers. Over the years, we and others have reported on CMS’s oversight of payments that states often make to institutional providers, such as hospitals and nursing facilities, which have raised questions. In particular, concerns have been raised about states making large Medicaid supplemental payments— payments in addition to the regular, claims-based payments made to providers for services they provided—often to government providers, such as local government and state-operated hospitals and other health care facilities. In fiscal year 2015, the latest date for which data are available, these payments totaled about $55 billion. Supplemental payments that result in total Medicaid payments well in excess of a provider’s costs raise questions about whether payments are consistent with the statutory requirement that payments be economical and efficient and are actually for covered Medicaid services.

Among other concerns related to CMS oversight of supplemental payments, we have found the agency lacks a policy and process for determining whether payments made to individual providers are economical and efficient, as required by law, and lacks clear guidance on appropriate methods for states to distribute payments. For example, in 2015, we reported that three hospitals in New York received supplemental payments that resulted in overall Medicaid payments to the hospitals that greatly exceeded their cost of providing Medicaid services.

CMS, in response, required New York to retroactively reduce supplemental payments to the hospitals by more than $1.5 billion— including $771 million in federal funds—over 4 years.

Further, in a 2016 report, we found that selected states distributed supplemental payments to hospitals largely based on the availability of local government funds to finance the nonfederal share, rather than on the volume of services each hospital provided. In addition, officials from hospitals that received payments above costs reported using the excess revenues from these supplemental payments broadly, from covering the costs of uninsured patients to funding general hospital operations, maintenance, and capital purchases, such as for a helicopter.

Based on the findings from these reports, we have recommended that CMS (1) clarify criteria for determining the economy and efficiency of payments to individual providers, (2) issue guidance clarifying its policies that supplemental payments should be linked to the provision of Medicaid services and not be contingent on the availability of local financing, and (3) require provider-specific reporting of certain types of supplemental payments. In 2015, legislation was proposed that would require CMS to collect provider-specific data on states’ supplemental payments. As of fall 2016, CMS was pursuing regulatory actions to address some of the concerns we raised, including requiring states to report information about how they distribute supplemental payments.

Managed Care Payments and Utilization Oversight

As of 2014, the latest date for which this information is available, more than three-fourths of Medicaid beneficiaries received some of their services in a managed care delivery system, in which the state typically contracts with managed care organizations (MCO) to provide a specific set of services for beneficiaries for a set amount per beneficiary per month. Federal spending for managed care in fiscal year 2014 was $107 billion, which accounted for over one-third of federal Medicaid spending that year and represented a significant increase from 2013. Increased enrollment and spending for Medicaid managed care makes effective federal and state oversight of this large and complex component of the Medicaid program critical, and underscores the need for reliable data to assess the appropriateness of states’ payments to MCOs and beneficiaries’ access to MCO services. In our work examining federal expenditures for MCOs, we determined that state payments to MCOs in 2014 varied widely across and within 8 states as did the average annual MCO payments per beneficiary, which ranged from $2,784 in California to $5,180 in Pennsylvania. While this variation could be due, in part, to differences in the enrolled population and geographic costs and utilization patterns, it suggests the need to further examine the relationship between higher MCO spending and beneficiaries’ experiences.

Further, federal law requires states to collect encounter data—records of health care services for which MCOs pay—and submit these data to CMS using MSIS. Having reliable encounter data that provides information on service utilization is important as MCOs receive a fixed amount per beneficiary regardless of the number of services used and therefore may have financial incentives to limit beneficiaries’ access to services. However, in our work examining beneficiary utilization of services, we could not fully assess utilization patterns for Medicaid managed care beneficiaries in 19 states because MSIS data were either not available (11 states) or were unreliable (8 states). In May 2016, CMS issued a final rule for Medicaid managed care that includes provisions aimed at improving Medicaid managed care encounter data submissions. For example, for contracts with MCOs and limited benefit health plans beginning on or after July 1, 2017, states are required to include provisions regarding the maintenance of encounter data, and, by July 1, 2018, to have procedures in place to validate that the enrollee encounter data these entities submit are complete and accurate.

Growing Expenditures for and Oversight of Large Medicaid Demonstrations

Medicaid demonstrations have become a significant proportion of Medicaid expenditures, growing steadily from about $50 billion, or about 14 percent of total Medicaid expenditures in fiscal year 2005, to $165 billion, or close to one-third of total Medicaid expenditures in fiscal year 2015. Section 1115 of the Social Security Act authorizes the Secretary of HHS to waive certain federal Medicaid requirements and allow costs that would not otherwise be eligible for federal matching funds for experimental, pilot, or demonstration projects that are likely to assist in promoting Medicaid objectives. The demonstrations can provide a way for states to test and evaluate new approaches for delivering Medicaid services. By policy, demonstrations should be budget neutral to the federal government; that is, they must not increase federal costs. In July 2015, CMS changed its organizational structure and increased its staffing to oversee section 1115 demonstrations and their growing role in the Medicaid program, and we continue to assess CMS’s approval and oversight of spending for these demonstrations.

Expenditure authorities in Medicaid demonstrations. Using its authority under Section 1115 of the Social Security Act to approve costs that would not otherwise be matchable under Medicaid, HHS has approved Medicaid spending for a wide range of purposes beyond extending coverage to new populations or for new benefits. For example, HHS approved demonstrations that allowed 5 states to spend up to $9.5 billion to fund state health programs that were previously financed at least in part by the state or potentially other federal programs. HHS also approved 8 states to make more than $26 billion in supplemental payments to hospitals and other providers. We found that HHS’s criteria and approval documents were not always clear as to how approved spending would further Medicaid objectives. For example, some of these state programs appeared to be only tangentially related to improving health outcomes for low-income individuals and lacked documentation explaining how approving them would promote Medicaid objectives. We also found that demonstration approvals sometimes lacked assurances that demonstration spending would not duplicate other federal funds received by states.

In response to our work, HHS issued general criteria for determining whether demonstrations met Medicaid objectives, which it had not delineated before. HHS also committed to identifying in approval documents how each expenditure authority promoted Medicaid objectives and providing assurances that demonstration funds would not duplicate other federal funds. While issuing the general criteria is a useful first step, we maintain that given the breadth of the Secretary’s authority under section 1115—the exercise of which can result in billions of dollars of federal expenditures for costs that would not otherwise by allowed under Medicaid—more explicit criteria are needed.

Budget neutrality of Medicaid demonstrations. We remain concerned about the Secretary of HHS’s lack of an adequate budget neutrality policy including the criteria and process for reviewing and approving demonstration spending limits and the lack of a written, up-to-date policy that is readily available to state Medicaid directors and others. In multiple reports, we have found that federal spending on Medicaid demonstrations could be reduced by billions of dollars if HHS were required to improve the process for reviewing, approving, and making transparent the basis for spending limits approved for Medicaid demonstrations. For example, in 2014, we reported that HHS had approved a spending limit for Arkansas’s demonstration—to test whether providing premium assistance to purchase private coverage through the health insurance exchange would improve access for newly eligible Medicaid beneficiaries—that was based, in part, on hypothetical, not actual, costs. We estimated that by allowing the state to use hypothetical costs, HHS approved a demonstration spending limit that was over $775 million more than what it would have been if it was based on the state’s actual payment rates for services under the traditional Medicaid program.

Another troubling precedent is that HHS granted Arkansas and 11 other states additional flexibility in their demonstrations to increase the spending limit if costs proved higher than expected. Our report on Arkansas was the latest in a series of reports showing significant concerns with HHS’s process for reviewing and approving spending under demonstrations. For example, in 2013 we reported that, for 4 of 10 demonstrations we reviewed, HHS approved spending limits that exceeded those that were supported in documentation and by HHS’s own policy by an estimated $32 billion. We have recommended that HHS (1) better ensure that valid methods are used to demonstrate budget neutrality, (2) clarify criteria for reviewing and approving demonstration spending limits, (3) document and make public the basis for approved spending limits, and (4) update its written budget neutrality policy to reflect the actual criteria and processes used to develop and approve demonstration spending limits.

HHS has generally disagreed that changes to its policy and process are needed. Congress has held hearings, sent letters to CMS, and proposed legislation regarding how CMS reviews and approves demonstration spending limits. Although HHS has not issued a written budget neutrality policy as of October 2016, HHS has taken some steps to improve its oversight, including issuing a report in October 2015 to Congress on actions taken with respect to Medicaid demonstrations. The report discussed some steps HHS has taken and planned to take to improve access to program information and the transparency of its criteria for approving expenditures. Further, in 2016 HHS took steps to change its budget neutrality methodology that are intended to result in more appropriate demonstration spending limits. Nonetheless, we maintain that HHS must take the additional actions specified in our recommendations to improve the transparency of its demonstration approvals.

Monitoring and Measurement of Access to Quality Care

Access to appropriate care has been a concern because of the needs and vulnerability of the individuals covered by Medicaid, including children, the elderly, and the disabled. National survey data have suggested that access reported by Medicaid beneficiaries is comparable to that of individuals with private health insurance in many areas, but that Medicaid beneficiaries do face particular challenges in accessing certain types of care. To help assess Medicaid enrollees’ access to care, CMS needs better data.

Access to preventive, oral, and mental health services. The higher prevalence of some health conditions among Medicaid beneficiaries nationally that can be identified and managed by preventive services suggests that more can and should be done to ensure Medicaid beneficiaries receive these services. For example, states are required to provide preventive services for children through the Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) benefit. However, national data collected by HHS suggest that Medicaid beneficiaries receive these services at rates below established goals. In addition, our 2016 work showed that, due to variation across states in the scope, functionality, and availability of resources on provider information, Medicaid beneficiaries in FFS arrangements may face challenges in identifying available providers in their respective states. State Medicaid programs have also struggled to ensure that beneficiaries, particularly children, receive appropriate oral health and mental health services when needed. High rates of dental diseases remain prevalent across the nation, especially in vulnerable and underserved populations. Medicaid beneficiaries, children in particular, have increased their use of dental services but still visited the dentist less often than privately insured children. These visits are essential to preventing future high cost dental services. Medicaid children may also have problems accessing mental health providers and may not be receiving appropriate mental health treatment and services. For example, national survey data indicate concerns that some children enrolled in Medicaid may be inappropriately prescribed psychotropic drugs and are not receiving needed mental health services, such as counseling and therapy.

Better data needed to assess enrollees’ access to care. CMS’s ability to assess beneficiaries’ access to services is complicated by insufficient data. For example, in reviewing states’ EPSDT reports for our 2011 report, we found reporting errors large enough to overstate the extent to which children received services, and we found that states did not always report required data on the number of children referred for additional services. Further, the currently reported state data do not indicate whether children referred for preventive services actually received the services.

CMS has taken steps to better identify reporting errors and obtain corrected data, but as of September 2016, CMS has no plans to require states to report whether children received the treatment services for which they were referred. Our 2015 work on MCOs described above also points out the need for better data to understand MCO beneficiaries’ access to covered services, including differences in access that could help explain the wide variation in MCO payments per beneficiary we identified. Finally, given that PPACA requires states to cover certain recommended preventive services for newly eligible adults in states that expanded Medicaid under the law, data are needed to determine whether this coverage helps improve beneficiaries’ access to and receipt of these services.

Growing Expenditures for Long-Term Care Services

Medicaid is the nation’s primary payer of long-term care services and supports (LTSS) for aged and disabled individuals. Medicaid spending (federal and state) on LTSS is significant—in 2016, we reported LTSS spending was an estimated $152 billion in fiscal year 2014 (see figure 20), or about one-quarter of the program’s total expenditures annually. The demand for LTSS is expected to increase as the nation’s population ages and life expectancy increases, including individuals with disabilities and complex health needs who require long-term services and supports.

Monitoring of long-term care services provided in the community. Medicaid LTSS spending for services provided to beneficiaries in home- and community-based settings has grown rapidly and now exceeds spending for care provided in institutional settings, such as nursing homes. Monitoring and oversight of these services is important for ensuring quality of care, as the individuals who rely on these services are among Medicaid’s most vulnerable, and while home- and community- based services can enable people to live more independently, the services are not without risk.

In the case of personal care services—an important type of long-term care service to help individuals who have limited ability to care for themselves—beneficiaries receiving these services include aged individuals and individuals with physical, developmental, or intellectual disabilities. When personal care services are provided in a private home, other providers or community members may not be present to help discourage or report questionable activities. Further, depending on the state and the personal care services program, personal care attendants who provide personal care services may not be required to have specialized training. Personal care services—for which Medicaid paid $15 billion on a fee-for-service basis in calendar year 2015—are also among the highest at risk for improper payments, including for services which were billed but never provided to the beneficiary. In 2014, CMS estimated over $2 billion of payment errors for Medicaid personal care services. In 2016, we found that while CMS has taken several steps to improve oversight of personal care services, it has not collected all required state reports on beneficiaries’ health and welfare for some programs, and it could do more to harmonize the patchwork of federal program requirements intended to oversee beneficiary safety and assure that billed services are provided. Such harmonization would help ensure a more consistent administration of policies and procedures and could enhance oversight.

Finally, another important change in the delivery of Medicaid-funded LTSS is the rapid growth in managed care, which in 2014 accounted for almost 15 percent of Medicaid LTSS expenditures. We will continue to monitor Medicaid’s use of managed care to deliver LTSS as well as other aspects of the program’s growing support for LTSS and examine the implications for oversight.

What Remains to Be Done

We have a number of Matters for Congressional Consideration and recommendations to HHS and CMS for addressing issues related to financing, payment oversight, demonstration spending, and access- related issues.

We have suggested Congress take the following actions:

To improve the transparency of and accountability for certain high-risk Medicaid payments that total tens of billions of dollars annually, Congress should consider requiring CMS to improve reporting of and guidance related to certain supplemental payments and to require states to submit annual independent audits of such payments.

To improve the fiscal integrity of Medicaid, Congress should consider requiring increased attention to fiscal responsibility in approving Section 1115 Medicaid demonstrations by requiring the Secretary of HHS to improve the demonstration review process through steps such as (1) clarifying criteria for reviewing and approving states’ proposed spending limits, (2) better ensuring that valid methods are used to demonstrate budget neutrality, and (3) documenting and making public material explaining the basis for any approvals.

To ensure that federal funding efficiently and effectively responds to the countercyclical nature of the Medicaid program, Congress should consider enacting a federal matching formula that targets variable state Medicaid needs and provides automatic, timely, and temporary increased federal assistance in response to national economic downturns.

In addition, we have made recommendations to HHS and CMS, including:

To improve CMS’s oversight of Medicaid payments, the Administrator of CMS should develop (1) a policy establishing criteria for when such payments at the provider level are economical and efficient; and (2) a process for identifying and reviewing payments to individual providers, once criteria are developed, in order to determine whether they are economical and efficient.

To improve the transparency of the process for reviewing and approving spending limits for comprehensive section 1115 demonstrations, the Secretary of Health and Human Services should update the agency’s written budget neutrality policy to reflect actual criteria and processes used to develop and approve demonstration spending limits, and ensure the policy is readily available to state Medicaid directors and others.

To meet HHS’s fiduciary responsibility of ensuring that section 1115 waivers are budget neutral, the Secretary should better ensure that valid methods are used to demonstrate budget neutrality, by developing and implementing consistent criteria for considering proposals for section 1115 demonstration waivers.

To better understand the effect of certain personal care services on beneficiaries and more consistently administer policies and procedures across personal care services programs, the Secretary of HHS should direct the Administrator of CMS to (1) collect and analyze required state information on the impact of certain personal care services programs, and (2) take steps to further harmonize federal requirements across programs providing personal care services.

In light of the need for accurate and complete information on children’s access to health services under Medicaid and State Children’s Health Insurance Program (CHIP), CMS should work with states to identify additional ways to improve reports used to monitor children’s access to services, including identifying how to capture information related to whether children receive treatment services for which they are referred.

GAO Contact

For additional information about this high-risk area, contact Katherine Iritani at (202) 512-7114 or iritanik@gao.gov, or Carolyn L. Yocom at (202) 512-7114 or yocomc@gao.gov.

Related GAO Products

Medicaid Personal Care Services: CMS Could Do More to Harmonize Requirements Across Programs. GAO-17-28. Washington, D.C.: November 23, 2016.

Medicaid Fee-For-Service: State Resources Vary for Helping Beneficiaries Find Providers. GAO-16-809. Washington, D.C.: August 29, 2016.

Medicaid: Federal Guidance Needed to Address Concerns About Distribution of Supplemental Payments. GAO-16-108. Washington, D.C.: February 5, 2016.

Medicaid Managed Care: Trends in Federal Spending and State Oversight of Costs and Enrollment. GAO-16-77. Washington, D.C.: December 17, 2015.

Medicaid: Improving Transparency and Accountability of Supplemental Payments and State Financing Methods. GAO-16-195T. Washington, D.C.: November 3, 2015.

Medicaid: Overview of Key Issues Facing the Program. GAO-15-746T. Washington, D.C.: July 8, 2015.

Medicaid: Key Issues Facing the Program. GAO-15-677. Washington, D.C.: July 30, 2015.

Medicaid Demonstrations: More Transparency and Accountability for Approved Spending Are Needed. GAO-15-715T. Washington, D.C.: June 24, 2015.

Medicaid: Service Utilization Patterns for Beneficiaries in Managed Care. GAO-15-481. Washington, D.C.: May 29, 2015.

Medicaid Demonstrations: Approval Criteria and Documentation Need to Show How Spending Furthers Medicaid Objectives. GAO-15-239. Washington, D.C.: April 13, 2015.

Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited Data and Unclear Policy. GAO-15-322. Washington, D.C.: April 10, 2015.

Medicaid and CHIP: Reports for Monitoring Children’s Health Care Services Need Improvements. GAO-11-293R. Washington, D.C.: April 5, 2011.

Medicaid Improper Payments

Why Area Is High Risk

The Centers for Medicare & Medicaid Services (CMS) in the Department of Health and Human Services (HHS) has taken several actions that demonstrate its commitment to reduce improper payments, including using rulemaking to strengthen state capacity and oversight of managed care organizations (MCO) and the ongoing implementation of a new claims data system that could address issues with incomplete, inaccurate, and untimely state data. Despite these efforts, however, overall Medicaid improper payments continue to increase, rising to about $36.3 billion in fiscal year 2016 compared with $29.1 billion in fiscal year 2015.

We designated Medicaid as a high-risk program in 2003 in part due to concerns about the adequacy of the fiscal oversight that is necessary to prevent inappropriate program spending. This federal and state program covered acute health care, long-term care, and other services for an estimated 72.2 million low income and medically needy individuals in fiscal year 2016, making it one of the largest sources of funding for medical and health-related services. Under current law, the program is expected to continue to grow—covering as many as 13.2 million additional individuals by 2025—as states may expand their Medicaid programs under the Patient Protection and Affordable Care Act (PPACA). As with any estimate, changes to PPACA or other laws could affect the projected federal spending on major federal health care programs and federal revenues.

By design, Medicaid allows significant flexibility for states to design and implement their programs, which has resulted in over 50 distinct state- based programs. The federal government matches state expenditures for most Medicaid services using a statutory formula. The federal matching rate varies under the program, with increased federal matching funds for individuals newly eligible through the expansion of Medicaid under PPACA. The program is a significant expenditure for the federal government and the states, with total estimated expenditures of $575.9 billion in fiscal year 2016, of which $363.4 billion was financed by the federal government and $212.5 billion by the states.

Within broad federal guidelines, states have some discretion in setting Medicaid eligibility standards and provider payment rates, and in determining the amount, scope, and duration of covered benefits and how these benefits are delivered. For example, states may pay health care providers for each service they provide on a fee-for-service (FFS) basis; contract with MCOs to provide a specific set of Medicaid-covered services to beneficiaries and pay them a set amount per beneficiary per month; or rely on a combination of both delivery systems. Roughly three-fourths of Medicaid beneficiaries receive some or all of their services from MCOs, and payments to MCOs account for over one-third of federal Medicaid spending. Increased enrollment and spending for Medicaid-managed care makes effective federal and state oversight of this large and complex component of the Medicaid program critical.

The size and diversity of the Medicaid program make it particularly vulnerable to improper payments—including payments made for people not eligible for Medicaid or made for services not actually provided. Over recent years, improper payments have increased substantially and represent a significant cost to the program, an estimated $36.3 billion in federal dollars in fiscal year 2016. While states have the first-line responsibility for preventing improper payments, CMS has an important role in overseeing and supporting state efforts to reduce and recover improper payments. This high-risk assessment focuses solely on CMS’s efforts to prevent and reduce improper payments. Medicaid vulnerabilities include more than improper payments, and we discuss the broader challenges and risks associated with the Medicaid program separately (see page 520).

What GAO Found

As mentioned above, the continued growth in the overall estimated improper payment rate—10.5 percent in 2016 compared with 9.8 percent in 2015—underscores the need for additional federal action and has resulted in the agency partially meeting the 5 key criteria for removal from our High-Risk List: leadership commitment, capacity, action plan, monitoring, and demonstrated progress. Until additional actions are taken, gaps in oversight remain that will challenge CMS’s ability to reduce improper payments.

Congress has taken action to address improper payments and oversight challenges in the Medicaid program. For example, HHS identified provider screening and enrollment as a main area contributing to increased estimates in Medicaid improper payments, and Congress recently enacted legislation requiring MCOs only use providers that have been screened and enrolled by the appropriate state Medicaid program. The legislation also requires states to report information about terminated Medicaid providers to CMS and requires CMS to include such information, as appropriate, in the agency’s Medicaid provider termination notification system. Additionally, Congress has held several hearings related to Medicaid improper payments, including a May 2016 hearing held by the House Energy and Commerce Subcommittee on Oversight and Investigations and an October 2015 hearing held by the Senate Committee on Finance. Further indicating a continued focus on agency action on Medicaid program integrity, the chairmen of two congressional committees and subcommittees sent letters to CMS regarding Medicaid program integrity, including a letter on eligibility determinations and one on how CMS sets its target improper payment rate for the Medicaid program.

What Remains to Be Done

CMS has taken steps to improve the improper payment rate in recent years, including implementing certain recommendations we previously made and using rulemaking to strengthen program integrity efforts. Several of these efforts are in progress, with staggered compliance dates for changes to oversight of MCOs and continued state implementation of the Transformed Medicaid Statistical Information System (T-MSIS). For example, the requirement in the May 2016 managed care rule for states to audit the accuracy, truthfulness, and completeness of the financial data submitted by MCOs will not take effect until July 2017. Additionally, T- MSIS, which aims to collect more complete and timely state data, including claims and utilization data, is not fully implemented across all states. Continued oversight and leadership will be necessary in these areas.

Further, there are several areas where CMS needs to take action to address issues and recommendations that have not been fully implemented, including: considering which additional databases that states and Medicaid managed care plans use to screen providers, which could be helpful in improving the effectiveness of these efforts, and determining whether any of these databases should be added to the list of databases identified by CMS for screening purposes; developing a plan to regularly assess the effectiveness of checks for duplicate coverage between Medicaid and federally facilitated exchanges, including thresholds for the level of duplicate coverage it deems acceptable; continuing its efforts to work with Social Security Administration to share its Death Master File with states and providing additional guidance to states to better identify beneficiaries who are deceased; and conducting systematic assessments of federal determinations of Medicaid eligibility in states that delegated this authority to the federal marketplace until it is part of the regular review processes that are expected to resume in 2018.

Fully addressing these recommendations would help CMS address the growing levels of improper payments. Until CMS takes additional actions to address these and other gaps in oversight, the Medicaid program remains at risk for unacceptable levels of improper payments and therefore remains on our High-Risk List.

Additional Details on What GAO Found

Leadership Commitment

CMS continues to partially meet the criteria for leadership commitment to reducing improper payments; however, questions remain about the success of its efforts. Since 2014, the agency has reorganized its program integrity activities with the aim of creating more streamlined operations; established an agency-wide Program Integrity Board to identify and set priorities for addressing vulnerabilities in its programs; and taken steps to improve coordination activities with Medicare. CMS also published a final rule on Medicaid managed care in May 2016 that is intended to improve oversight of MCOs. The rule is responsive to our priority recommendations that CMS should hold states accountable for Medicaid MCO program integrity by requiring states to audit payments to and by MCOs, and updating its guidance on Medicaid managed care program integrity practices and effective handling of MCO recoveries. As 1 example, the rule requires that states, at least once every 3 years, audit the data submitted by MCOs with contracts starting on or after July 1, 2017. Prior to issuance of this rule, there had been no requirement for states to audit payments to and by MCOs. However, given that CMS only recently reorganized its program integrity activities, and issued the new rule, and that the rule’s provisions will be implemented in staggered time frames that extend to 2018, the effects on program integrity efforts are unclear.

Further, additional leadership is needed to address remaining weaknesses in federal oversight, including ensuring complete, accurate, and timely data to support oversight and program integrity efforts. CMS is continuing its national effort to implement the T-MSIS. However, implementation has been delayed for several years, and it remains unclear when data will be available from all states or how CMS will use these data for oversight purposes.

Capacity

CMS continues to partially meet the criteria for capacity. The agency has taken actions to enhance the resources and guidance available to states for program integrity purposes. For example, CMS issued a final rule in December 2015 that permanently extends the availability of a 90 percent federal match for states’ expenditures related to enhancing or replacing their Medicaid eligibility and enrollment information technology (IT) systems, and aims, in part, to enhance states’ program reporting and management tools to support program integrity efforts. In addition, the May 2016 managed care rule includes provisions to strengthen data available on managed care utilization and imposes financial consequences on states that do not submit MCO utilization data. For example, state contracts with MCOs must provide for the collection and maintenance of sufficient data on managed care service utilization, also known as encounter data, and states must have procedures to ensure that these required enrollee encounter data are complete and accurate. However, these provisions do not take effect until July 2017 or 2018, so their success in improving data available for program integrity is unknown and will depend on how states and CMS implement them.

In response to our 2015 priority recommendation to support state third- party liability efforts, CMS produced an updated guide to compile and share effective and innovative Medicaid third-party liability practices reported by states, an important tool that could help states ensure that Medicaid pays only after other liable third parties. In response to our priority recommendation to provide guidance to states on their oversight of third-party liability efforts conducted by Medicaid managed care plans, CMS subsequently published a handbook, which provides guidance to states on third party liability efforts, including such efforts conducted by Medicaid MCOs. Finally, our recent work has also identified limitations in program integrity efforts in Puerto Rico and other U.S. territories that put Medicaid funding in these areas at risk for fraud, waste, and abuse, and underscore the need for CMS to develop a cost-effective approach to protecting Medicaid funding in these territories.

Action Plan

CMS has documented a strategic approach to reducing improper Medicaid payments, but only partially meets the criteria due to a missing report the agency is legally required to provide to Congress. In July 2014, CMS issued the Comprehensive Medicaid Integrity Plan for fiscal years 2014 through 2018, in which CMS established goals to expand its capacity to protect the program’s integrity and manage risk in administering federal grants to states. The agency is required to report to Congress annually on the use and effectiveness of funds appropriated for the Medicaid Integrity Program. The agency reported for fiscal years 2013 and 2014 in July 2016, well after the required timeframes, and the agency is out of compliance with the requirement for fiscal year 2015 because it has not submitted a report for fiscal year 2015, as of December 2016.

With regard to specific actions, CMS has taken steps to identify duplicate coverage for individuals transitioning from Medicaid to federally facilitated exchanges created under PPACA, and had performed three checks as of October 2016. In response to our priority recommendation that CMS establish a schedule for regular checks for duplicate coverage, CMS reported that it intends to check for duplicate coverage at least two times per coverage year going forward. CMS also reported that it was reviewing these data to assess whether the checks were effective. However, the agency has not developed a plan, including thresholds for the level of duplicate coverage it deems acceptable, to routinely monitor the effectiveness of these checks.

Monitoring

CMS continues to partially meet the criteria for monitoring. CMS has enhanced its oversight of states’ program integrity activities, particularly by increasing its focus on collaborative audits and working with states to improve compliance with PPACA’s provider screening requirements. In focusing on collaborative audits, CMS has engaged more states than before, targeted federal audit resources to state needs, and identified an increasing amount of overpayments. In addition, CMS now provides states with federal data to strengthen Medicaid provider enrollment screening and has provided guidance and technical assistance to assist states on their revalidation efforts. CMS also recently provided additional guidance to states on specific provider screening and reporting provisions included in the 21st Century Cures Act. Our prior work has shown that available federal data do not include all of the information necessary for states to effectively and efficiently process Medicaid provider applications. Due to this issue and other challenges, we found that states and managed care plans rely on fragmented information from multiple and disparate databases to screen managed care providers, and often struggle to access and use these databases because of difficulties conducting provider matches across databases.

CMS also needs to take additional steps to better monitor states’ beneficiary eligibility determinations. Specifically, we found that CMS is not always able to assess the accuracy of federal Medicaid eligibility determinations, which is particularly problematic where states delegate this determination authority to the federal government through federally facilitated exchanges. While CMS is relying upon operational controls within the federal marketplaces to ensure accurate eligibility determinations, without a systematic review of these determinations, the agency lacks a mechanism to ensure that only eligible individuals are enrolled in the program and to identify associated improper payments until CMS’s updated eligibility review program resumes in 2018.

Demonstrated Progress

CMS continues to partially meet the criteria for demonstrated progress. The agency has taken actions to improve federal and state oversight of Medicaid MCOs, to extend funding to help states modernize their eligibility systems, and to help states come into compliance with recent legislation by providing updated guidance. Nonetheless, additional actions are warranted to identify and reduce improper payments, given the rise in the Medicaid improper payment rate and expected growth of the Medicaid program.

Several factors will complicate CMS efforts to identify improper payments. Specifically, CMS’s improper payment rate estimates may be inaccurate because the agency has frozen a component used to calculate improper payments based on beneficiary eligibility through fiscal year 2018. Additionally, CMS estimates of improper payments to MCOs do not consider underlying medical data such as the use of medically unnecessary services and other contributing factors. Finally, CMS will not fully implement certain provisions to strengthen program integrity in Medicaid managed care—such as requiring MCOs to only use providers that have been screened and enrolled by the appropriate state Medicaid program—until January 2018. Thus, it is critical that CMS take other actions to ensure that only providers in good standing participate in the program during this interim period.

Benefits Achieved by Implementing Our Recommendations

CMS is conducting collaborative audits with states, which allows the states to augment their own program integrity audit capacity by leveraging the resources of CMS and its audit contractors. These efforts have increased the amount of identified Medicaid overpayments.

CMS provided training to states through the Medicaid Integrity Institute on correct reporting of program integrity recoveries. Efforts to ensure correct reporting of recoveries will make it easier for CMS to determine whether states are returning the federal share of recovered overpayments.

CMS posted guidance on its website regarding the requirements that must be met in order for Medicaid administrative expenditures to be eligible for federal matching funds. A CMS official said that the agency ensures that the policies are applied consistently across all states through internal training. These efforts should improve CMS’s financial management of Medicaid administrative claiming activities.

CMS reconfigured the National Medicaid Audit Program to eliminate the review contractor function altogether in response to concerns that the federal review was duplicative of actions undertaken by audit contractors within a state or geographic area. By eliminating duplication in the review function, CMS will realize greater efficiencies in its audits and reduce state burden.

GAO Contact

Related GAO Products

Medicaid: Program Oversight Hampered by Data Challenges, Underscoring Need for Continued Improvements. GAO-17-173. Washington, D.C.: January 6, 2017.

Medicaid Program Integrity: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers. GAO-16-402. Washington, D.C.: April 22, 2016.

Medicaid and CHIP: Increased Funding in U.S. Territories Merits Improved Program Integrity Efforts. GAO-16-324. Washington, D.C.: April 8, 2016.

Nonemergency Medical Transportation: Updated Medicaid Guidance Could Help States. GAO-16-238. Washington, D.C.: February 2, 2016.

Medicaid: Additional Federal Controls Needed to Improve Accuracy of Eligibility Determinations and for Coordination with Exchanges. GAO-16-157T. Washington, D.C.: October 23, 2015.

Medicaid: Additional Efforts Needed to Ensure That State Spending Is Appropriately Matched with Federal Funds. GAO-16-53. Washington, D.C: October 16, 2015.

Medicaid and Insurance Exchanges: Additional Federal Controls Needed to Minimize Potential for Gaps and Duplication in Coverage. GAO-16-73. Washington, D.C.: October 9, 2015.

Medicaid: Key Issues Facing the Program. GAO-15-677. Washington, D.C.: July 30, 2015.

Medicaid: Additional Actions Needed to Help Improve Provider and Beneficiary Fraud Controls. GAO-15-313. Washington, D.C: May 14, 2015.

Medicaid: Additional Federal Action Needed to Further Improve Third- Party Liability Efforts. GAO-15-208. Washington, D.C.: January 28, 2015.

Improving and Modernizing Federal Disability Programs

Why Area Is High Risk

programs that support employment can divert individuals from the disability rolls, these programs lack a unified vision, strategy, or set of goals to guide their outcomes. We first designated improving and modernizing federal disability programs as high risk in 2003.

What GAO Found

The federal government’s progress in improving and modernizing disability programs remains mixed. We assessed progress across five broad areas: two reflecting SSA’s and VA’s actions to manage their disability claims workloads; two reflecting SSA’s and VA’s progress to modernize their criteria for deciding who is eligible for disability benefits; and, lastly, the Office of Management and Budget’s (OMB) efforts to create unified strategies and goals for programs that support employment for people with disabilities. Some of the agencies we assessed met certain criteria while others did not, and when combined, the resulting summary rating shows that the five criteria were partially met. SSA and VA have continued to make progress managing their claims workloads, but both agencies currently face challenges managing their appeals backlogs. SSA and VA also have made progress updating the criteria they use to determine eligibility for disability benefits, especially with respect to developing action plans. In terms of plans to mitigate the potential effects of program fragmentation, OMB—which performs a management role for the executive branch—has made some progress developing plans to test interventions that may improve employment outcomes in the private as well as public sector, but has not yet developed a unified vision, or government-wide goals and related strategies for improving employment outcomes outside of the federal sector.

With respect to SSA updating the criteria it uses to determine eligibility for benefits, more needs to be done to address this high-risk issue, but in response to our 2012 recommendation, SSA took action that resulted in cost savings. Specifically, SSA replaced its earlier, highly ambitious plans to develop its own occupational information system (OIS) (to house occupational data used to make disability determinations) with a potentially more cost-effective approach that uses existing expertise and resources in the federal government. In doing so, SSA partnered with the Bureau of Labor Statistics (BLS) to collect and update occupational information by surveying employers. As a result of SSA implementing our recommendation, we determined that, as of 2015, SSA saved approximately $27 million dollars.

What Remains to Be Done

council to run early intervention demonstration programs, which has the potential to uncover approaches worth pursuing at a national level. However, to date, the proposed council to achieve that vision has not been funded. Further, while common measures recently implemented will help assess the relative success of specific programs across agencies, the prior administration did not develop goals or strategies for measuring and tracking the cumulative effect of disparate programs on employment outcomes beyond the federal sector—which could also help inform and target the types of interventions to be piloted by the new administration.

Additional Details on What GAO Found

Managing Disability Claims Workload (SSA)

Since our 2015 update, SSA has demonstrated mixed progress in addressing its workload challenges, such that partially met ratings did not change from 2015. Specifically, SSA made progress reducing its backlog of initial disability claims, while its appeals workload continued to grow.

Leadership Commitment

Since our 2015 high-risk report, SSA has continued to meet our leadership criterion. As described below, SSA officials told us that they continued to develop plans to implement its Vision 2025—a long-term strategic plan that articulates how SSA will serve its customers in the future. SSA also designated reducing wait times for hearings decisions as a priority goal for fiscal years 2016 and 2017.

Capacity

SSA continued to partially meet our criterion for building capacity. With respect to ensuring sufficient capacity at the initial claims level, while SSA has reduced the number of pending initial claims each year since 2010, efforts to further reduce costs and process claims more efficiently using technology were stalled. Specifically, SSA halted development of its Disability Case Processing System (DCPS), after a consulting firm contracted by SSA reported the agency spent about $288 million with few results. Subsequently, SSA selected a new development path for the DCPS, and officials still expect that DCPS will improve workflows and reduce administrative costs; however, SSA’s Office of Inspector General found that SSA did not evaluate all alternatives or consider all costs required to maintain a new system before pursuing a DCPS alternative. SSA officials reported in October 2016 that the agency was developing an initial product to deliver to three test sites focused on processing certain fast-track claims. To address its priority goal of reducing the time for hearing decisions, officials reported that SSA increased the number of administrative law judges (ALJ) who decide appeals cases by 349 in fiscal years 2015 and 2016—about a 24 percent increase. In its plan to address its appeals backlog, SSA noted that it is exploring ways to improve ALJ hiring in difficult-to-staff locales, leverage SSA’s Office of Quality Review to obtain assistance with critical case processing activities, and use judges from the Appeals Council to hold hearings on some cases. However, SSA officials noted in October 2016 that plans to increase hiring and leverage other resources are on hold due to a hiring freeze expected to extend into fiscal year 2017.

Action Plan

their hearings, and sharing resources across the agency to help process appeals at backlogged hearing offices; and improving the use of information technology (IT), such as expanding the use of video hearings, providing online records access to medical and vocational experts, and reducing the use of physical paperwork at hearings-level cases.

While this plan is a positive step, the extent to which proposed actions will reduce the hearings backlog remains to be seen. In September 2016, SSA’s OIG reported that more than half of the initiatives in the agency’s plan duplicated past backlog initiatives, including a 2007 plan that did not result in long-term reductions of the backlog. Additionally, SSA notes in its plan that some efforts, such as increased hiring, will depend on the agency receiving additional funding. Regarding SSA’s broader Vision 2025 effort, officials told us that SSA is still in the process of developing plans to implement it. Among other things, Vision 2025 touches on the agency’s capacity to process initial claims and appeals. SSA officials told us that SSA is integrating aspects of Vision 2025 into its fiscal year 2018- 2022 strategic plan—scheduled to be issued in January 2018—and conducting working sessions with a cross-section of SSA employees to gather input about how to realize Vision 2025 priorities.

Monitoring

SSA continued to meet our criterion for monitoring by continuing to monitor and report on the timeliness of its initial claims and appeals workloads.

Demonstrated Progress

SSA partially met our criterion, demonstrating mixed progress. In addressing its initial claims backlogs, SSA continued to reduce the number of pending claims in each fiscal year since 2010—from about 842,000 in fiscal year 2010 to 621,000 in fiscal year 2015. However, the timeliness of its appeals workload worsened. The number of hearings pending as of the end of 2016 was over 1.1 million and the average time needed to complete appeals increased from 353 days in fiscal year 2012 to 545 days in fiscal year 2016. SSA’s goal is to eventually reduce this time to 270 days, as articulated in its appeals reform plan.

Managing Disability Claims Workload (VA)

Since our 2015 high-risk update, VA has demonstrated mixed progress in addressing its workload challenges. Progress is evident in regards to VA’s efforts to reduce the Veterans Benefit Administration’s (VBA) compensation claims backlog. However, VA’s appeals workload continued to grow, and several efforts to address this challenge are still underway. In particular, VA’s proposed framework to reform the appeals process—developed by VBA and the Board of Veterans’ Appeals (Board)—requires legislative authority to pursue. We have ongoing work related to VA’s efforts to address appeals workloads and timeliness that we plan to issue in the first quarter of 2017.

Leadership Commitment

VA continued to meet our criterion for leadership commitment. Since 2015, VA tracked progress toward eliminating the disability compensation claims backlog, an agency priority goal set for fiscal years 2014 and 2015. It also renewed its commitment to reducing appeals inventories and improving timeliness of appeals decisions by updating its appeals strategic plan in 2016, making development of a simplified appeals process 1 of VA’s 12 breakthrough priorities for 2016, and working closely with veterans service organizations (VSO) and other stakeholders to propose a new framework and associated legislation to reform the current appeals process.

Capacity

evidence is received. VA states that these automation capabilities will increase the efficiency of compensation claims processing; and implementing a national work queue distribution tool at all regional offices that should allow VA to electronically distribute claims across regional offices to even out workloads.

According to VA, these efforts have resulted, to date, in reducing the compensation claims backlog by 88 percent from a peak of 611,073 claims in March 2013 to a low of 71,690 as of September 30, 2016. Further, VA reported that it increased compensation claim productivity per full-time equivalent (FTE) by 25 percent since 2011. However, it remains to be seen if VA can maintain these gains as workloads are projected to increase in the future.

At the appellate level, VA proposed a streamlined appeals framework through which it hopes to gain efficiencies; however this new framework—which is still in the planning stages—requires legislative authority to implement. VA is developing and implementing technology improvements that could result in enhanced productivity, such as a new appeals processing system that would better support a paperless process. VA also added 300 FTEs at VBA to help process appeals in fiscal years 2015 and 2016, and according to agency officials, VA received a 42 percent increase in funding for the Board in fiscal year 2017 that will support the hiring of additional FTEs. VA plans further improvements related to capacity, such as increasing human resources and training support, and is developing a recruitment plan with the Office of Personnel Management (OPM) to hire additional staff, primarily in the attorney role. However, these staffing increases and technology improvements were underway as of January 2017, and it is too early to determine the extent to which the sum of these efforts will improve VA’s capacity to process appeals.

Action Plan

providing veterans with a more simple, timely, transparent, and fair appeals process. While potentially promising, as of October 2016, VA was still developing implementation plans and did not have legislative authority to pursue its proposed reforms. Regarding staffing, VA officials reported in March 2016 that they were working with OPM on a strategic recruitment plan, but had not finalized this plan.

Monitoring

VA partially met our criterion for monitoring. VA continued to have clear goals for processing compensation claims and a system for monitoring them on a regular basis; however, gaps exist in VA’s ability to measure performance and proposed process changes related to appeals. In fiscal year 2015, VA developed new measures to publicly report appeals processing performance in its Annual Performance Reports, which VA officials said focus on the discrete steps in the appeals process and help show where bottlenecks exist. However, VA no longer publicly reports the total average amount of time needed across VBA and the Board to resolve an appeal. As we noted in our 2015 update, not reporting broad measures—such as the average time needed to resolve appeals across VA—reduces the transparency of VA’s progress. Additionally, VA currently lacks data that could help it more fully understand factors currently affecting appeals decision timeliness, such as data on the number of actions taken on cases or the number of times claims were re- reviewed because new evidence was submitted. To help address this, VA officials told us that they are developing a data dashboard as a part of IT improvements, but it is too early to tell how the agency will use the dashboard to evaluate proposed improvements to the appeals process.

Demonstrated Progress

VA partially met our criterion for demonstrating progress. VA continued to make progress with reducing its compensation claims backlog. Specifically, VA decreased the total inventory of compensation claims by 57 percent from a peak of 883,930 in fiscal year 2012 to 377,107 in fiscal year 2016. Additionally, VA has improved its claim processing timeliness by reducing the average length of time a claim is pending from an average of 282 days in fiscal year 2013 to 85 days in fiscal year 2016.

2012 to 936 days in fiscal year 2015. Appeals that were decided by the Board in fiscal year 2015 required an average of 1,789 days for a decision, compared to an average of 1,691 days in fiscal year 2012.

Updating Disability Benefit Eligibility Criteria (SSA)

Since 2015, SSA has continued to make progress on several fronts to update the criteria that it uses to determine eligibility for disability benefits. SSA’s progress is evident across the five high-risk criteria, especially with respect to capacity and action plans, which improved from partially met to met. However, SSA has not yet finished reviewing all medical listings, and is still developing and testing its approach for updating occupational information that is also used to determine eligibility. It is also unclear how SSA will consider incorporating the results of a study on accommodations in the workplace into its decision-making process.

Leadership Commitment

SSA continued to meet our criterion for leadership commitment, by maintaining focus and ensuring progress toward updating the medical criteria and occupational information used to determine eligibility for disability benefits, as well as by agreeing to study the role of assistive technologies and workplace accommodations in mitigating impairments, and how this might be considered in its disability decision making.

Capacity

the first update of occupational data (due to be completed in 2024) will be $178 million. We found SSA’s cost estimate to contain sufficient analysis and information to support its scaled-back and more feasible approach for developing an OIS. Thus, SSA met the intention of our prior recommendation that it develop life-cycle cost estimates for the project in accordance with best practices, which may help SSA make program decisions and ensure sufficient resources are allocated to the effort. With respect to our prior recommendation to consider the roles of assistive technologies and workplace accommodations in disability decision making, SSA built capacity by tasking the Health and Medicine Division (HMD) of the National Academies of Sciences, Engineering, and Medicine under a contract to study this issue. Its final report is due in July 2017.

Action Plan

SSA has also met our criterion for developing action plans, improving from partially met in 2015. As we noted earlier, SSA has plans in place for updating its medical criteria, and it continued to make progress towards its goals. With respect to updating its OIS, SSA has developed a project plan for developing the OIS, and recently provided a life-cycle cost estimate as noted earlier. Lastly, SSA tasked HMD under a contract to further study the issue of how assistive technologies and workplace accommodations can affect disability determination decisions, with a proposed completion date of July 2017.

Monitoring

SSA continued to meet the criterion of monitoring progress toward updating its medical criteria, and has project plans and schedules against which to monitor its progress toward developing a new OIS to replace its outdated Dictionary of Occupational Titles.

Demonstrated Progress

SSA partially met our criterion for demonstrating progress. With respect to updating its medical listings, SSA officials reported that, as of October 2016, the agency had published final rules for 13 of the 14 body systems for adults, and drafted a proposed rule for the remaining system. SSA expects to publish that final rule in 2017 once OMB under the new administration has reviewed it. Officials stated they are on track to revisit the 14 body systems every 3 to 5 years once the first round of comprehensive updates is complete. SSA officials also reported steady progress updating its occupational information.

In 2016, SSA and BLS completed the first year of its 3-year cycle of collecting survey data for the OIS, which followed its completion of a large-scale, preproduction test involving collecting occupational information from about 2,500 employers.

In May 2016, SSA officials also reported that they are working with a contractor to develop a Web-based system to house its occupational data, which they expect to complete in fiscal year 2017.

With respect to assistive technologies and workplace accommodations, officials reported progress under SSA’s contract with HMD to study workplace accommodations and assistive technologies. Officials reported that HMD held public forums in July and September 2016 and invited experts to present information on various aspects of workplace accommodations and assistive technologies, which HMD plans to incorporate into its report findings. SSA expects HMD to conclude its study by July 2017, but it remains to be seen whether and how SSA will consider the results of the study in its decision-making process.

Updating Disability Benefit & Eligibility Criteria (VA)

VA continued to make progress toward updating the medical criteria that it uses to determine eligibility for disability compensation, and has now improved to met for action plan and monitoring. However, VA has experienced delays, and officials told us that VA will not meet its prior target for completing this effort by March 2017.

Leadership Commitment

VA met our criterion for leadership commitment. As noted in sections below, VA leadership continued to dedicate attention and resources to completing an initial revision of its medical criteria and developing plans to keep them updated.

Capacity

VA partially met our criterion for capacity. Since 2015, VA has taken steps to ensure it has the capacity to revise and maintain its medical criteria, and officials told us that VA has drafted or is in the process of drafting revised regulations for 14 of the 15 body systems. However, VA will not meet its target date for completing a final review and revision of all body systems by March 2017. Specifically, officials told us that VA: finished impact analyses—studies of how revisions will affect veterans’ disability ratings—for 10 of 15 body systems and extended timelines for completing analyses for the remaining body systems to the end of calendar year 2017; promulgated proposed regulations for 5 of 15 body systems with plans to finalize 4 of those 5 by its original target date of March 2017, and extended its target dates for finalizing new rules for all body systems until the end of fiscal year 2018; and plans to assemble cross-functional teams to identify what changes VA will need to make to its policies, procedures, communications, training, and computer systems to implement the regulations, which VA officials said is in accordance with the agency’s standard process for implementing new and revised regulations.

In addition, officials told us that VA lacks the necessary internal resources or expertise to conduct earnings loss studies, which take into account how advances in medical treatments and assistive technologies might be used to reduce functional loss due to disability. As such, VA requested funding for a new earnings loss study to begin in 2017. If funding is not provided, VA officials noted that they will use any available information to meet VA’s goal of reviewing and revising its medical criteria on a staggered 5-year cycle. We will continue to monitor VA’s efforts toward making fact-based and timely revisions to the VA ratings schedule, and ultimately implement these revisions in its decision making process.

Action Plan

VA has now met our criterion for action plans, up from partially met in 2015. VA made noteworthy progress in accordance to its original project plan, as noted above, and updated timeframes in its plan in response to delays. VA officials currently expect to promulgate final rules for all body systems by the end of fiscal year 2018. Moreover, officials also told us that VA is on track to achieve its plans to keep criteria current once initial updates are complete by placing each of the 15 body systems into a 5- year cycle of staggered reviews, and intends to document work plans and maintain working groups for each system to ensure that medical advancements and new research are incorporated as necessary.

Monitoring

VA met our criterion for monitoring, up from partially met in 2015. Since August 2013, VA has tracked its progress against its project plan for finishing its first round of updates of medical criteria, completing earning loss studies, and ensuring all body systems are updated once every 10 years. In doing so, it has also updated its project plan to include new timeframes for completing its first round of updates in response to delays described below.

Demonstrated Progress

VA partially met our criterion for demonstrated progress. Since 2015, VA has continued to make progress updating its medical criteria, but, as previously mentioned, VA will not meet its target to review and revise regulations for all body systems by March 2017. Specifically, it is not on target to promulgate regulations for 11 of the 15 body systems it is updating, and now expects to promulgate proposed regulations for the 11 systems by the end of fiscal year 2017, and final regulations by the end of fiscal year 2018. Officials also reported progress in completing impact analyses; as of August 2016, VA had completed analyses for 10 of the 15 body systems. VA extended timeframes for the 5 remaining analyses to be completed by the end of 2017, prior to the new target date for promulgating final regulations. We will continue to monitor VA’s progress toward finalizing regulations for all body systems, and, as referenced earlier, how it will keep earnings loss information updated.

Programs with Unified Strategies and Goals (OMB)

Since our 2015 update, OMB has made some progress towards enhancing coordination and capacity across programs that support employment for people with disabilities. Some progress is evident in all five high-risk criteria. However, the scope of its current efforts to improve employment outcomes and coordination is limited to federal agencies and contractors, and OMB has not yet articulated a broader vision for supporting employment for people with disabilities outside the federal sector that includes appropriate government-wide goals and strategies for achieving them.

Leadership Commitment

promising, they continue to fall short of developing government-wide strategies and measurable goals to help people with disabilities attain employment in both the public and private sectors. Finally, OMB officials told us that they are preparing transition plans to help ensure current efforts continue under the new administration, but it remains to be seen whether the administration will support and sustain these efforts.

Capacity

OMB continued to partially meet our criterion for building capacity. In addition to proposing the creation of the Council and issuing a resource guide for employers regarding people with disabilities, OMB officials noted that the prior administration took two other actions to improve the capacity for agency coordination:

The Departments of Education and Labor finalized regulations under the Workforce Innovation and Opportunity Act (WIOA), which includes a provision that requires states to set aside funds to assist students with disabilities transition from school to postsecondary education or the workforce, and allows state vocational rehabilitation agencies to prioritize serving students with disabilities.

The administration proposed increased funding for supported employment programs in fiscal years 2016 and 2017 that could, for example, provide supported employment services for up to 2 years for individuals already in vocational rehabilitation programs. These efforts, however, are limited in scope or have not yet been implemented. Moreover, they do not relate to creating capacity for establishing goals and other mechanisms to ensure agencies are accountable for having a measureable impact on employment outcomes outside the federal sector.

Action Plan

OMB continued to not meet our criterion for developing action plans. As mentioned previously, the prior administration proposed establishing the Council. While the proposed Council is a promising approach, the Council has not received—as of January 2017—funding for fiscal year 2017, and it remains to be seen whether this proposal will be funded in the future. Moreover, the administration has yet to establish government-wide goals for people with disabilities achieving employment outside the federal sector. To help ensure focus through the new administration, OMB officials noted that, in addition to OMB developing transition plans, a number of agencies have 5-year strategic plans that will span the outgoing and incoming administrations. OMB officials also noted that it is ultimately up to the new administration to decide how to plan and coordinate across federal disability programs.

Monitoring

OMB partially met our criterion for monitoring. Since 2015, the administration continued to track and work toward increasing employment for people with disabilities at federal agencies, achieving the former President’s goal of hiring 100,000 employees with disabilities over 5 years. With respect to the goal to have people with disabilities comprise 7 percent of federal contractors, OMB officials told us that Labor is updating its case management system to track progress toward this goal. They added that Labor will collect information on contractor performance against this goal as it conducts compliance evaluations, thereby creating a good source of trend data over time. With respect to standardizing the way programs and agencies measure employment, OMB officials told us that the prior administration took a number of steps:

The Departments of Labor and Education promulgated a joint final rule, pursuant to a requirement in WIOA, which defines common measures to be used by the six core job training programs under the two departments.

Other programs, such as the Supplemental Nutrition Assistance Program’s Employment and Training program, have adopted similar measures.

OMB officials stated that it is coordinating an interagency group to ensure all relevant agencies develop the necessary data infrastructure to collect information on these common measures.

OMB officials said that the administration worked with VA to add employment-oriented measures to its Vocational Rehabilitation and Employment Program. Relatedly, officials noted that it is reasonable to expect the manner in which programs and agencies measure employment to vary to reflect the different challenges they face.

While common measures are helpful in measuring across programs, they do not provide and OMB still lacks a comprehensive picture of how disparate federal efforts support employment of those with disabilities outside the federal sector.

Demonstrated Progress

permanent employees with disabilities—including 98,000 full-time employees—exceeding the former President’s goal of hiring 100,000 over this period. However, additional hiring goals have not been set and OMB officials said it is up to the new administration whether and how to do so. With respect to the administration’s goal to have people with disabilities comprise 7 percent of most federal contractors, OMB officials reported that Labor’s initial results from this effort will not be available until mid- 2017. With respect to implementing measures across programs, OMB officials told us that, although the administration has yet to develop government-wide goals for the employment of people with disabilities across all sectors, they anticipate that demonstration projects overseen by the Council, if implemented, would identify successful early intervention approaches, which would inform the development of reasonable outcome measures.

Benefits Achieved by Implementing Our Recommendations

SSA Workloads: In response to a past recommendation, SSA appointed a chief strategic officer responsible for coordinating agency- wide planning efforts, including those related to managing SSA’s disability claims workloads.

VA Workloads: Consistent with our past recommendation, in 2013 VA published its Strategic Plan to Eliminate the Compensation Claims Backlog, which identified implementation risks and metrics for the major initiatives mentioned in the Plan.

SSA Modernizing: In response to past recommendations, SSA developed a project plan to assess risks to the success of the OIS, and has taken steps to estimate costs for necessary data collection and planned IT expenditures. SSA also worked with BLS to contract with experts to ensure they had the appropriate expertise to complete the OIS. products and technologies for adults, and a final report for SSA is expected in July 2017.

VA Modernizing: In response to a past recommendation, in 2013 VA developed a project management plan that included plans for initiating subsequent updates to its disability rating schedule at regular intervals—whereby reviews of each body system are initiated on a staggered 5-year cycle to ensure no more than 10 years transpires without a review and possible revision of each body system.

VA Modernizing: In response to a past recommendation, in 2014 VA updated its project management plan to reflect planned actions—such as identifying human resources to assist in developing and implementing proposed changes, and needed updates to guidance, training and systems—that would ensure smooth and timely implementation of revisions to its ratings schedule.

GAO Contact

For additional information about this high-risk area, contact Barbara Bovbjerg at (202) 512-7215 or bovbjergb@gao.gov.

Related GAO Products

Social Security Disability: SSA Could Increase Savings by Refining Its Selection of Cases for Disability Review. GAO-16-250. Washington, D.C.: February 11, 2016.

Veterans Disability Benefits: VA Can Better Ensure Unemployability Decisions are Well Supported. GAO-15-464. Washington, D.C.: July 2, 2015.

Veterans’ Disability Benefits: Improvements Could Further Enhance Quality Assurance Efforts. GAO-15-50. Washington, D.C.: November 19, 2014.

Social Security Administration: Long-Term Strategy Needed to Address Key Management Challenges. GAO-13-459. Washington, D.C.: May 29, 2013.

Veterans’ Disability Benefits: Timely Processing Remains a Daunting Challenge. GAO-13-89. Washington, D.C.: December 21, 2012.

VA Disability Compensation: Actions Needed to Address Hurdles Facing Program Modernization. GAO-12-846. Washington, D.C.: September 10, 2012.

Employment for People with Disabilities: Little Is Known about the Effectiveness of Fragmented and Overlapping Programs. GAO-12-677. Washington, D.C.: June 29, 2012.

Modernizing SSA Disability Programs: Progress Made, but Key Efforts Warrant More Management Focus. GAO-12-420. Washington, D.C.: June 19, 2012.

Pension Benefit Guaranty Corporation Insurance Programs

Why Area Is High Risk

With nearly $100 billion in assets, the Pension Benefit Guaranty Corporation’s (PBGC) financial portfolio is one of the largest of any federal government corporation. Through its single-employer and multiemployer insurance programs, PBGC insures the pension benefits of nearly 40 million American workers and retirees who participate in nearly 24,000 private-sector defined benefit plans. PBGC’s financial future remains uncertain, due in part to a long-term decline in the number of traditional defined benefit plans and the collective financial risk of the many underfunded pension plans that PBGC insures. We designated the single-employer program as high risk in July 2003 and added the multiemployer program in January 2009.

Since fiscal year 2013, PGBC’s financial deficits have more than doubled. At the end of fiscal year 2016, PBGC’s net accumulated financial deficit was over $79 billion—an increase of about $44 billion since 2013. At the same time, PBGC estimated that its exposure to future losses for underfunded plans was nearly $243 billion. The single-employer program, composed of about 22,200 plans, accounted for $20.6 billion of PBGC’s overall deficit (see figure 21). The multiemployer program, composed of only about 1,400 plans, accounted for about $59 billion. According to PBGC, these dramatic increases were attributable to broad economic factors and financial conditions of the plans PBGC insures.

Various laws have been enacted to strengthen PBGC’s financial position. For instance, the Pension Protection Act of 2006 (PPA) strengthened pension funding requirements for plans, the Moving Ahead for Progress in the 21st Century Act (MAP-21) included measures to increase premium rates and the Bipartisan Budget Act of 2013 increased premium rates further. However, some of this legislation also included provisions that would allow single employer plan sponsors to defer mandatory contributions to their defined benefit pension plans. To the extent that sponsors reduce contributions in the short term, they may increase plan underfunding and expose PBGC to greater risk. Recognizing the dramatic increase in PBGC’s deficit because of particular financial and demographic challenges facing many multiemployer plans, the Multiemployer Pension Reform Act of 2014 (MPRA) was enacted in December 2014 with a number of provisions to promote the long-term viability of the multiemployer program.

What GAO Found

As with our last report in 2015, there is no rating for this high-risk area because addressing the issues in this area primarily involves congressional action, while the high-risk criteria and subsequent ratings were developed to reflect the status of agencies’ actions and the additional steps they need to take.

While PBGC faces a significant long-term challenge with its single- employer program, it faces an immediate and critical challenge with its multiemployer program. In a 2013 report, we recommended that Congress consider comprehensive and balanced structural reforms to reinforce and stabilize the multiemployer system. In December 2014, Congress took action to address the growing crisis in the multiemployer pension system by passing MPRA, which enacted several reforms responsive to our 2013 report on PBGC’s multiemployer program. Specifically, MPRA provided severely underfunded plans, under certain conditions and only with the approval of federal regulators, the option to reduce the retirement benefits of current retirees to avoid plan insolvency and expanded PBGC’s ability to intervene when plans are in financial distress. In addition, MPRA doubled the premiums paid by multiemployer plans (from $13 to $26 per participant). While these reforms are intended to improve the program’s financial condition, projections suggest that the future insolvency of the multiemployer program remains likely. Prior to passage of MPRA, PBGC estimated that the multiemployer insurance fund would likely be exhausted by 2022 as a result of current and projected plan insolvencies. PBGC officials noted that the act did not fully address the crisis in the multiemployer program and they predict that the changes will only forestall insolvency of the program probably by about an additional 3 years. Current estimates indicate that these changes will allow some plans to stay solvent and will reduce the cumulative unmet need for financial assistance to multiemployer plans by about half. As of January 2017, 10 pension plans had submitted 11 applications to suspend benefits under MPRA. (4 applications have been denied, 2 were withdrawn, 4 are under review, and 1 has been approved.) In addition, the Bipartisan Budget Act of 2013 and the Bipartisan Budget Act of 2015 increased premium rates for the single-employer program.

PBGC continues to face long-standing funding challenges for its single- employer insurance program as well, due to an overall decline in the defined benefit pension system. While tens of thousands of companies continue to offer traditional defined benefit plans, the total number of plans has declined significantly, as has participation in those plans. Since 1985, there has been a 79 percent decline in the number of plans insured by PBGC to 23,769 plans in 2014 and more than 11 million fewer workers are actively participating in these plans. As a result, PBGC’s premium base has been eroding over time as fewer sponsors are paying premiums for fewer participants.

Additionally, the structure of PBGC’s premium rates—a key component of PBGC’s funding—has long been another area of concern. Despite periodic increases in premium rates, which are set according to statute, the level of premiums has not kept pace with the magnitude and multiplicity of risks that PBGC insures against. Moreover, plan underfunding is the only risk factor currently considered in determining a sponsor’s premium rate. Since 2011, the administration has proposed legislative reforms that would authorize the PBGC board to adjust premiums and to explore designing a more risk-based premium structure. Under the current premium structure for its single-employer program, PBGC collects from sponsors a per-participant flat-rate premium and a variable-rate premium that is based on a plan’s level of underfunding. In 2012, we recommended that Congress consider authorizing a redesign of PBGC’s premium structure for single-employer plans to allow incorporation of additional risk factors, such as consideration of a sponsor’s financial health. PBGC officials stated that they have continued efforts to enhance understanding of alternative premium structures by analyzing the limitations of the current system and by modeling various alternative risk-based options. However, to date no legislation incorporating additional risk factors into PBGC’s premium structure has been enacted.

PBGC’s governance structure is another area of weakness noted in several of our past reports. In particular, we have long recommended that PBGC’s board—currently composed of the Secretaries of the Treasury, Commerce, and Labor—be expanded to include additional members with diverse backgrounds who possess knowledge and expertise useful to PBGC’s mission. This recommendation has not yet been enacted into law, but MAP-21 included provisions to improve PBGC’s governance by prescribing in greater detail the working relationships between its Board of Directors and its Inspector General, General Counsel, Advisory Committee, and Director. It also called for the National Academy of Public Administration (NAPA) to review PBGC’s governance structure and to report on the ideal size and composition of its board. In its September 2013 report, NAPA recommended to Congress that if the agency is provided greater responsibility over its policies, PBGC’s board should be expanded. Furthermore, we have long emphasized that PBGC requires strong and stable leadership to ensure that it can meet its future financial challenges.

In August 2016, the Secretary of Labor provided updated information related to several of these areas of concern. Regarding the long-term financial stability of both insurance programs, the Secretary noted that the President’s 2017 budget again proposed that the PBGC Board be granted the authority to adjust premiums, and with that authority directed the Board to raise $15 billion in additional premium revenue from the multiemployer program. With regard to the recommendation to improve PBGC’s governance structure, the PBGC Board has declined to pursue the matter further absent authorizing legislation. PBGC has recently established an Enterprise Risk Management function and plans to hire a Risk Management Officer to identify and determine appropriate actions to mitigate the risks identified. As of October 2016, PBGC had not yet filled this position or determined the areas of potential risk to be targeted.

What Remains to Be Done

Although Congress and PBGC have taken significant and positive steps to strengthen the agency over the past 3 years, concerns persist related to the multiemployer program and challenges related to PBGC’s overall funding structure and governance. While changes were made with passage of MPRA, PBGC officials believe there is a 50 percent chance that the multiemployer program will be insolvent by the year 2025, and after that, the risk of insolvency rises rapidly—reaching 90 percent by 2032. Further, the premium structure for PBGC’s single-employer program continues to result in rates that do not align with the risk the agency insures against and the effectiveness of PBGC’s board remains hampered by its size and composition.

Moreover, PBGC continues to face the ongoing threat of losses from the termination of underfunded plans, while grappling with a steady decline in the defined benefit pension system. With each passing year, fewer employers are sponsoring defined benefit plans and the sources of funds to finance future claims are becoming increasingly inadequate. Absent additional steps to improve PBGC’s finances, the long-term financial stability of the agency remain uncertain and the retirement benefits of millions of American workers and retirees could be at risk of dramatic reductions.

Congressional Actions Needed

To improve the long-term financial stability of both PBGC’s insurance programs, Congress should consider: authorizing a redesign of PBGC’s single employer program premium structure to better align rates with sponsor risk; adopting additional changes to PBGC’s governance structure—in particular, expanding the composition of its board of directors; strengthening funding requirements for plan sponsors as appropriate given national economic conditions; working with PBGC to develop a strategy for funding PBGC claims over the long term, as the defined benefit pension system continues to decline; and enacting additional structural reforms to reinforce and stabilize the multiemployer system that balance the needs and potential sacrifices of contributing employers, participants and the federal government.

GAO Contact

For additional information about this high-risk area, contact Charles A. Jeszeck at (202) 512-7215 or jeszeckc@gao.gov.

Related GAO Products

Pension Plan Valuation: Views on Using Multiple Measures to Offer a More Complete Financial Picture. GAO-14-264. Washington, D.C.: September 30, 2014.

Private Pensions: Timely Action Needed to Address Impending Multiemployer Plan Insolvencies. GAO-13-240. Washington, D.C.: March 28, 2013.

Private Pensions: Multiemployer Plans and PBGC Face Urgent Challenges. GAO-13-428T. Washington, D.C.: March 5, 2013.

Pension Benefit Guaranty Corporation: Redesigned Premium Structure Could Better Align Rates with Risk from Plan Sponsors. GAO-13-58. Washington, D.C.: November 7, 2012.

Pension Benefit Guaranty Corporation: Improvements Needed to Strengthen Governance Structure and Strategic Management. GAO-11-182T. Washington, D.C.: December 1, 2010.

Private Pensions: Changes Needed to Better Protect Multiemployer Pension Benefits. GAO-11-79. Washington, D.C.: October 18, 2010.

National Flood Insurance Program

Why Area Is High Risk

The National Flood Insurance Program (NFIP) is a key component of the federal government’s efforts to limit the damage and financial effect of floods. However, it likely will not generate sufficient revenues to repay the billions of dollars borrowed from the Department of the Treasury (Treasury) to cover claims from the 2005 and 2012 hurricanes or potential claims related to future catastrophic losses. This lack of sufficient revenue highlights what have been structural weaknesses in how the program is funded. Since the program offers rates that do not fully reflect the risk of flooding, NFIP’s overall rate-setting structure was not designed to be actuarially sound in the aggregate, nor was it intended to generate sufficient funds to fully cover all losses.

Instead, Congress authorized the Federal Emergency Management Agency (FEMA)—the agency within the Department of Homeland Security (DHS) responsible for managing NFIP—to borrow from Treasury, within certain limits, when needed. Until the 2005 hurricanes, FEMA had used its authority to borrow intermittently and was able to repay the loans. As of March 2016, FEMA owed Treasury $23 billion, up from $20 billion as of November 2012. FEMA made a $1 billion principal repayment at the end of December 2014—its first such payment since 2010.

The Biggert-Waters Flood Insurance Reform Act of 2012 (Biggert-Waters Act) contained provisions to help strengthen the financial solvency of the program, including phasing out almost all discounted insurance premiums (for example, subsidized premiums). However, the extent to which its changes would have reduced NFIP’s financial exposure is unclear. In July 2013, we reported that FEMA was starting to implement some of the required changes. However, on March 21, 2014, the Homeowner Flood Insurance Affordability Act of 2014 (HFIAA) was enacted. HFIAA reinstated certain premium subsidies and slowed down certain premium rate increases that had been included in the Biggert-Waters Act. Aspects of HFIAA were intended to address affordability concerns for certain property owners, but may also increase NFIP’s long-term financial burden on taxpayers. Further, an outdated policy and claims management system has also placed the program at risk. As a result of its substantial financial exposure and management and operations challenges, the program has been on our High-Risk List since 2006.

What GAO Found

Congress and FEMA have made progress in meeting the criteria for removing NFIP from the High-Risk List. In July 2012, the Biggert-Waters Act was enacted. The Biggert-Waters Act contained provisions to help strengthen the financial solvency of the program, including phasing out almost all discounted insurance premiums (for example, subsidized premiums). In March 2014, HFIAA was enacted. HFIAA reinstated certain premium subsidies and slowed down certain premium rate increases that had been included in the Biggert-Waters Act.

FEMA leadership has also shown a commitment to taking a number of actions to implement our recommendations. However, implementing required changes under the Biggert-Waters Act, as amended by HFIAA, and addressing allegations of improper claims adjusting practices after Hurricane Sandy have created capacity challenges for FEMA in addressing the financial exposure created by NFIP as well as improving program administration. FEMA has identified actions to implement our recommendations, but it has not yet developed a comprehensive plan to address all the issues that have placed NFIP on our High-Risk List.

For example, FEMA has a process in place to monitor progress in taking actions to implement our recommendations related to NFIP. But broader monitoring of the effectiveness and sustainability of its actions would help ensure that FEMA takes appropriate corrective actions. While FEMA has demonstrated progress toward improving NFIP’s financial stability and program efficiency, these efforts are not complete. For example, FEMA has addressed our recommendations to improve the monitoring and reporting of NFIP contractor performance and validate data system changes before they become effective.

FEMA also has initiated actions to improve the accuracy of full-risk rates, but some of these efforts will continue over the next 5 to 10 years. In addition, we estimate that policyholders with certain subsidized premiums paid $216 million more in premiums as of the end of fiscal year 2015 than they would have paid prior to the enactment of the Biggert-Waters Act as a result of changes FEMA made in rates for these properties. However, FEMA still does not have all the necessary information to appropriately revise premium rates for certain subsidized properties. Other important actions, such as modernizing its policy and claims management system, also remain to be completed.

What Remains to Be Done

While FEMA leadership has displayed a commitment to addressing the challenges that have placed NFIP on the High-Risk List and has made progress in a number of areas, FEMA needs to take the following actions.

Complete Biggert-Waters Act and HFIAA requirements that have not been fully met.

Develop a comprehensive plan for removing NFIP from the High-Risk List.

Initiate broader monitoring of the effectiveness and sustainability of its actions to help ensure that appropriate corrective actions are being taken.

Continue ongoing efforts to improve its NFIP rate-setting methods and evaluate approaches to obtain flood risk information needed to determine full-risk rates for properties with previously subsidized rates.

Complete efforts to establish a new information technology system for NFIP.

By completing the actions noted above, FEMA will likely improve its ability to address the financial exposure of the program and help ensure that the funds allocated to NFIP and premiums paid to the program are used effectively.

In addition, Congress should continue to consider changing the program to further address the competing goals of financial solvency and affordability.

Additional Details on What GAO Found

Leadership Commitment

FEMA partially meets this criterion. FEMA’s leadership continues to show a commitment to implement our recommendations designed to help strengthen NFIP’s future financial solvency and administrative efficiency. However, the 2014 enactment of HFIAA continues to present administrative challenges for FEMA leadership and affect the program’s capacity to address the financial exposure created by NFIP. For example, HFIAA reinstated certain premium subsidies and slowed down some premium rate increases that had been included in the Biggert-Waters Act. In addition, the Biggert-Waters Act required that FEMA establish a reserve fund to be available for meeting the expected future obligations of NFIP, and HFIAA includes an annual surcharge for all policies ($25 for most policies) to be added to the reserve fund. However, FEMA stated in its June 2016 Quarterly NFIP Reserve Fund Report to Congress that it would not reach the required reserve fund balance of $12.8 billion for fiscal year 2015.

FEMA stated that as long as the NFIP maintains outstanding debt, it would expect that the reserve fund will not reach the required balance, as amounts collected may be periodically transferred to Treasury to reduce the NFIP’s debt or to pay claims and expenses in years when claims are high. For example, according to DHS officials, FEMA notified Congress in October 2016 that it planned to use reserve funds to pay for claims related to the 2016 flooding in Louisiana and Hurricane Matthew because the National Flood Insurance Fund had been exhausted. FEMA further stated in its June 2016 report that in order to make any significant progress toward increasing the reserve fund balance or paying down the NFIP debt, the reserve assessment would need to be significantly increased. In January 2017, FEMA obtained reinsurance for NFIP effective January 1, 2017 through January 1, 2018. A FEMA official noted that securing reinsurance was a key step toward building a stronger financial framework for NFIP. Under the agreement, reinsurers agreed to cover 26 percent of NFIP claims between $4 billion and $8 billion on losses from events that occur in 2017.

Capacity

FEMA partially meets this criterion. FEMA’s capacity continues to be strained as it deals with multiple challenges, including implementing required changes under the Biggert-Waters Act, as amended by HFIAA. For example, as we reported in December 2016, FEMA officials told us that the agency’s progress implementing the Biggert-Waters Act requirement to revise its compensation methodology had slowed as litigation over Hurricane Sandy claims escalated and more resources were assigned to that issue.

FEMA has made some progress to address weaknesses that we previously noted could limit its ability to effectively and efficiently implement NFIP. For example, we made two recommendations in a January 2014 report aimed at improving FEMA’s monitoring and reporting of contractor performance, such as ensuring that federal contracting officials have complete and timely information about contractor performance. FEMA provided us with documentation describing how the agency plans to ensure the timeliness of contractor performance assessments and address our other concerns.

We also recommended in a December 2014 report that FEMA institute controls to validate changes to the NFIP data system. In March 2015, FEMA instituted the use of a new procedure manual, including a testing plan, for data system programming changes required to implement NFIP rate and rule changes. This procedure manual outlines the steps and approvals needed to plan, develop, test, and deploy NFIP data system changes.

However, FEMA faces challenges implementing required Biggert-Waters Act and HFIAA requirements, including the complexity of the legislation and timing of the enactment of HFIAA, resource constraints, and the competing program goals of financial solvency and affordability. In October 2016, DHS officials told us that FEMA had met requirements to complete 20 of the 34 Biggert-Waters sections and 14 of the 25 HFIAA sections and was taking action on other sections.

Action Plan

FEMA partially meets this criterion. FEMA has identified actions to address the recommendations from our individual reports. In January 2017, a FEMA official noted that the agency tracks GAO recommendations through its internal controls program. The official added that FEMA is planning to enhance its Enterprise Risk Management approach to track those GAO recommendations that impact its risk profile. However, FEMA lacks a comprehensive plan that addresses the issues that have placed NFIP on our High-Risk List. While addressing our recommendations is part of such a plan, a comprehensive plan defines the root causes, identifies effective solutions, and provides for substantially completing corrective measures near term. Such a plan could help FEMA ensure that all important issues, and all aspects of those issues, are addressed.

Monitoring

FEMA partially meets this criterion. FEMA has a process in place to monitor progress in taking actions to implement our recommendations related to NFIP. For example, the status of efforts to address the recommendations is regularly discussed both within FEMA and at the DHS level, according to a DHS official. However, FEMA lacks a specific process for independently validating the effectiveness or sustainability of those actions. According to a DHS official, once FEMA implements a recommendation related to NFIP, it does not track separately the effects of the actions taken to do so, but instead regularly reviews the effectiveness of the entire program. Additional monitoring of the effectiveness and sustainability of its specific actions taken to address our recommendations would help ensure that appropriate corrective actions are being taken.

Demonstrated Progress

FEMA partially meets this criterion. FEMA has demonstrated progress toward improving NFIP’s financial stability and program operations. As previously discussed, FEMA has taken steps to address our recommendations to improve how it monitors and reports NFIP contractor performance and validates data system changes before they become effective. However, progress is needed in other areas. For example, in 2008 we recommended that FEMA take steps to ensure that rate-setting methods and the data used to set rates result in full-risk premiums that accurately reflect the risk of flooding. We found that FEMA’s method for setting its full-risk rates may not ensure that the rates accurately reflect the actual risk of flood damage. In 2013, we also recommended that FEMA develop and implement a plan to obtain flood risk information needed to determine full-risk rates for properties with previously subsidized rates. We found that FEMA generally lacks information needed to apply full-risk rates to certain subsidized properties.

As of March 2016, FEMA officials identified a number of actions the agency has taken or has underway to improve its NFIP rate-setting methods, but the officials noted that some of these efforts would continue over the next 5 to 10 years. In addition, as a result of changes FEMA has made in rates for certain subsidized properties (specifically, subsidies for primary residences, non-primary residences, and residential severe repetitive loss properties), we estimate that policyholders with these subsidized premiums paid $216 million more in premiums as of the end of fiscal year 2015 than they would have paid prior to the enactment of the Biggert-Waters Act. FEMA officials also said that they are evaluating approaches, including using new technologies, to collect elevation information for subsidized properties without financially burdening policyholders.

FEMA has demonstrated progress in improving other areas of the program’s operations, such as continuity planning. However, some important actions, such as modernizing its information technology systems—including those for financial reporting and its policy and claims management system—remain to be completed. In 2011, we recommended that FEMA develop guidance and a related plan for continuing operations during federal disasters to help ensure consistent day-to-day operations when staff are deployed to disaster sites or reassigned to work on disaster-related issues. As part of developing its 2012 continuity plan, FEMA identified critical staff as well as the key operations that need to continue when staff are deployed in response to a federal disaster and how operations will continue during such periods.

In 2011, in our review of FEMA’s financial management, we reported that staff faced multiple challenges in their day-to-day operations due to limitations in the systems they must use to perform these operations. In this same report, we also noted that FEMA faces challenges modernizing NFIP’s insurance policy and claims management system. After 7 years and $40 million, FEMA ultimately canceled its NextGen effort in November 2009 because the system did not meet user expectations. Since that time, FEMA established a steering committee tasked with overseeing FEMA’s next attempt to modernize its policy and claims processing system and began implementing some changes to its acquisition management practices. It remains to be seen if these efforts will help FEMA avoid some of the problems that led to NextGen’s failure. In late-November 2014, FEMA officials told us that the agency was in the acquisition stage for a new system called “Phoenix” that will replace NextGen and NFIP’s current financial and reporting system. In January 2017, a FEMA official stated the DHS acquisition review board had granted FEMA permission to procure and build the new system.

GAO Contact

For additional information about this high risk area, contact Alicia Puente Cackley at (202) 512-8678 or cackleya@gao.gov.

Related GAO Products

Flood Insurance: FEMA Needs to Address Data Quality and Consider Company Characteristics When Revising Its Compensation Methodology. GAO-17-36. Washington, D.C.: December 8, 2016.

Flood Insurance: Review of FEMA Study and Report on Community- Based Options. GAO-16-766. Washington, D.C.: August 24, 2016.

Flood Insurance: Potential Barriers Cited to Increased Use of Private Insurance. GAO-16-611. Washington, D.C.: July 14, 2016.

National Flood Insurance Program: Continued Progress Needed to Fully Address Prior GAO Recommendations on Rate-Setting Methods. GAO- 16-59. Washington, D.C.: March 17, 2016.

National Flood Insurance Program: Options for Providing Affordability Assistance. GAO-16-190. Washington, D.C.: February 10, 2016.

Flood Insurance: Status of FEMA's Implementation of the Biggert-Waters Act, as Amended. GAO-15-178. Washington, D.C.: February 19, 2015.

Flood Insurance: Forgone Premiums Cannot Be Measured and FEMA Should Validate and Monitor Data System Changes. GAO-15-111. Washington, D.C.: December 11, 2014.

Overview of GAO’s Past Work on the National Flood Insurance Program. GAO-14-297R. Washington, D.C.: April 9, 2014.

Flood Insurance: Strategies for Increasing Private Sector Involvement. GAO-14-127. Washington, D.C.: January 22, 2014.

National Flood Insurance Program: Progress Made on Contract Management but Monitoring and Reporting Could Be Improved. GAO-14- 160. Washington, D.C.: January 15, 2014.

Flood Insurance: More Information Needed on Subsidized Properties. GAO-13-607. Washington, D.C.: July 3, 2013.

FEMA: Action Needed to Improve Administration of the National Flood Insurance Program. GAO-11-297. Washington, D.C.: June 9, 2011.

Managing Risks and Improving VA Health Care

Why Area Is High Risk

Since designating Department of Veterans Affairs (VA) health care as a high-risk area in 2015, we continue to be concerned about VA’s ability to ensure its resources are being used cost-effectively and efficiently to improve veterans’ timely access to health care, and to ensure the quality and safety of that care. VA’s Veterans Health Administration (VHA) operates one of the largest health care delivery systems in the nation, with 168 medical centers and more than 1,000 outpatient facilities organized into regional networks. VA has faced a growing demand by veterans for its health care services—due, in part, to servicemembers returning from the United States’ military operations in Afghanistan and Iraq and the needs of an aging veteran population—and that trend is expected to continue. For example, the total number of veteran enrollees in VA’s health care system rose from 7.9 million to almost 9 million from fiscal year 2006 through fiscal year 2016. Over that same period, VHA’s total budgetary resources have increased substantially, from $37.8 billion in fiscal year 2006 to $91.2 billion in fiscal year 2016.

Although VA’s budget and the total number of medical appointments provided have substantially increased for at least a decade, there have been numerous reports in this same period of time—by us, VA’s Office of the Inspector General, and others—of VA facilities failing to provide timely health care. In some cases, the delays in care or VA’s failure to provide care at all reportedly have resulted in harm to veterans. In response to these serious and longstanding problems with VA health care, the Veterans Access, Choice, and Accountability Act of 2014 (Pub. L. No. 113-146, 128 Stat. 1754) was enacted, which provided temporary authority and $10 billion in funding through August 7, 2017 (or sooner, if those funds are exhausted) for veterans to obtain health care services from community (non-VA) providers to address long wait times, lengthy travel distances, or other challenges accessing VA health care. Under this authority, VA introduced the Veterans Choice Program in November 2014. The $10 billion is meant to supplement VA’s medical services budget and is funded through a separate appropriations account, the Veterans Choice Fund. The 2014 law also appropriated $5 billion to expand VA’s capacity to deliver care to veterans by hiring additional clinicians and improving the physical infrastructure of VA’s medical facilities. agency officials projected a fiscal year 2015 funding gap of about $3 billion in its medical services appropriation account. The projected funding gap was largely due to administrative weaknesses that slowed the utilization of the Veterans Choice Program in fiscal year 2015 and resulted in higher-than-expected demand for VA’s previously established VA community care programs. In particular, VA officials expected that the Veterans Choice Program would absorb much of the increased demand from veterans for health care services delivered by non-VA providers, but instead the slow utilization resulted in veterans continuing to receive care through previously established VA community care programs that drew funds from VA’s medical services appropriation account. To avoid a projected funding gap in VA’s medical services appropriation account, the VA Budget and Choice Improvement Act provided VA temporary authority to use up to $3.3 billion from the Veterans Choice Program appropriation for obligations incurred for other specified medical services, starting May 1, 2015, until October 1, 2015.

While timely and cost-effective access to needed health care services is essential, care coordination between VA and community providers, and between VA and the Department of Defense (DOD) (for transitioning servicemembers), is also critical to preventing unfavorable health outcomes for veterans. With the increased utilization of community providers that has occurred as a result of the Veterans Access, Choice, and Accountability Act, veterans are required to navigate multiple complex health care systems—the VA health care system and those of community providers—to obtain needed health care services. The quality of veterans’ care may be adversely affected if VA and community providers do not promptly communicate important clinical information. In addition, servicemembers transitioning from DOD to VA health care may experience problems if, for example, VA inappropriately discontinues medications, such as those for mental health conditions, because of a lack of clarity in VA’s medication continuation policy, potentially increasing the risk for adverse health effects.

What GAO Found

Overall, VA has partially met the criteria for leadership commitment and an action plan to address the five areas of concern we identified when we placed VA health care on our High-Risk List in 2015. These five areas of concern are: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) information technology (IT) challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities. VA has not met the other criteria for removal: capacity to address the areas of concern, monitoring implementation of corrective actions, and demonstrating progress.

Although we concluded in our overall assessment that VA’s actions partially met two of our five criteria for removal from the High-Risk List, it is worth noting that the department made significantly less progress in addressing the action plan criterion than it has in demonstrating leadership commitment. Specifically, VA partially met the action plan criterion for only one of the five areas of concern—ambiguous policies and inconsistent processes—whereas VA partially met the leadership commitment criterion for four out of five areas of concern (VA did not meet the leadership commitment criterion for inadequate training for VA staff). The department must make significant progress on the action plan criterion for all five areas of concern we identified in order to meet this criterion for removal from our High-Risk List.

VA officials have expressed their commitment to addressing the department’s High-Risk List designation, and have taken actions such as establishing a task force, working groups, and a governance structure for addressing the issues contributing to the designation. For example, in July 2016, VA chartered the GAO High-Risk List Area Task Force for Managing Risk and Improving VA Health Care (task force) to develop and oversee implementation of VA’s plan to address the root causes of the five areas of concern we identified. VHA’s Deputy Under Secretary for Health (USH) for Organizational Excellence serves as the executive agent for the task force, with support from a combination of permanent and temporary staff. This senior VHA position was created in 2015 and is responsible for overseeing offices focused on assessing and improving health care quality and safety, providing VA leadership with analytics to assess VHA’s performance, and addressing issues related to public trust and integrity. For each of the five areas of concern we identified, VA has established a working group with two senior-level VA officials as leaders. These workgroups and officials are responsible for developing and executing VA’s high-risk mitigation plan for each of our five areas of concern.

VA has also contracted with two entities to support VA’s actions to address the high-risk designation. The first contract—with a Federally Funded Research and Development Center operated by the MITRE Corporation—is focused on (1) developing and executing an action plan, (2) creating a plan to enhance VA’s capacity to manage High-Risk List areas, and (3) recommending changes to the organizational structure VA set up to address the high-risk designation. The total contract value is $5.2 million, with an 8-month performance period that began on June 20, 2016 and 1 option year. The second contract—with Atlas Research, LLC—is for project management staff who will help establish a program executive office within the office of the VHA Deputy USH for Organizational Excellence, and assist with establishing the management functions necessary to oversee the five high-risk area working groups. The total contract value is $2.6 million, with a 1-year performance period that began on September 9, 2016 and the option to extend services for up to 6 additional months.

Since we added VA health care to our High-Risk List in 2015, VA’s leadership has increased its focus on implementing our recommendations. Between January 2010 and February 2015 (when we designated VA health care as a high-risk area), we issued products containing 178 recommendations related to VA health care. When we made our designation in 2015, the department had only implemented about 22 percent of them—39 of the 178 recommendations. In the last 2 years, VA has made good progress, but additional work is needed. Since we designated VA health care as a high-risk area, we have made 66 new recommendations related to VA health care, for a total of 244 recommendations from January 1, 2010 through December 31, 2016. VA has implemented about 50 percent of the recommendations we have made since 2010—122 of the 244 recommendations. (See table 9.) It is critical that VA implement our recommendations not only to remedy the specific weaknesses identified, but because they may be symptomatic of larger underlying problems that also need to be addressed.

On August 18, 2016, VA provided us with an action plan for addressing the High-Risk List designation that acknowledged the deep-rooted nature of the areas of concern we identified, and stated that these concerns would require substantial time and work to address. Although the action plan outlined some steps VA plans to take over the next several years to address its high-risk designation, the overall document did not satisfy the action plan criterion for removal. Specifically, several sections were missing actions that support our criteria for removal, such as analyzing the root causes of the issues and measuring progress with clear metrics. In our feedback to VHA on drafts of their action plan, we highlighted these missing actions and also stressed the need for specific timelines and an assessment of needed resources for implementation. For example, VA plans to use staff from various sources, including contractors and temporarily detailed employees, to support their high-risk area working groups, so it will be important for VA to ensure that these efforts are sufficiently resourced.

While VA has demonstrated partial leadership commitment in most of the five areas of concern, significant gaps remain between VA’s stated plans and its actual progress. This lack of progress is evidenced by findings from our recent work, which have led us to make new recommendations that relate to each of the five areas of concern we highlighted in 2015. (See table 10.)

Managing Risks and Improving VA Health Care Number of recommendations prior to GAO high-risk designation (Jan. 1, 2010 through Feb. 11, 2015)

Number of recommendations added since GAO high-risk designation (Feb. 11, 2015 through Dec. 31, 2016)

Recommendation counts listed include both implemented and not implemented recommendations as of the dates indicated.

What Remains to Be Done

Since we added VA health care to our High-Risk List in 2015, VA has acknowledged the significant scope of the work that lies ahead. VA took an important step toward addressing our criteria for removal by establishing the leadership structure necessary to ensure that actions related to the High-Risk List are prioritized within the department. It is imperative, however, that VA maintain strong leadership support as it completes its transition into a new presidential administration. strategies that link strategic goals to actions and guidance. In addition, VA will need to demonstrate that it has the capacity to sustain efforts by devoting appropriate resources—including people, training, and funds—to address the high-risk challenges we identified.

VA’s action plan for addressing its high-risk designation describes many planned outcomes with overly ambitious deadlines for completion. We are concerned about the lack of root cause analyses for most areas of concern, and the lack of clear metrics and needed resources for achieving stated outcomes. This is especially evident in VA’s plans to address the IT and training areas of concern. In addition, with the increased use of community care programs, it is imperative that VA’s action plan include a discussion of the role of community care in decisions related to policies, oversight, IT, training, and resource needs. We will continue to monitor VA’s institutional capacity to fully implement and sustain needed changes, including those related to its IT transformation, comprehensive training management plan, and resourcing decisions.

Finally, to help address our high-risk designation, VA should continue to implement our recommendations and recommendations from other reviews such as the Commission on Care. The Veterans Access, Choice, and Accountability Act of 2014 established the Commission on Care to examine, assess, and report on veterans’ access to VA health care and to strategically examine how best to organize VHA, locate health resources, and deliver health care to veterans during the next 20 years. The Commission’s June 2016 report to the President included 18 recommendations to improve veterans’ access to care and, more broadly, to improve the quality and comprehensiveness of that care. For example, the Commission recommended that VHA create local, networked systems of care that integrate VA-based care and community care and remove restrictions to veterans seeking care from community providers. On September 1, 2016, the President concurred with 15 of the 18 recommendations and directed VA to implement them. including its policy development and dissemination process; controls and oversight for controlled substances; Veterans Choice Program implementation; physician recruitment and retention; the process for enrolling veterans in VA health care. In particular, the following selected recommendations require VA’s immediate attention: improving oversight of access to timely medical appointments, including the development of wait-time measures that are more reliable and not prone to user error or manipulation, as well as ensuring that medical centers consistently and accurately implement VHA’s scheduling policy. improved oversight of VA community care to ensure—among other things—timely payment to community providers. improved planning, deployment and oversight of VA/VHA IT systems, including identifying outcome-oriented metrics and defining goals for interoperability with DOD. ensuring that recommendations resulting from internal and external reviews of VHA’s organizational structure are evaluated for implementation. This process should include the documentation of decisions and assigning officials or offices responsibility for ensuring that approved recommendations are implemented.

It is critical that Congress maintain its focus on oversight of VA health care to help address this high-risk area. Congressional committees responsible for authorizing and overseeing VA health care programs held more than 70 hearings in 2015 and 2016 to examine and address VA health care challenges. In addition, as VA continues to change its health care service delivery in the coming years, some changes may require congressional action—such as VA’s planned consolidation of community care programs after the Veterans Choice Program expires. Sustained congressional attention to these issues will help ensure that VA continues to improve its management and delivery of health care services to veterans.

Additional Details on What GAO Found

Ambiguous Policies and Inconsistent Processes

When we designated VA health care as a high-risk area in 2015, we reported that ambiguous VA policies led to inconsistent processes at local VA medical facilities. Based on actions taken since 2015, VA has partially met our criteria for removal for its leadership commitment and action plan. However, VA has not met our criteria for removal for capacity, monitoring, and demonstrated progress for this area of concern.

Leadership Commitment

one example of an action that would contribute to meeting the leadership commitment criterion for removal from our High-Risk List.

Capacity

VA has not met the capacity criterion because of significant gaps between its stated goals and the resources available to achieve them. VA’s high- risk working group on ambiguous policies and inconsistent processes is a first step towards establishing the capacity necessary to address this area of concern. VA has allocated staff and awarded contracts to support the department’s overall high-risk effort, but its action plan for this area does not explain how VA will allocate staff and resources to support its plans to address ambiguous policies and inconsistent processes, such as the professional policy writers VA states it needs to ensure consistent policy content and quality.

Other actions VA needs to take to demonstrate capacity in this area of concern include maintaining procedures that have recently been established; training appropriate staff in policy development, implementation, and oversight; and addressing gaps such as unofficial policy documents. One example of unofficial policy is memoranda sent by the VHA Deputy USH for Operations and Management to regional network offices and VA medical centers. These memoranda are treated as new policy, but they have not been vetted by other VA offices, potentially creating confusion at the local level between mandatory and suggested actions.

Action Plan

fully-established policy revision process in place, or the professional policy writers available to revise policies, VA cannot effectively meet these milestones. VA needs to use the root cause analysis results to develop more realistic milestones and metrics for this area, and ensure that critical actions and outcomes are prioritized given any identified limitations in capacity.

Monitoring

VA has not met the monitoring criterion for our concerns related to ambiguous policies and inconsistent processes. VA has many planned actions that have not yet been implemented, including plans to ensure policy is implemented consistently at local and national levels, as well as plans to identify and address unofficial sources of policy. We also have continued to find evidence in our recent work of inconsistencies in policy application that will need to be addressed to show that VA is monitoring policies. For example, we highlighted the inconsistent application of policies in two recent reports examining mental health and primary care access at VA medical facilities in 2015 and 2016, respectively. In both reports, we found wide variation in the time that veterans waited for primary and mental health care, which was in part caused by a lack of clear, updated policies for scheduling—therefore, we recommended that VA update these policies. These ambiguous policies contributed to errors made by appointment schedulers, which led to inconsistent and unreliable wait-time data. For mental health, we also found that two policies conflicted, leading to confusion among VA medical center staff as to which wait-time policy to follow. In 2015, VA resolved this policy conflict by revising its mental health handbook, but other inconsistent applications of mental health policy have not yet been addressed, such as our recommendation to issue guidance about the definitions used to calculate veteran appointment wait times, and communicate any changes to those definitions within and outside VHA.

Demonstrated Progress

VA has not met the demonstrated progress criterion for removal. We are unable to assess VA’s actions in this area because without the clear milestones and metrics necessary to track performance, VA cannot demonstrate that its actions are linked to identified root causes and that it is effectively managing this area of concern. We have ongoing work examining VA’s actions to ensure that policies related to veterans’ health care are consistently communicated and implemented, and we will continue to monitor VA’s progress in this area.

Inadequate Oversight and Accountability

In our 2015 high-risk report, we found that VA has had problems holding its facilities accountable for their performance because it relied on self- reported data from facilities, its oversight activities were not sufficiently focused on compliance, and it did not routinely assess policy implementation. VA has partially met the leadership commitment criterion for this area of concern because it established a high-level governance structure and adopted a new model to guide the department’s oversight and accountability activities. However, VA has not met our criteria for removal for capacity, action plan, monitoring, or demonstrated progress because the department continues to rely on existing processes that contribute to inadequate oversight and accountability.

Leadership Commitment

yet approved the draft directive establishing this office and authorizing it to carry out its planned functions.

Capacity

VA has not taken sufficient actions to meet the capacity criterion for removing this area of concern from our High-Risk List. Although VA has begun to allocate staff and resources by establishing the VHA office of the Assistant Deputy USH for Integrity, the success of its new oversight and accountability model depends on establishing consistent policies and ensuring that staff at all levels are complying with them. VA staff will need sufficient guidance and training to address skills gaps and to correct identified deficiencies, and VA’s new office of Internal Audit and Risk Assessment (a key component of its new oversight and accountability model) will need to be fully resourced, staffed, and operational. In addition, VA identified a need for increased training in ethics, as well as a need for staff with this specific expertise at the local level. However, VA’s action plan does not discuss how these actions will be resourced, including hiring staff or obtaining other resources necessary to ensure that such knowledge is in place.

Action Plan

VA also has not met the action plan criterion for addressing our concerns about oversight and accountability. In its action plan, VA identifies root causes based on an “environmental analysis” of its health care oversight structure, such as the lack of a formal audit capacity. However, the identified root causes are not linked to clear milestones, metrics, or processes for reporting on progress. VA plans to include metrics in every new or revised policy to allow officials to determine whether the policy is being appropriately implemented and meets objectives. However, as described earlier, VHA’s new policy development and revision process is still in its early stages. Without clear milestones and metrics linked to root causes of the problem, VA cannot assess its implementation status or demonstrate progress against goals. For example, in our May 2016 report on the Veterans Crisis Line (a 24-hour telephone line staffed by responders who assist veterans in emotional crisis), we found VA established key performance indicators to evaluate crisis line operations but had no measureable targets or time frames established for their completion. One of the indicators related to rate at which crisis line callers abandoned their calls prior to speaking with a responder, but VA did not set a minimum or ideal performance target for this indicator. We recommended that VA document clearly stated and measurable targets and time frames for key performance indicators needed to assess Veterans Crisis Line performance, in order to improve the timeliness and quality of crisis line responses to veterans.

Monitoring

VA has not met the criterion for monitoring its progress in improving oversight and accountability. VA’s action plan for this area of concern does not explain how it will ensure that medical facilities are consistently reporting reliable data, which is critical to monitoring actions. We have continued to find instances where VA lacked reliable data to determine whether its medical centers were following policies, which will continue to make it difficult for VA to monitor improved oversight and accountability. For example, in 2015, as part of our review of VA’s primary care oversight, we found inaccuracies in VA’s data on primary care panel sizes, which are used to help medical centers manage their workload and ensure that veterans receive timely and efficient care. We found that while VA’s primary care panel management policy requires facilities to ensure the reliability of their panel size data, it does not assign responsibility for verifying data reliability to regional- or national-level officials or require them to use the data for monitoring purposes. As a result, VA could not be assured that local panel size data were reliable, or whether its medical centers have met VA’s goals for efficient, timely, and quality care. We recommended that VA incorporate an oversight process in its primary care panel management policy that assigns responsibility, as appropriate, to regional networks and central office for verifying and monitoring panel sizes.

Demonstrated Progress

safety, and dignity of women veterans when they receive care at VA medical facilities.

Information Technology Challenges

In our 2015 high-risk report, we identified limitations in the capacity of VA’s existing IT systems, including the outdated, inefficient nature of certain systems and a lack of system interoperability—the ability to exchange and use electronic health information—as contributors to VA’s IT challenges related to VA health care. These challenges present risks to the timeliness, quality, and safety of VA health care. VA has partially met our leadership commitment criterion by involving top leadership in this area of concern, but it has not met our four remaining criteria for removing IT challenges from the High-Risk List.

Leadership Commitment

VA has partially met the leadership commitment criterion for addressing IT challenges. Specifically, VA outlined in its action plan a high-level governance structure that designates an official within VA’s department- level Office of Information and Technology (OI&T) as responsible for this area of concern. In addition, VA’s Chief Information Officer (CIO) has recently initiated an effort to transform the focus and functions of OI&T in response to the Secretary’s goal of making VA a more veteran-focused organization. The CIO’s transformation strategy, initiated in January 2016, calls for the office to stabilize and streamline processes, mitigate weaknesses highlighted in our assessments, and improve outcomes by institutionalizing a new set of IT management capabilities. As part of this transformation, in January 2016, the CIO began transitioning the oversight and accountability of IT projects to a new project management process called the veteran-focused integration process, in an effort to streamline its systems development and delivery of new IT capabilities. intended to serve as OI&T’s portfolio management and project tracking organization; (2) account management, led by three account managers responsible for managing the IT needs of VA’s major components; (3) quality and compliance, responsible for establishing effective policy governance and standards, and ensuring VA adheres to the policies and standards; (4) data management, intended to improve both service delivery and the veteran experience by engaging with data stewards to ensure the accuracy and security of the information collected by VA; and (5) strategic sourcing, which is expected to be responsible for establishing an approach to working with vendors that can supply solutions to VA’s IT requirements. However, VA is in the early stages of implementing these new functions, and it will need to sustain leadership commitment by maintaining OI&T’s transformation through the presidential transition.

Capacity

VA has not taken sufficient action to demonstrate it has the capacity to address the IT challenges we identified. VA has extensive IT resources in terms of staff and funding. In fiscal year 2016, VA’s IT appropriations were approximately $4.1 billion, and in our August 2016 report on VA’s IT management, OI&T reported nearly 7,300 federal employees and approximately 7,800 contractor staff working in support of IT-related functions. However, VA has not demonstrated improvement in several capacity actions, such as establishing specific responsibilities for its new functions, improving collaboration between internal and external stakeholders, and addressing skill gaps. For example, in our August 2016 report, we found that OI&T was still in the process of fully defining the roles and responsibilities of its new organizational units, as of July 2016.

With regard to collaboration, VA designated an account manager for VHA as of May 2016, which has the potential to improve VHA and VA collaboration on IT needs. However, its August 2016 action plan for IT challenges describes plans rather than actions already taken to implement the account management function. In addition, we have repeatedly reported on the importance of VA working with DOD to achieve electronic health record interoperability. In August 2015, we reported on the status of these interoperability efforts and noted that the departments have engaged in several near-term efforts focused on expanding interoperability between their existing electronic health record systems. However, we were concerned by the lack of outcome-oriented goals and metrics that would more clearly define what VA and DOD aim to achieve from their interoperability efforts. Accordingly, we recommended that the departments establish a time frame for identifying outcome-oriented metrics and define related goals for achieving interoperability.

Finally, in our August 2016 report, we found that while OI&T conducted annual skill gap analyses and developed training courses, and recommended other actions for addressing these gaps, the office had not identified potential gaps that may exist in future years. This led us to recommend that OI&T identify IT skills needed beyond the current fiscal year to assist in identifying future skill gaps. By focusing on the current year, OI&T may not be aware of skill gaps that need to be filled to assure its staff can deliver long-term IT support that contributes to improved services for veterans.

Action Plan

VA has not met the action plan criterion for addressing the IT challenges we identified. VA’s action plan for this area provides a descriptive problem statement—reflecting our previously stated concerns—and high-level information about VA-wide IT strategies and initiatives. However, it does not contain a root cause analysis that would help identify and prioritize critical actions and outcomes to address IT challenges. As a result, VA’s stated milestones and dates appear unrealistic and disconnected from the challenges identified. For example, VA set a goal of having 50 percent of its active IT projects on budget and on schedule by the end of 2016, but it does not state what supporting actions and processes would be necessary to achieve this ambitious goal. Also, without a root cause analysis, VA cannot be certain this action will address its IT challenges. A significant concern we identified in our August 2015 report on VA’s and DOD’s interoperability efforts is that the two departments had not identified outcome-oriented goals and metrics that would more clearly define what they aim to achieve from their interoperability efforts and the value and benefits these efforts are intended to yield.

Monitoring

VA has not met the criterion related to monitoring actions to address IT challenges. Without outcome-oriented goals and metrics to measure progress, VA cannot demonstrate that it is effectively monitoring implementation and tracking progress against goals. As we have stressed in our prior work, assessing the performance of a program should include measuring its outcomes in terms of the desired results of products or services. In this case, such outcomes could include improving the quality of health care or clinician satisfaction. Establishing outcome-oriented goals and metrics is essential to determining whether a program is operating as intended and delivering value.

Demonstrated Progress

sustained. A key action within the criterion for demonstrated progress is implementing recommendations. We have made several recommendations to VA to address outdated systems such as its scheduling and community care claims processing systems, but VA has not yet implemented these recommendations. For example, in May 2016, we recommended that VA develop a sound plan for modernizing its claims processing system. We found that, due to recent increases in utilization of community care, VA has had difficulty with the timely processing of claims from community providers and the contractors responsible for administering the Veterans Choice Program. VA officials and claims processing staff indicated that IT limitations, manual processes, and staffing challenges had delayed claims processing. The department had implemented interim measures to address some of the system’s challenges, but it did not expect to deploy solutions to address all challenges, including those related to IT, until fiscal year 2018 or later.

Inadequate Training for VA Staff

When identifying this area of concern in our 2015 high-risk report, we described several gaps in VA’s training, as well as burdensome training requirements, that we found in our prior work. Since we issued the 2015 report, VA has expressed its desire to improve the department’s standardization and management of training, but has not met any of our criteria for removing this area of concern from the High-Risk List.

Leadership Commitment

process, VA’s action plan states that it will set goals that enable VA medical center involvement in training planning, but those goals are not fully articulated in the document. The high-level nature of the descriptions in the action plan and lack of action to update outdated policies and set goals for improving training shows that VA lacks leadership commitment to address the concerns that led to our inclusion of this area in the 2015 high-risk report.

Capacity

VA also has not demonstrated that it has the capacity to address our concerns regarding inadequate training. Since identifying these concerns in our 2015 high-risk report, we have continued to find VA health care training gaps that need to be addressed. VA needs to determine the resources needed, actions required, and systems that need to be established to support improvements in how it manages training.

In our September 2015 report on nurse recruitment and retention, for example, we found that VA did not know whether its medical center staff had sufficient training to support its national initiatives to recruit and retain nurses. As a result, we recommended that VA evaluate the adequacy of these training resources to help ensure the effective recruitment and retention of nurses across VA medical centers. In our December 2016 report on VHA’s human resources (HR) capacity, we found that VA’s competency assessment tool did not address two of the three personnel systems under which VHA staff may be hired. We recommended that VHA (1) develop a comprehensive competency assessment tool for HR staff that evaluates knowledge of all three of VHA’s personnel systems and (2) ensure that all VHA HR staff complete it so that VHA may use the data to identify and address competency gaps among HR staff. Without such a tool, VHA will have limited insights into the abilities of its HR staff and be ill-positioned to provide necessary support and training.

Action Plan

VA also has not met the action plan criterion for this area of concern. In its action plan, VA identified an outdated 2002 policy and a decentralized approach to training as potential root causes of the lack of effective training management and oversight we previously identified. VA did not, however, take the additional steps in its action plan of conducting an analysis to confirm its assumptions. It is also not clear from the action plan whether VA plans to establish clear milestones and metrics to review and measure its progress in addressing the root causes of inadequate training for VA staff.

Monitoring

measures and its progress against goals. One key monitoring action is reporting on program progress to senior managers. VA’s action plan for this area states that VHA leadership, including the VHA Under Secretary for Health, will review and approve an annual training plan, but the action plan does not describe what data will support that review, and how it will define progress against goals.

Demonstrated Progress

Because VA’s comprehensive training management strategy is in the early stages of development, VA has not met the criterion for demonstrated progress in addressing this high-risk area of concern. Without clear priorities and goals for improving training, an action plan with clear milestones and metrics, and data to support reports on progress, it is not possible for VA to demonstrate progress in effectively addressing this area.

Unclear Resource Needs and Allocation Priorities

In our prior work, we reported on gaps in the availability of data needed for VA to identify the resources it needs and ensure they are effectively allocated across VA’s health care system. We included this area of concern when we designated VA health care as a high-risk area in 2015. Over the past 2 years, VA’s actions have partially met our criterion for leadership commitment but not met the other four criteria for removing this area of concern from the High-Risk List.

Leadership Commitment

cycles. However, VA’s planned actions do not make clear how VHA, as the agency managing VA health care, is or will be incorporated into VA’s department-level framework, or how that framework will be communicated and reflected at the regional network and medical center levels. Actions that will assist VA in demonstrating progress in leadership commitment for this area of concern include clarifying the role and responsibilities of VHA in the Managing for Results framework, and ensuring continued oversight and accountability of the framework’s implementation.

Capacity

VA has not met our criterion for capacity for this area of concern. In its action plan, VA names several initiatives that are underway to enable Managing for Results, including establishing a mission-requirements- planning function to supply the ground rules and assumptions necessary to inform cost analysis of major VA initiatives. However, VA does not explain how it intends to establish the mission-requirements-planning function, or what resources may be necessary to establish and maintain that function at the national and local levels. Understanding the resources necessary to establish a new process can help to identify skills gaps and training that VA staff may need to facilitate implementation.

Action Plan

VA has not met our action plan criterion for this area of concern because it has not established performance measures based on a root cause analysis of its unclear resource needs and allocation priorities. VA’s action plan states that the fragmented nature of the department’s data and information management systems limits its ability to integrate priorities, requirements, and solutions. While Managing for Results is intended to facilitate that integration, the action plan does not contain an analysis or explanation for how VA determined that fragmented systems was a cause of unclear resource needs and allocation priorities, or how their chosen framework would address that cause. As a result, VA lacks reasonable assurance that planned actions are addressing the root cause of the problem. correspond to all of its strategic goals and objectives, VHA’s regional networks and medical centers had limited guidance to help them operationalize VA’s strategic goals and objectives. Moreover, the day-to- day activities and initiatives developed by VHA regional networks and medical centers may not appropriately align with national goals and objectives for VA health care. Directly aligning strategic goals and their associated strategies is important in assessing an organization’s ability to achieve those goals.

Monitoring

VA has not met our criteria for monitoring because its planned actions do not address our previously stated concerns about data quality. VA’s planned actions to address unclear resource needs and allocation priorities include incorporating information from VHA’s resource allocation model, enrollment projection model, and health care staffing utilization data to improve the accuracy of its resource decisions. However, we have described our concerns about the accuracy of data used for health care resourcing decisions in our 2015 high-risk report, as well as in our June 2016 report examining VA’s projected fiscal year 2015 funding gap. In the 2016 report, we found that VA’s weaknesses in estimating costs and tracking obligations as use of VA’s community care programs increased was one reason for VA’s projected funding gap. To better align cost estimates for community care services with associated obligations, we reported that VA was examining options for replacing its outdated financial IT systems, a plan that is reiterated in VA’s high-risk action plan, with a projected completion date of fiscal year 2020. However, VA’s high- risk action plan states that updating its financial management system will only partly address the capability gap associated with having the systems necessary to extract cost data. VA has made previous, unsuccessful, attempts to update its financial IT systems. To show progress in monitoring actions, VA will need to ensure data quality and regularly review its status and performance compared to its goals.

Demonstrated Progress

care to the nation’s veterans will improve. We recommended that VA develop a process to ensure that it evaluates organizational structure recommendations resulting from internal and external reviews of VHA. This process should include documenting decisions and assigning officials or offices responsibility for ensuring that approved recommendations are implemented. Such a process will help VA ensure that it is using resources efficiently, monitoring and evaluating implementation, and holding officials accountable.

Benefits Achieved by Implementing Our Recommendations

Both Congress and VA have taken action to address our high-risk designation. In July 2015, the VA Budget and Choice Improvement Act directed VA to, among other things, include in its annual budget submission a new appropriations account for medical care delivered by community providers. Beginning in fiscal year 2017, Congress began funding community care through this new Medical Community Care appropriations account. This should allow VA to better ensure that sufficient funds are available for community care in the future.

In November 2014, we reviewed data that VA collects on veteran suicides. We found that the data were not always complete, accurate, or consistent because the medical centers we reviewed differed in how they interpreted and used templates for collecting the data. We made six recommendations, including that VA clarify guidance on how to complete these templates and ensure that medical centers have a process to review them. In response, VA took several actions in 2015, including analyzing diagnostic coding practices at medical centers, adding more specific guidance on how to complete the templates, and requiring medical center leadership to review the templates. These actions positioned VA to collect consistent data to better inform its suicide prevention efforts, and we closed all six report recommendations as implemented in fiscal year 2016. centers to assess the degree they were using alternative processes to address the root causes of adverse events when a root cause analysis is not required. By collecting this information, VA increased its awareness of medical center actions to address the root causes of adverse events.

For our 2011 review of VA’s purchasing, tracking, and reprocessing of expendable medical supplies (e.g., needles) and reusable medical equipment (e.g., endoscopes), we examined VA’s requirements as well as VA central office and regional network oversight processes. We found that both the tracking and reprocessing requirements we reviewed were inadequate to help ensure the safety of veterans who receive care at medical centers. We also found that VA central office did not analyze regional network reports on noncompliance with reusable medical equipment policies to inform its oversight. As such, we made four recommendations, including that VA develop and implement an approach for providing standardized training for reprocessing reusable medical equipment; hold VAMCs accountable for implementing the training; and use the regional network reports of noncompliance to take action to improve compliance in areas such as those that occur frequently, pose high risks to veterans’ safety, or have not been addressed. In 2015 and 2016, VA took action to require standardized training for reprocessing reusable medical equipment and oversight of reprocessing activities, issue guidance to clarify regional networks’ oversight responsibility, and identify areas of noncompliance that occur frequently and issue guidance to help address this noncompliance. All recommendations from this report have been closed as implemented.

GAO Contacts

For additional information about this high-risk area, contact Debra Draper at (202) 512-7114 or draperd@gao.gov, or Randall Williamson at (202) 512-7114 or williamsonr@gao.gov.

Related GAO Products

Veterans Health Administration: Management Attention Is Needed to Address Systemic, Long-standing Human Capital Challenges. GAO-17-30. Washington, D.C.: December 23, 2016.

VA Health Care: Improved Monitoring Needed for Effective Oversight of Care for Women Veterans. GAO-17-52. Washington, D.C.: December 2, 2016.

Veterans Health Care: Improvements Needed in Operationalizing Strategic Goals and Objectives. GAO-17-50. Washington, D.C.: October 21, 2016.

VA Health Care: Processes to Evaluate, Implement, and Monitor Organizational Structure Changes Needed. GAO-16-803. Washington, D.C.: September 27, 2016.

Veterans’ Health Care: Improved Oversight of Community Care Physicians’ Credentials Needed. GAO-16-795. Washington, D.C.: September 19, 2016.

VA IT Management: Organization Is Largely Centralized; Additional Actions Could Improve Human Capital Practices and Systems Development Processes. GAO-16-403. Washington, D.C.: August 17, 2016.

Veterans Affairs: Sustained Management Attention Needed to Address Numerous IT Challenges. GAO-16-762T. Washington, D.C.: June 22, 2016.

VA’s Health Care Budget: In Response to a Projected Funding Gap in Fiscal Year 2015, VA Has Made Efforts to Better Manage Future Budgets. GAO-16-584. Washington, D.C.: June 3, 2016.

Veterans Crisis Line: Additional Testing, Monitoring, and Information Needed to Ensure Better Quality Service. GAO-16-373. Washington, D.C.: May 26, 2016.

Veterans’ Health Care: Proper Plan Needed to Modernize System for Paying Community Providers. GAO-16-353. Washington, D.C.: May 11, 2016.

VA Health Care: Actions Needed to Improve Newly Enrolled Veterans’ Access to Primary Care. GAO-16-328. Washington, D.C.: March 18, 2016.

DOD and VA Health Care: Actions Needed to Help Ensure Appropriate Medication Continuation and Prescribing Practices. GAO-16-158. Washington, D.C.: January 5, 2016.

VA Mental Health: Clearer Guidance on Access Policies and Wait-Time Data Needed. GAO-16-24. Washington, D.C.: October 28, 2015.

VA Primary Care: Improved Oversight Needed to Better Ensure Timely Access and Efficient Delivery of Care. GAO-16-83. Washington, D.C.: October 8, 2015.

VA Health Care: Oversight Improvements Needed for Nurse Recruitment and Retention Initiatives. GAO-15-794. Washington, D.C.: September 30, 2015.

Electronic Health Records: Outcome-Oriented Metrics and Goals Needed to Gauge DOD’s and VA’s Progress in Achieving Interoperability. GAO-15-530. Washington, D.C.: August 13, 2015.

Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland

Why Area Was High Risk

Since 2015, the Program Manager (Program Manager) for the Information Sharing Environment (ISE) and key departments and agencies have made significant progress to strengthen how intelligence on terrorism, homeland security, and law enforcement, as well as other information (collectively referred to in this section as terrorism-related information) is shared among federal, state, local, tribal, international, and private sector partners. As a result, the Program Manager and key stakeholders have met all five criteria for addressing our high risk designation, and we are removing this issue from our High-Risk List. While this progress is commendable, it does not mean the government has eliminated all risk associated with sharing terrorism-related information. It remains imperative that the Program Manager and key departments and agencies continue their efforts to advance and sustain the ISE. Continued oversight and attention is also warranted given the issue’s direct relevance to homeland security as well as the constant evolution of terrorist threats and changing technology. As we have with areas previously removed from the High-Risk List, we will continue to monitor this area, as appropriate, to ensure that the improvements are sustained. If significant problems again arise, we will consider reapplying the high risk designation. terrorism-related information. Figure 22 depicts the relationship between the various stakeholders and disciplines involved with the sharing and safeguarding of terrorism-related information through the ISE.

What GAO Found

The federal government has made significant progress in promoting the sharing of information on terrorist threats, and has met all of our criteria for removal from the High-Risk List. The Program Manager and key departments and agencies met the leadership commitment and capacity criteria in 2015, and have subsequently sustained efforts in both these areas. For example, the Program Manager clearly articulated a vision for the ISE that reflects the government’s terrorism-related information sharing priorities. Key departments and agencies also continued to allocate resources to operations that improve information sharing, including developing better technical capabilities.

Implementation Plan (Implementation Plan), which includes the overall strategy and more specific planning steps to achieve the ISE. Further, they have demonstrated that various information sharing initiatives are being used across multiple agencies as well as state, local, and private sector stakeholders. For example, the Project Manager has developed a comprehensive framework for managing enterprise architecture to help share and integrate terrorism-related information among multiple stakeholders in the ISE. Specifically, the Project Interoperability initiative includes technical resources and other guidance that promote greater information system compatibility and performance. Furthermore, the key departments and agencies have applied the concepts of the Project Interoperability initiative to improve mission operations by better linking different law enforcement databases, and facilitating better geospatial analysis, among other things. accomplishments (e.g., related to maritime domain awareness) where the Program Manager helped connect previously incompatible information systems. The Program Manager has also partnered with DHS to create an Information Sharing Measure Development Pilot that intends to better measure the effectiveness of information sharing across all levels of the ISE.

Further, the Program Manager and key departments and agencies have used the Implementation Plan to track progress, address challenges, and substantially achieve the objectives in the National Strategy for Information Sharing and Safeguarding. The Implementation Plan contains 16 priority objectives, and by the end of fiscal year 2016, 13 of the 16 priority objectives were completed. The Program Manager transferred the remaining 3 objectives, which were all underway, to other entities with the appropriate technical expertise to continue implementation through fiscal year 2019.

In our 2013 high-risk update, we listed nine action items that were critical for moving the ISE forward. In that report, we determined that two of those action items—demonstrating that the leadership structure has the needed authority to leverage participating departments, and updating the vision for the ISE—had been completed. In our 2015 update, we determined that the Program Manager and key departments had achieved four of the seven remaining action items—demonstrating that departments are defining incremental costs and funding; continuing to identify technological capabilities and services that can be shared collaboratively; demonstrating that initiatives within individual departments are, or will be, leveraged to benefit all stakeholders; and demonstrating that stakeholders generally agree with the strategy, plans, time frames, responsibilities, and activities for substantially achieving the ISE.

For the 2017 update, we determined that the remaining three action items have been completed: establishing an enterprise architecture management capability; demonstrating that the federal government can show, or is more fully developing a set of metrics to measure, the extent to which sharing has improved under the ISE; and demonstrating that established milestones and time frames are being used as baselines to track and monitor progress. Achieving all nine action items has, in effect, addressed our high-risk criteria.

Manager, departments, and agencies. Although no longer a high-risk issue, sharing terrorism-related information remains an area with some risk and continues to be vitally important to homeland security, requiring ongoing oversight as well as continuous improvement to identify and respond to changing threats and technology. Table 11 summarizes the Program Manager’s and key departments’ and agencies’ progress in achieving the action items.

Additional Details on What GAO Found

Leadership Commitment

In our 2013 high-risk update, we reported that the federal government had fundamentally met this high-risk criterion—primarily because it had established an interagency policy committee to leverage the efforts of participating departments and agencies. In addition, the Program Manager has continued to update the vision for the ISE as information sharing initiatives have evolved. Further, since 2013, the government has issued and largely executed the Implementation Plan and taken other actions, which demonstrate continued leadership commitment.

With the majority of Implementation Plan priority objectives completed in fiscal year 2016, the Program Manager has updated the vision and led the establishment of new goals to strengthen the ISE. For example, now that terrorism-related information sharing among key federal departments and agencies has matured, the Program Manger is expanding collaboration on information sharing initiatives with state, local, tribal, territorial, and private sector partners. This includes promoting the use of interoperable systems and disseminating best practices for sharing and safeguarding information. According to the Program Manager, this expanded stakeholder engagement is necessary given the increasing overlap of national security and public safety. assumed key roles in governing ISE activities. The SCC is the focal point for advancing core interoperability frameworks and standards, and the CICC is a key forum for federal and non-federal entities to develop, implement, and align information sharing platforms, according to the 2016 Information Sharing Environment Annual Report to the Congress. In addition, the SCC and CICC will have key roles in overseeing the three Implementation Plan priority objectives not completed in fiscal year 2016. Updating the vision for the ISE, including the expanded leadership roles for entities like the SCC and CICC, helps ensure terrorism-related information is accessible and identifiable to relevant federal, state, local, private, and foreign partners.

As we reported in 2015, key departments and agencies have also played an increased leadership role by serving as stewards for the priority objectives in the Implementation Plan. For example, DHS led the implementation of the priority objective on fusion centers, which was completed in fiscal year 2015, and has continued to lead efforts in this area as the vision for the ISE evolves. Additionally, departments and agencies have taken various actions to govern their own information sharing activities and to coordinate with the ISE. For example, DHS has used a governance board to serve as the decision-making body for DHS information-sharing issues since 2007. This board has identified information-sharing gaps and has developed a list of key initiatives to help address those gaps. Many of these initiatives—such as those related to safeguarding information—are consistent with established priorities for the ISE.

Capacity

Among other things, the federal government met this high-risk criterion in 2015 by changing its approach to funding information-sharing activities.

Specifically, key departments are funding ISE-related activities as part of mission activities and operations instead of seeking separate funds. Additionally, the Implementation Plan defines the fundamental technological capabilities and services for advancing the ISE. The Program Manager and key departments and agencies also satisfied this high-risk criterion through their progress in identifying technological capabilities and services that can be shared collaboratively within and across the ISE, consistent with a federated architecture approach.

As we reported in 2015, regarding the government’s approach to funding, senior officials in each key department or agency explained that any incremental costs related to implementing the ISE continue to be embedded within each department’s mission activities and operations and do not require separate funding. The Program Manager and department and agency officials also noted that the Implementation Plan assigned priority objectives to those departments and agencies whose missions most align with the initiatives under each objective, thereby helping to ensure that the activities received funding. begun to adopt these standards, an important step in developing federal capabilities to establish individual accountability and facilitate the appropriate level of information access.

There are multiple priority objectives in the Implementation Plan that further the capacity to identify and share technical capabilities within and across the ISE. For instance, the priority objective on discovering and accessing information addresses the ability to discover that information exists and retrieve it. According to the results of a 2014 questionnaire administered by the Office of the Program Manager, over 80 percent of agencies reported improvements over the previous year in their ability to discover, access, and retrieve information necessary to accomplish their missions. As of December 2016, the remaining milestones associated with this priority objective were expected to be completed by fiscal year 2019, according to the Program Manager and key department documentation.

The Implementation Plan also contains an objective dedicated to standards-based acquisition, which seeks to ensure that future products and services are interoperable and can easily exchange and interpret data. The goal of this objective is to develop common technical standards to guide all departments and agencies when they acquire new technologies. The five milestones contained under this objective were completed in fiscal year 2016, including developing a standards handbook. The Implementation Plan also identifies capacity-related activities consistent with a federated architecture approach, such as identifying technological capabilities and services to be used across communities of interest. For example, ISE stakeholders developed a repository of capabilities and services as part of the priority objective on interoperability. These knowledge resources include a web-based collection of tools, best practices, and frameworks for improving information interoperability.

Action Plan

The government has met this high-risk criterion by developing and largely executing the Implementation Plan, leveraging information-sharing initiatives across the government, and improving enterprise architecture management as recommended in our 2011 report on the ISE.

Developing and executing the Implementation Plan were important steps for the ISE, and as we have reported, are characteristics that can enhance the usefulness of national strategies. Specifically, the Program Manager and key departments and agencies generally agreed with the plan’s actions and time frames to advance the ISE. Further, the Program Manager has demonstrated that ISE stakeholders have taken steps to implement concepts promoted by the Project Interoperability initiative, including those contained in the Information Interoperability Framework (I2F).

In addition to identifying key initiatives—such as those intended to control information access, safeguard information, increase a user’s ability to search for relevant information, and increase interoperability among data systems—the Implementation Plan seeks to address gaps in information sharing that ISE stakeholders identified and that we highlighted in our 2013 and 2015 high-risk reports. For example, the plan establishes a priority objective dedicated to information sharing with the private sector. This objective seeks to ensure that processes and procedures are in place for identifying threats, including those related to cybersecurity and to critical infrastructure—such as financial institutions, commercial facilities, and energy production and transmission facilities, among others. The Program Manger and key departments and agencies reached agreement on and completed all four milestones associated with the private sector priority objective by the end of fiscal year 2016. Among other things, this effort is intended to make appropriate fusion center products accessible to critical infrastructure owners and operators, and identify systems tools that provide near real time situational awareness of critical infrastructure vulnerabilities across the law enforcement and intelligence communities. survey administered by the Program Manager, numerous agencies also mentioned that they were leveraging the fusion center information sharing initiative. Specifically, all agencies that answered the 2014 question related to fusion center progress reported satisfaction with improvements made in the last year to enhance the capabilities and performance of the national network of fusion centers. This included improving how threat and encounter information is shared between the federal government and state, local, and private partners. In November 2014, we reported on federal efforts to improve fusion center capabilities and results.

Additionally, in April 2013, we reported that fusion centers, along with other field-based information sharing entities, provided a variety of analytical activities that resulted in benefits, such as intelligence products. We also recommended that DHS, DOJ, and the Office of National Drug Control Policy (ONDCP) collaborate to (1) identify practices that could enhance the coordination and reduce unnecessary overlap across field-based information sharing entities, and (2) develop a mechanism that will allow them to hold field-based information-sharing entities accountable for coordinating with each other. Since our report DHS, DOJ, and ONDCP have made significant progress toward addressing our recommendations. Specifically, the three agencies have taken the necessary steps to assess the extent to which practices that can enhance coordination are being implemented at fusion centers and other field-based information sharing entities. They have also developed a mechanism to hold fusion centers and other field-based information sharing entities accountable for coordinating their analytical and investigative activities. However, the FBI has not taken action on our recommendations for the field-based information sharing entities it leads and, as a result, the recommendations from our report have not been fully addressed. milestones associated with establishing aspects of the ISE architecture. Such milestones include developing Project Interoperability and the I2F, key elements intended to help link systems across departments to enable information sharing (i.e., interoperability). For instance, the I2F calls for a common profile for achieving interoperability among systems, which among other things, can enable a user to access different departments’ or agencies’ databases from a single workstation. In March 2014, the Program Manager issued an initial version of I2F to guide the implementation of information-sharing capabilities. In 2016, the Program Manager identified several ongoing initiatives that implemented I2F concepts. For example, officials from the Office of the Program Manager provided documentation that illustrated how I2F was used and stated that the framework helped: identify security specifications for successfully exchanging data across various maritime partners to share information via the Maritime ISE, including services to publish and search for information about a ship’s location; create a virtual nationwide event deconfliction system to alert affected agencies or officers of potential conflicts between officers who are conducting law enforcement operations at the same time and in close proximity; and bridge data standards to enhance geospatial exchange capabilities (e.g., data embedded in maps) among mission partners, such as homeland security, law enforcement, emergency management, and public safety.

Information Network, Regional Information Sharing Systems, Law Enforcement Enterprise Portal, and Intelink-U) are now interoperable, providing an array of services and information through a simplified sign- on using existing credentials. The Program Manager also stated that ongoing efforts to improve information sharing have informed future architecture efforts, including guidance associated with Project Interoperability 2.0, which is to provide the framework for building the next generation of the ISE.

The Program Manager has also made progress in using the Implementation Plan to hold key departments and entities accountable over time for executing priority objectives and milestones associated with establishing aspects of the ISE architecture. Specifically, the Implementation Plan established architecture-related milestones and time frames to track and monitor progress. Importantly, the Program Manager and key stakeholders collaborated to create the plan and generally agreed with its timeframes and delegation of responsibilities to advance the ISE. In September 2015 and July 2016, the Program Manager updated us on the status of executing these priority objectives, including milestones with revised target dates and new entities that will assume responsibilities to complete the priority objectives, thereby demonstrating that the priority objectives and milestones are monitored over time. The Program Manager has not yet demonstrated outcomes associated with all of the priority objectives because several milestones are not complete. We will continue to monitor these enterprise architecture activities to ensure that they are sustained over time.

Monitoring

The Program Manager and key departments and agencies have made sufficient progress to meet this high-risk criterion of monitoring by (1) implementing initiatives that show the extent to which information sharing has improved under the ISE and (2) continuing to develop metrics and processes to measure results achieved, both from individual projects and activities, as well as from the overall ISE. Developing effective performance metrics for information sharing initiatives is challenging given the complexity of information sharing, and the Program Manger acknowledged in 2016 that additional work is needed in this area. However, considering the collective efforts of the Program Manager’s performance management framework—including the Implementation Plan—key departments and agencies, and the ongoing Information Sharing Measure Development Pilot, we consider this high-risk criterion to be met.

The Program Manager has created a performance management framework to measure the performance of key departments and agencies in completing ISE initiatives, many of which are included in the Implementation Plan. At a high level, performance is monitored by executing the Implementation Plan. For example, there are clear linkages between the plan’s 16 priority objectives, which in turn are linked to the 5 overarching goals in the 2012 National Strategy for Information Sharing and Safeguarding: collective action, common standards, shared services, safeguarding, and privacy. In this context, achieving milestones are a means of measuring progress toward the overarching strategic goals. For example, the 4 completed milestones under the governance priority objective helped advance all 5 strategic goals by identifying governance best practices and establishing a governance roadmap to implement information sharing initiatives. Table 12 illustrates the alignment between Implementation Plan priority objectives and national strategic goals.

The performance management framework also consists of several measures, including the Performance Assessment Questionnaire. For example, through the annual questionnaire, the Program Manager measured results from key ISE initiatives, such as the extent that information gathered from international partners is integrated into the process the government uses to screen individuals for potential terrorist threats. In 2016, the Program Manger reported that his office was revising the format of the questionnaire, in part because the Implementation Plan was mostly complete, but that collecting certain performance data would continue.

The Program Manager also developed a set of homeland security scenarios in 2011 to assist key departments in planning for and executing the ISE’s initiatives. The scenarios were designed to demonstrate information-sharing capabilities relevant to an agency’s mission, as well as to allow the Program Manager and departments to determine if the ISE is achieving desired capabilities. For example, 1 scenario described how departments need to mature their capabilities over the next 7 years such that an analyst does not have to manually check numerous databases to find information related to a suspicious activity, but rather can conduct 1 search of linked databases from a single point of entry. Similarly, in 2016, the Program Manger referred to the eight “mission stories” documented on the Office of the Program Manager’s website as qualitative indicators of improved information sharing over time.

The mission stories include issue areas such as cybersecurity, counterterrorism, domain awareness, and interoperability, and according to the Program Manager, represent causal outcomes of ISE initiatives and are evidence of improved decision-making capability. Although the mission story information does not encompass quantitative metrics, it provides means to demonstrate the extent to which information sharing has improved, and results have been achieved through individual projects. For example, in the cybersecurity issue area, the Program Manager partnered with the International Association of Chiefs of Police, among other entities, to create the Law Enforcement Cyber Center, an online portal to facilitate information sharing about cyber-crime investigations. safeguarding measures between 2011 and 2016. Specifically, the Program Manger solicited agency responses to 16 questionnaires that measured agency implementation of policy recommendations related to removable media, online identity management, insider threat programs, access control, and enterprise audit. The results of this program—which directly links to the Implementation Plan’s priority objective on information safeguarding—were used to inform executive and legislative leadership of the government’s progress in simultaneously sharing and protecting sensitive terrorism-related information, and provided a quantitative measure of results achieved Separately, DHS and other stakeholders have been collecting performance data on fusion center capabilities since 2011, which are assessed and reported in annual reports. DHS uses an online self- assessment survey, which in 2015 included 128 questions and 10 data tables, to collect information from individual fusion centers. The results provide various output and outcome measures related to such areas as information gathering, analysis, and dissemination, and enhanced threat and domain awareness. The Program Manager’s and DHS’s efforts to establish performance metrics for areas such as information safeguarding and fusion centers are other means to help monitor and gain insight into the overall state of the ISE.

In addition, in October 2016, the Program Manager and DHS initiated a pilot to help measure and monitor the overall performance of information sharing across the ISE. Specifically, the Information Sharing Measure Development Pilot intends to develop a new set of information sharing measures by analyzing how information is exchanged in various networks. According to DHS officials, algorithms will be used to calculate an Information Sharing Index that can quantify information sharing efficiencies across organizations, agencies, and departments regardless of information topic or use. The pilot project, scheduled for completion by the end of fiscal year 2017, will focus in part on fusion center information sharing. According to the Program Manager and DHS officials, the resulting metrics will then be applied more broadly across the ISE. The Program Manager and DHS have compiled a detailed Memorandum of Agreement, which clearly defines the project’s scope, objectives, time frames, and deliverables. If completed and broadly implemented, this performance measures initiative could be a valuable tool to assess and improve information sharing across the ISE.

Demonstrated progress

The Program Manager and key departments and agencies have met this criterion primarily by using the Implementation Plan to track progress in implementing priority objectives and in substantially achieving the overall ISE. The Implementation Plan assigns stewards to each priority objective—in most cases, a senior official within a key department or agency—who have primary responsibility for coordinating, integrating, and synchronizing activities to achieve the priority objectives within the time frames established. The steward is responsible for ensuring that participating agencies communicate and collaborate to complete the objective, while also raising to senior management any issues that might hinder progress. Stewards are to communicate these issues via the Information Sharing Council (ISC), a body consisting of senior officials from a variety of federal departments and agencies.

The Program Manager stated that 13 of the 16 priority objectives were completed by the end of fiscal year 2016. The Program Manager transferred the remaining 3 objectives—Data Tagging, FICAM, and Discovery and Access—to other entities to implement through fiscal year 2019. Table 13 describes the 13 completed Implementation Plan priority objectives and examples of demonstrated progress. For example, work on several priority objectives—such as reference architecture and standards-based acquisitions—resulted in concrete guidance based on best practices that was then made available for stakeholders to use in their own organizations. The interoperability objective resulted in products, such as the I2F framework, that were used by multiple entities to improve terrorism-related information sharing across different information systems. Among other things, the fusion center and private sector priority objectives resulted in new processes that facilitated greater and more secure information sharing with critical infrastructure owners and operators.

Descriptions

Complete the implementation of the Nationwide Suspicious

Activity Reporting (SAR) Initiative programs while expanding training and outreach beyond law enforcement to the rest of the public safety community. and secured funding for related training materials.

Achieve the four Critical Operational Capabilities, four Enabling Capabilities, and other prioritized objectives across the National Network of Fusion Centers to help them effectively and lawfully execute their role as a focal point within the state and local environment for receiving, analyzing, gathering, and sharing threat-related information.

Ensured appropriate federal analytic products are posted, shared, and cataloged within DHS’s secure information network. that clearly documented the status of all priority objectives and milestones. Among other information, these tracking documents detailed whether milestones were completed, on track, needed attention, or deleted, along with due dates.

The Program Manger reported that his staff request documentation from stewards—such as white papers, emails, project completion notifications, and formal memorandums—to prove that milestones are complete. In this manner, over time, the Program Manager and key departments track milestones and adjust project baselines as needed. The status of modifying milestones was documented in regular priority objective and milestone updates. For instance, in cases where milestones were added, such as under the Data Tagging and FICAM priority objectives, the Program Manger noted that the new milestones were not creating additional tasks. Rather, the new milestones were written at a finer level of detail, which allowed departments and agencies to demonstrate incremental progress that was not visible under the original milestones. Milestones were deleted if stewards and stakeholders agreed that the milestones were no longer relevant to accomplishing priority objectives. The Program Manager and officials from key departments and agencies generally agreed that the Implementation Plan and process used to track and adjust priority objectives and milestones were effective, and we reviewed documentation that justified the status determinations for several milestones.

Overall, the Program Manager and key departments have demonstrated progress in advancing the ISE by using processes to track and assess the status of priority objectives and milestones, and to make adjustments if needed. The majority of milestones were met within the given timeframes of the Implementation Plan, which enabled the work of the ISE to move forward.

GAO Contact

For additional information about this high-risk area, contact Diana Maurer at (202) 512-9627, or maurerd@gao.gov.

Related GAO Products

Information Sharing: DHS Is Assessing Fusion Center Capabilities and Results, but Needs to More Accurately Account For Federal Funding Provided to Centers. GAO-15-155. Washington, D.C.: November 4, 2014.

Maritime Critical Infrastructure Protection: DHS Needs to Better Address Port Cybersecurity. GAO-14-459. Washington, D.C.: June 5, 2014.

DHS Intelligence Analysis: Additional Actions Needed to Address Analytic Priorities and Workforce Challenges. GAO-14-397. Washington, D.C.: June 4, 2014.

Intelligence, Surveillance, and Reconnaissance: DOD Has Taken Steps to Improve Data Management, but Key Guidance Is Incomplete. GAO-13-398SU. Washington, D.C.: May 8, 2013.

Intelligence, Surveillance, and Reconnaissance: DOD Has Partially Implemented GAO’s Recommendations to Enhance Intelligence Information Sharing. GAO-13-440SU. Washington, D.C.: April 26, 2013.

Information Sharing: Agencies Could Better Coordinate to Reduce Overlap in Field-Based Activities. GAO-13-471. Washington, D.C.: April 4, 2013.

Information Sharing: Additional Actions Could Help Ensure That Efforts to Share Terrorism-Related Suspicious Activity Reports Are Effective. GAO-13-233. Washington, D.C: March 13, 2013.

Terrorist Watchlist: Routinely Assessing Impacts of Agency Actions since the December 25, 2009, Attempted Attack Could Help Inform Future Efforts. GAO-12-476. Washington, D.C.: May 31, 2012.

Information Sharing Environment: Better Road Map Needed to Guide Implementation and Investments. GAO‑11‑455. Washington, D.C.: July 21, 2011.

Appendix III: GAO’s 2017 High-Risk List

The areas on our 2017 High-Risk List are shown in table 15.

GAO Related Products

The following GAO reports reflect our High-Risk Series reports issued since 2000. For additional GAO related products issued specific to each of the 34 high-risk areas on our updated list, see our High-Risk List website, http://www.gao.gov/highrisk/.

High-Risk Series: Key Actions to Make Progress Addressing High-Risk Issues. GAO-16-480R. Washington, D.C.: April 25, 2016.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 11, 2015.

High-Risk Series: An Update. GAO-13-283. Washington, D.C.: February 14, 2013.

High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 16, 2011.

High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 22, 2009.

High-Risk Series: An Update. GAO-07-310. Washington, D.C.: January 31, 2007.

High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 1, 2005.

High-Risk Series: An Update. GAO-03-119. Washington, D.C.: January 1, 2003.

High-Risk Series: An Update. GAO-01-263. Washington, D.C.: January 1, 2001.

Determining Performance and Accountability Challenges and High Risks. GAO-01-159SP. Washington, D.C.: November 1, 2000.