Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies
Released: 2014-06-25T00:00:00

Letter

Background

Attacks against U.S. Diplomatic Missions Resulted in Legal and Policy Changes

U.S. diplomatic missions have faced numerous attacks in recent years, resulting in legal and policy changes. According to DS, between January 1998 and December 2013, there were 336 attacks against U.S. personnel and facilities. Several of those attacks resulted in the deaths of U.S. personnel, destruction of U.S. facilities, or both including recent attacks in Benghazi, Libya, in September 2012, and in Ankara, Turkey, and Herat, Afghanistan, in 2013.

Pub. L. No. 99-399 (codified at 22 U.S.C. § 4801 et seq).

State Bureaus and Offices Responsible for Physical Security of U.S. Diplomatic Facilities Abroad, Numbers of Facilities, and Funding for Physical Security of Facilities

The Omnibus Diplomatic Security and Antiterrorism Act of 1986 requires that the Secretary of State (in consultation with the heads of other federal agencies) develop and implement policies and programs, including funding levels and standards, to provide for the security of U.S. government diplomatic operations abroad. State’s policies are detailed in the FAM and corresponding FAH; these include the Overseas Security Policy Board (OSPB) standards and the Physical Security Handbook specifications to guide implementation of the standards. In June 1991, State adopted new security-related construction standards, which are included in the FAH and have continued to evolve.

Responsibility for diplomatic facility security falls principally on two State bureaus, DS and OBO.

DS is responsible for, among other things, establishing and operating security and protective procedures at posts, developing and implementing posts’ physical security programs, and chairing the interagency process that sets security standards. In addition, at posts, it is the DS agents known as Regional Security Officers (RSOs), including Deputy RSOs and Assistant RSOs, that are responsible for protection of personnel and property, documenting threats and facility vulnerabilities, and identifying possible mitigation efforts to address those vulnerabilities, among other duties.

OBO is responsible for the design, construction, acquisition, maintenance, and sale of U.S. government diplomatic property abroad, establishing construction programs—including those for most facility and security-related construction—and providing direction and guidance on construction matters abroad to State regional bureaus and other agencies.

State’s overseas posts also play a role in setting post-specific security measures and funding some physical security upgrades, with approval from DS. In addition, M/PRI manages State’s implementation of ARB recommendations and State’s Bureau of Administration coordinates State’s clearance process regarding updates to the FAM and FAH. (See fig. 2 for an organizational chart of the key State offices responsible for physical security.) USAID maintains its own Office of Security, which is responsible for the physical security of its facilities and coordinating with DS.

According to OBO, State maintains approximately 1,600 work facilities, which includes offices and warehouses, at 275 diplomatic posts— embassies, consulates, and missions—worldwide under chief-of-mission authority. A significant number of State’s embassies and consulates predate the June 1991 construction standards. State constructed approximately 475 of the work facilities, including over 120 new embassy and consulate compounds and annex facilities built to the newer construction standards. In addition, State acquired—purchased or leased—over 1,125 work facilities. According to State officials, State has a limited number of temporary work facilities, mostly in high-risk locations such as Afghanistan. In addition, USAID maintains over 25 independently leased facilities.

In fiscal years 2009 through 2014, State allotted about $8.3 billion directly to construction of new secure facilities and physical security upgrades to existing and acquired facilities (see table 1). While DS has a few small programs to provide physical security upgrades to facilities abroad, most of the allotted funds were managed by OBO. DS and OBO have detailed the conditions under which each bureau is responsible for funding security construction and upgrades. In general, OBO is responsible for constructing new facilities and funding upgrades to owned facilities and leased office facilities, while DS is responsible for funding physical security upgrades to leased residential facilities. State runs other programs, such as OBO’s major rehabilitation program and DS’s technical field support efforts, which may include physical security upgrades; however, we did not include funding from these sources in table 1. USAID has also allotted about $0.03 billion to directly support physical security upgrades.

State Conducts a Range of Activities to Manage Risks to Overseas Facilities; However, Gaps Exist in Categorizing Facilities and Ensuring Data Reliability

To manage risk to overseas facilities under chief-of-mission authority, State conducts a range of ongoing activities (see fig. 3), and after the September 2012 attacks, it took additional steps to improve risk management activities. Nonetheless, we found problems with facility categorization and data reliability that may affect State’s ability to accurately track facilities and rank them by the risks they face.

State Manages Risk to Overseas Facilities through Several Activities and Has Recently Taken Steps to Improve These Activities

State conducts several key activities to manage risk to overseas facilities:

OBO tracks facilities in a property inventory database, and OBO and other bureaus rely on the information in this database to inform a number of security-related decisions.

DS uses security-related questionnaires completed by officials at each post to assess and determine threat levels at each overseas post.

Working through an interagency group, DS establishes security standards for facilities overseas, which vary depending on the threat levels at each post.

Guided by the security standards, officials at posts periodically assess facilities to identify security deficiencies or vulnerabilities.

DS analyzes information from OBO’s property inventory database, the threat assessments, and the vulnerability assessments to assess the risk faced by overseas facilities. DS then ranks facilities by the level of risk each facility faces to help OBO prioritize embassy and consulate construction plans.

In addition to these ongoing activities to manage risk, State has taken steps to implement recommendations resulting from several post- Benghazi reports such as the ARB.

OBO Tracks Overseas Facilities in a Property Inventory Database

OBO is responsible for maintaining records on all diplomatic residential and work facilities overseas in its property inventory database (hereafter referred to as OBO’s property database). According to OBO officials, OBO and other State bureaus rely on this database for data on over 1,600 work facilities. OBO’s property database includes data for facilities State or USAID owns or leases, including facilities located outside embassy and consulate compounds—such as office spaces and warehouses—and facilities outside both the work and residential categories—such as recreational facilities. OBO’s property database does not include host-government facilities where U.S. agencies may operate, such as laboratories supported by the Centers for Disease Control.

According to OBO officials, OBO has undertaken several efforts since early 2012 to improve the quality of the information in its property database. For example, OBO hired additional staff to review the reliability of the data in the system, and these staff identified outdated records and missing information. In addition, in response to the Benghazi ARB report, OBO requested that all posts provide (1) a list of all facilities located off compound and (2) the number of desk positions at each facility. OBO intended to use this information to ensure that OBO’s property database contained records on all off-compound work facilities. According to OBO officials, the updated information from posts had been entered into its property database as of spring 2013.

DS Assesses Threat Levels at Posts Overseas

DS assesses six types of threats at each overseas post by evaluating the post’s security situation and assigning a corresponding threat level, which is used to determine the security standards required for facilities at that post. Published annually by State, the Security Environment Threat List documents each post’s threat levels for six threat categories, including political violence, terrorism, residential, and nonresidential crime. Each post is assigned one of four threat levels for each threat category. The levels are as follows: critical: grave impact on American diplomats; high: serious impact on American diplomats; medium: moderate impact on American diplomats; and low: minor impact on American diplomats.

According to DS officials, the bureau develops the Security Environment Threat List threat levels for each post based on questionnaires filled out by post officials, and the final threat ratings are reviewed and finalized through an iterative process involving officials at overseas posts and in headquarters.

A DS-Led Interagency Board Establishes Physical Security Standards for Diplomatic Work Facilities

DS, in conjunction with the interagency OSPB, reviews and issues uniform guidance on physical security standards for diplomatic work facilities overseas. Chaired by the Assistant Secretary of DS, OSPB includes representatives from approximately 20 U.S. agencies with personnel overseas, including intelligence, foreign affairs, and other agencies. State incorporates the OSPB’s physical security standards in the FAH for the six types of overseas work facilities, including embassy and consulate compounds. Facilities overseas, whether permanent, interim, or temporary, are required to meet the standards applicable to them. The OSPB standards vary by facility type, date of construction or acquisition, and threat level. If facilities do not meet all applicable standards, posts are required to request waivers to SECCA requirements, exceptions to OSPB standards, or both.

Within State’s physical security standards, we identified six categories of key security requirements, to protect overseas work facilities against physical attacks and other dangers: (1) a 100-foot setback from the perimeter wall, (2) anti-climb perimeter walls and “clear zone,” (3) anti- ram protection, (4) hardened building exteriors, (5) controlled access to the compound or facility, and (6) a safe space for taking refuge during an attack (see fig. 4 for an illustration of the six categories at a notional embassy).

In addition to the OSPB standards, State independently developed and continues to update the Physical Security Handbook, also published in the FAH, which provides detailed supporting information, such as construction specifications and diagrams, to help officials understand how to implement and meet the OSPB standards. State has supplemented the physical security standards found in the FAH with guidance found in other sources, such as OBO’s construction manuals or guidance sent out to posts.

DS and the OIG Periodically Assess Facility Vulnerabilities

DS and State’s OIG periodically assess facility vulnerabilities to identify security deficiencies. For example, RSOs at every post are to inspect the physical security of (1) each work facility at least once every 3 years to identify vulnerabilities and (2) potential properties prior to acquisition. To support these security assessments, DS developed a physical security survey template to guide RSOs in conducting the facility inspections. According to DS officials, during these inspections the RSOs are expected to identify all instances in which a facility does not meet OSPB standards. However, while visiting posts, we learned that not all RSOs know how to determine whether a facility meets certain security requirements. For example, one RSO did not know how to determine the level of protection provided by a forced-entry and ballistic-resistant door.Furthermore, based on our review of physical security surveys for 50 facilities at 14 posts, we identified four facilities with out-of-date surveys and 14 facilities for which DS could not provide us with a survey. DS is currently redesigning the physical security survey templates and automating the survey process, which may address the problems we identified. According to DS officials, RSOs in the field had already evaluated 44 embassies and consulates and a smaller number of other work facility types with the new survey templates as of November 2013.

The OIG is also supposed to inspect each overseas post once every 5 years; however, due to resource constraints, the OIG Office of Inspections has not done so. The OIG Office of Inspections has conducted inspections in an average of 24 countries per year (including all constituent posts within each country) in fiscal years 2010 through 2013. Given their limited resources, according to OIG officials, they have prioritized higher-risk posts. OIG’s post inspections cover all aspects of post management, including consular affairs, public diplomacy, and security, among other things. Each inspection team, according to OIG officials, includes one or two security inspectors who evaluate all aspects of a post’s security, including compliance with OSPB standards. Following the inspection, the OIG provides a report with all recommendations to the post’s management, DS, OBO, and other relevant bureaus which are required to respond to the OIG’s recommendations.

DS Assesses and Ranks Facilities According to Levels of Risk to Help OBO Set Construction Priorities

DS combines facility, threat, and vulnerability data to rank the level of risk faced by overseas facilities. This risk matrix forms the basis for OBO’s new embassy and consulate construction plans. According to DS officials, to develop the list of facilities ranked in the risk matrix, DS obtains a list of work facilities from OBO. To rank embassy and consulate compounds and off-compound facilities according to the risks they face, DS draws data from its threat and vulnerability assessments—including the threat levels for political violence and terrorism, host-country willingness and capability ratings, facility setback distance, and a facility rating for compliance with security standards. DS’s risk matrix also draws staffing data, such as numbers of desk positions and percentages of off- compound desk positions, from OBO’s annual colocation study, which enables OBO to collect updated staffing information from posts. The DS risk matrix was developed for OBO to identify facility replacement priorities in accordance with SECCA, which mandated that State submit a report annually from 2000 to 2004 that identified diplomatic facilities that were a priority for replacement or for any major security enhancement because of vulnerability to a terrorist attack. DS has continued this practice and now typically updates the risk matrix annually. OBO uses the risk matrix to develop its Capital Security Construction Program schedule, which identifies the highest priority posts for contract awards over the next 5 years. This schedule takes into consideration the availability of land at each post, the feasibility of obtaining construction permits, and other factors.

DS has, on occasion, modified the factors scored in the risk matrix to address the changing risk environment, according to a DS official. For example, in 2010, OBO requested that DS include the percentage of off- compound desk positions as one of the factors used in ranking facilities in the risk matrix. For the most current version, DS split the host- government capability and willingness score into two separate scores to reflect the increased emphasis on these factors following the September 2012 attacks.

State Has Taken Several Actions to Enhance Its Risk Management Activities since the September 2012 Attacks

Since the September 2012 attacks against U.S. facilities overseas, State has taken several actions to better manage risks to work facilities overseas, including (1) conducting interagency facility security assessments, (2) creating the High Threat Programs Directorate in DS, and (3) taking steps to address recommendations from the Benghazi ARB report. In response to the September 2012 attacks against overseas facilities—including facilities in Libya, Sudan, Tunisia, Yemen, and Egypt, among others—State formed several Interagency Security Assessment Teams to assess security vulnerabilities at 19 posts that DS considered to be high-threat and high-risk. Each team was led by a senior DS agent and included a DS physical security expert, and two U.S. military officials. Rather than assess the facilities at the 19 posts against the OSPB standards, the teams assessed all facilities at the 19 posts for any type of security vulnerability—physical or procedural. The Interagency Security Assessment Team process resulted in a report that included a list of recommendations for State, and more specifically, recommendations for DS and OBO to install additional physical security upgrades. For example, the teams recommended that many posts install concertina wire to increase the height of their perimeter walls and further improve anti- climb measures, a security enhancement that exceeds the OSPB standards. According to State officials, State immediately began upgrading the security at 5 of the 19 posts assessed by the Interagency Security Assessment Teams and is using fiscal year 2013 and 2014 funds to upgrade security at the other posts. According to State officials, these upgrades resulted in the deferral of planned security projects at other posts.

In addition, State created the new High Threat Programs Directorate within DS to ensure that those posts facing the greatest risk receive additional security-related attention. To determine which posts should fall under the new Directorate, DS developed a high-threat post risk list to rank posts, using many of the same criteria and data points used to rank facilities in the risk matrix that DS provides to OBO. Currently, the High Threat Programs Directorate is responsible for 27 posts in 20 countries and for 2 posts where operations are currently suspended. State plans to conduct annual and as-needed reviews of posts on the high-threat posts risk list, which could change the composition of the list.

Moreover, the Secretary of State convened an ARB following the attacks in Benghazi, and State plans to take action on all of the ARB recommendations. In addition, that ARB made two recommendations that led to the formation of other panels that reported on various aspects of State’s security operations. State is also taking action to address most of the recommendations from those two panels’ reports.

Action taken to address the Benghazi ARB recommendations: State agreed with all 29 of the ARB recommendations and as of April 2014, according to State officials, has implemented 15 of the recommendations. For example, State developed a method—the Vital Presence Validation Process—by which it can systematically review the “proper balance between acceptable risk and expected outcomes in high-threat, high-risk areas” when beginning, restarting, continuing, modifying, or discontinuing operations at individual posts. According to State officials, this transparent and repeatable process will help State determine the appropriate presence overseas through a documented, systematic, risk-based analysis. To address another recommendation, State developed a new process involving multibureau support cells and checklists to provide an action plan for opening a new post or reopening a post that had closed due to security concerns. State published checklists to support this process in the FAM and,applied the process on at least two occasions. according to State officials, State has already

Action taken to address the DS Organization and Management Panel’s recommendations: Based on a Benghazi ARB recommendation, State established a panel to evaluate the organization and management of DS. This panel provided State with its report in May 2013, and State accepted 30 of the 35 recommendations in the report. According to State officials, State has begun taking action to address these recommendations. For example, the panel recommended several organizational changes that State has already implemented, including raising three DS Assistant Director positions to Deputy Assistant Secretary positions. However, State does not plan to implement a recommendation to restructure responsibilities for the new High Threat Programs Directorate. State also does not plan to implement a recommendation concerning the creation of a DS chief of staff. Decisions on the other two recommendations concerning activities by the Bureau of Intelligence and Research are pending until the bureau’s vacant assistant secretary position is filled.

Action taken to address the Independent Panel on Best Practice’s recommendations: In response to the Benghazi ARB, State also established a panel of outside, independent experts with experience in high-threat, high-risk areas to help DS identify best practices for operating in these environments. The Independent Panel on Best Practices published its report in August 2013, and State plans to implement 38 of its 40 recommendations. State has begun taking action to address these recommendations. For example, State is developing (1) an accountability framework to document institutional and individual accountability and responsibility for security throughout the department and (2) a department-wide risk management policy. However, according to State officials, State has decided not to implement the panel’s recommendation that waivers to established security standards only be provided subsequent to the implementation of mitigating measures and State has not decided whether to implement the recommendation to elevate DS out of the Bureau of Management and create a new under secretary position for DS.

Problems with Categorizing Facilities and Ensuring Data Reliability May Impact State’s Tracking and Ranking of Facilities

Although State conducts a range of ongoing activities to manage risk to facilities overseas, we identified facility categorization and data reliability problems that may impact these activities:

DS and OBO have not defined the conditions that would determine when a warehouse with desk positions should be categorized as an office facility and meet appropriate office physical security standards.

State uses different facility categories in its physical security standards and property databases.

OBO’s property database and DS’s risk matrix have data reliability problems, including missing and inaccurate data.

DS and OBO Do Not Have a Shared Understanding on When to Categorize Warehouses as Office Facilities

DS and OBO have not agreed on a common definition for desk positions for the purpose of categorizing office and warehouse facilities, a decision which may have security and resource implications. According to best practices identified by GAO concerning the implementation of the Government Performance and Results Act of 1993 (GPRA) Modernization Act of 2010, agencies should have a shared understanding of definitions. Desk positions are those that require the use of designated office space, while positions that do not need office space, such as guards, garden staff, and custodial staff, are considered non- desk positions. These designations help OBO determine how much space is needed when planning construction of an embassy or consulate. However, during interviews with both DS and OBO officials in headquarters, we learned that DS and OBO do not agree on when a warehouse with desk positions must meet office standards. According to State officials, as of May 2014, DS and OBO began working together to establish a policy to determine when a warehouse with desk positions should be categorized as an office facility.

According to DS officials, posts are allowed to have some part-time desk positions in warehouses, such as those for warehouse supervisors who need a computer to manage warehouse activities. Such part-time desk positions, occupied for less than 4 hours per day, are permitted in a warehouse without the warehouse having to meet office security standards. However, the DS officials also noted that if a warehouse reached an undefined threshold of part-time desk positions, the warehouse would then have to meet office standards.

OBO officials indicated that they did not agree with DS’s decision to allow some part-time desk positions in warehouses without those facilities meeting office standards. In addition, when we reviewed an OBO- developed list of office and warehouse facilities located outside of embassy compounds, we identified a number of warehouses being used as offices. OBO officials stated that these facilities should meet OSPB standards for offices instead of those for warehouses, whether or not they are being occupied part time or full time.

During our site visits, we identified several warehouses with office space. In a January 2013 memorandum to State’s Under Secretary for Management, State OIG noted it had identified examples of warehouses We followed up on the OIG findings being used as office space as well.during facility reviews at the posts we visited, through document reviews, and during interviews with officials at posts and in headquarters. During our facility reviews, we identified one warehouse compound that included office facilities with desk positions. The RSO who toured the warehouse compound with us stated that the compound should be required to meet the office security standards, which require more rigorous security requirements. In addition, we visited two warehouses at other posts that contained a number of desk positions with computers. DS and OBO’s lack of agreement about when a warehouse with desk positions must meet office standards may hamper the implementation of appropriate physical security upgrades at these facilities.

State Lacks Standard Terminology for Different Facility Categories

GAO-12-1022. compound: sole occupant facilities or compounds, tenant of commercial office spaces, public office facilities, and Voice of America relay stations. State officials told us that OBO does not use these facility categories in its property database because OBO’s property database was designed to meet Federal Real Property Profile reporting requirements. OBO designates work facilities as an office, a warehouse, or a specific type of work facility, such as a library, workshop, medical office, dispatch office, or other facility to meet these reporting requirements. M/PRI officials stated that as they sought to implement Benghazi ARB recommendations, they became increasingly aware that definitional issues across different State bureaus were a challenge and noted that State is working to correct the issue. OBO started working with M/PRI in April 2014 to create a new management tool in which data from OBO’s property database will be combined with other data, such as host- government facilities and staffing data. According to State officials, all bureaus will use this management tool to access property information, which they believe will help support the use of more consistent facility categories. DS and OBO are also developing a pilot program to automatically download property data directly from OBO’s property database into a DS system to provide ready access to up-to-date property data, rather than relying on intermittent information sharing.

Because DS and OBO use different terminology for facility categories, the process DS follows when developing the risk matrix has weaknesses. To develop the list of facilities ranked in the risk matrix, DS obtains a list of work facilities from OBO that includes over 1,600 facilities. DS consolidates the list, resulting in approximately 400 compounds and off- compound office facilities. OBO’s facility categories has led DS to develop an ad hoc process for creating the list of facilities ranked in the risk matrix. This process has led to inconsistencies, and has caused DS to exclude facilities from the risk matrix or rank duplicative facilities. For example, the DS official responsible for this process stated that DS has listed each tenant office space in the same facility as separate off-compound facilities for some posts but combined them as one off-compound facility for other posts.

State consolidates all of the facilities in a compound into one entry in its risk matrix and also ranks the individual off-compound facilities.

Moreover, while reviewing a portion of the risk matrix, we identified several tenant office spaces that DS mistakenly omitted.

OBO’s Property Inventory Database and DS’s Risk Matrix Have Data Reliability Problems

We identified problems with the data reliability of OBO’s property inventory database and DS’s risk matrix. Our previous work has found that results-oriented organizations make sure that the data they collect are sufficiently complete, accurate, and consistent to support decision making. Although OBO has undertaken a number of efforts to validate the information in OBO’s property database, we identified 9 data entry errors in 65 facility data records at eight of the posts we visited. For instance, records for one post included eight off-compound facilities; however, when visiting the post we learned that three of the eight facilities were located at different posts in the same country and that three of the other facilities were actually residential garages. Without accurate data on overseas facilities, OBO and other bureaus relying on data from OBO’s property database may not be in a position to make fully informed risk- related decisions. According to State officials, State recently created a standard list of posts, and OBO has committed to using that list to correct errors in the property database by August 2014, which may address some of these data reliability issues.

In addition, DS is missing data for some of the factors evaluated in the risk matrix, and some of the data are incorrect. For example, DS officials did not enter certain data into the risk matrix, including (1) the number of desk positions for some facilities, (2) the threat-level scores for some facilities, and (3) the setback distance for some facilities. Without these data points, the total score for each of the facilities affected by the missing data could be skewed or incorrect. Furthermore, DS officials entered incorrect information for some of the data points in the risk matrix. For example, we identified several examples of embassy and consulate compounds with incorrect percentages of desk positions located off compound, some of which were overstated. We also identified information for two posts’ embassy compounds that was out of date and did not reflect the posts’ move into new embassy compounds. Because the overall score for each facility in the risk matrix is based on the data for eight factors, missing or incorrect data for even one factor may skew a facility’s overall score in the risk matrix, which could affect the information that OBO uses in prioritizing embassy and consulate compound construction plans. Moreover, because much of these data are also used in determining which posts fall under DS’s new High Threat Programs Directorate, DS may not have accurate information when determining which posts fall under the new directorate.

State Has Established Physical Security Standards for Most Types of Facilities, but Several Lack Standards, and Some Standards Are Problematic

State has developed security standards for most types of facilities but lacks standards for several of them, and we identified problems with some of the existing standards. Lacking standards for several types of facilities, officials are unable to systematically evaluate the security of all facilities. In addition, State’s process for updating physical security standards is not timely. In some instances, State and OSPB have taken over 8 years to update standards, which may leave some facilities more vulnerable in the interim. We also identified inconsistencies within the standards that may lead to confusion and the inconsistent application of security standards at posts. Furthermore, although OSPB is required to review the OSPB standards periodically, State does not systematically re- evaluate the existing security standards against evolving threats and risks.

Although State Has Developed Security Standards for Most Types of Facilities, It Lacks OSPB Standards for Several Others

State has developed security standards for a variety of facilities—such as offices and warehouses—but it has not developed OSPB standards for several other types of facilities. For security reasons, we are not naming the types of facilities in this report. For some of these other types of facilities, State issued guidance on physical security requirements in a May 2011 memorandum. However, these security requirements have not been incorporated into the OSPB standards. As a result, some officials at posts we visited were not aware of the physical security requirements found in the memorandum, and the physical security measures in place for such facilities at several of the posts we visited did not meet the outlined security requirements. Federal internal control standards call for reasonable assurance that assets are safeguarded, in part through identifying and assessing risk. Because State lacks OSPB standards for some facilities, officials are unable to systematically conduct risk assessments for these facilities, and consequently, appropriate security measures may not be taken, and the personnel working in or using those facilities may be at a greater risk if their facility should come under attack.

State’s Process for Updating Its Physical Security Standards Is Not Always Timely

Updating the FAM or the FAH, which includes the OSPB standards and the Physical Security Handbook, is supposed to take about 60 to 90 days, according to DS officials. However, we identified several examples in which the process for updating security standards in the FAM or the FAH took more than 3 years and some that took significantly longer than that. Federal internal control standards dictate that agencies must have timely communication and information sharing to achieve objectives; therefore, it is essential that agencies update their policies in a timely fashion, particularly when the security of lives, property, and information is at stake. DS manages the process by which the OSPB standards and the Physical Security Handbook are updated. DS officials said that it is supposed to take about 60 days to update the Physical Security Handbook, which requires clearance only within State, and 90 days to update the OSPB standards, which requires approval from other OSPB members. Specifically, it is supposed to take 30 days to draft and obtain approval within DS for an update to the security standards and handbook in the FAH and another 30 days to obtain approval for the draft changes by other relevant stakeholders within State, such as OBO and the Office of the Legal Adviser. If the draft changes include changes to OSPB standards, then it is supposed to take an additional 30 days to obtain approval from OSPB members. After all of the required approvals are obtained for changes to either the FAM or the FAH, DS sends the update to the Bureau of Administration for publishing.

We identified two examples of updates to the OSPB standards and the Physical Security Handbook that took 5 to 8 years to complete the process and 11 updates that are still pending after 3 to 8 years in process. Four of these updates resulted from recommendations by previous ARBs. For example, the 2005 ARB resulting from the attacks on the U.S. Consulate in Jeddah, Saudi Arabia, recommended that State and OSPB develop residential security standards to address terrorism threats. The OSPB working group completed a final draft of the standards in April 2009, but OSPB has not yet reviewed the draft standards. DS officials said the draft standards have not been sent to OSPB because other relevant State stakeholders have not yet approved them. Officials further noted that because these draft standards have been stalled in the approval process for 3 years, they may need to be modified to address threats that have been identified in the meantime before going to the OSPB for approval, thus re-starting the review process at the beginning.

DS officials said they face two key challenges in managing updates to the OSPB standards and the Physical Security Handbook that at times cause major delays in the update process—a cumbersome review process and subchapter update requirements.

Cumbersome review process. If a stakeholder suggests a change to the draft standard at any time during the review process, the proposed draft must go through the entire review process again (see fig.5). This requirement becomes more time consuming when someone in the later stages of the review process suggests an edit. In addition, DS officials told us that some stakeholders within State or OSPB member agencies may request additional time for reviewing proposed changes, which further delays the process.

FAM and FAH subchapter update requirement. The FAH requires officials to review and update the entire subchapter when making changes to an existing FAM or FAH subchapter, and there is no specific exception for life safety updates. As a result, when DS needs to make changes to the OSPB standards or the Physical Security Handbook, it must review and update the entire subchapter in which the update is located. As an example of how this requirement delays the process, DS officials told us that draft OSPB standards for compound emergency sanctuaries were begun in 2005 and not completed until 2013. DS finished drafting the standards in 2011, but the standards spent over 2 years in the approval and clearance process because DS and the relevant OSPB working group had to update the entire subchapter, which covers several sensitive security topics. Officials told us that non-State OSPB member agencies did not have any concerns with the compound emergency sanctuary standards, but some members had concerns with the other updates to the subchapter that resulted in additional delays. As noted above, if a stakeholder suggests a change to the draft at any time during the review and approval process, the draft must go through the entire review and approval process again. Because the additional edits occurred during the final stage of the process, each recommended change resulted in a full review of the draft at every level.

According to the FAH, in rare circumstances State’s Bureau of Administration will publish specific changes to a section in the FAH or the FAM without requiring a review of the full subchapter.explicitly state when or how such exceptions occur. DS officials said that they were aware of only a few instances in which the Bureau of Administration had granted such an exception. For example, following the Edward Snowden leaks of National Security Agency documents, the Bureau of Administration published changes to technical security requirements without requiring a review of the full subchapter. Officials told us they could not recall any exceptions to the subchapter update requirement on account of critical life safety updates to physical security standards.

Although it may take years for State to update some security standards, we found that State at times took steps to address identified threats in advance of approving updates to the security standards. For example, according to DS officials, DS sometimes works with OBO to quantify the cost of installing certain upgrades for new construction projects to meet draft security standards for which eventual approval is anticipated. If funding is available, OBO will incorporate the upgrades into facilities currently under construction or being planned for construction so that the facilities will meet the draft security standards. For example, OBO included mantraps in new embassy and consulate construction projects following the 2005 attack on the U.S. Consulate in Jeddah, Saudi Arabia, even though OSPB did not approve standards for mantraps until 2010. Furthermore, OBO included the construction of compound emergency sanctuaries in some construction plans before OSPB finalized the relevant standards. Nevertheless, because updates to the OSPB standards and the Physical Security Handbook are not always completed in a timely manner, posts may not have security measures in place to address identified threats.

Inconsistencies within Security-Related Guidance Documents May Lead to Confusion and Inconsistent Application of Some Security Standards

We identified a number of inconsistencies among various security-related guidance documents. Our previous work has found that leading organizations strive to ensure that their core processes efficiently and effectively support mission-related outcomes. To do so, policy standards should be clear and consistent in order to support good decision making. However, we identified about 20 inconsistencies pertaining to physical security standards within State’s various security-related guidance documents; such inconsistencies may lead to confusion and the inconsistent application of some security standards. The types of inconsistencies we identified fall into three categories: Inconsistencies between the FAM and the FAH. For example, in 2010 DS changed the threat categories in the Security Environment Threat List, which impacted security standards, but the corresponding updates to the FAM and the FAH are inconsistent. For example, the FAM states that security standards against the terrorism threat are part of the physical security standards. However, there are currently no security standards for the terrorism threat in the OSPB standards within the FAH. Inconsistencies within the FAH between OSPB standards and the Physical Security Handbook. In some cases, State made an update to either the Physical Security Handbook or the OSPB standards, but not to the corresponding standard in the other part of the FAH. For example, the OSPB standards include requirements for anti-ram perimeter walls at medium- and higher-threat posts, but the Physical Security Handbook used to include this requirement only for higher- threat posts. In addition, DS published physical security specifications for consular agencies in the Physical Security Handbook, but State and OSPB have not approved and incorporated the corresponding standards in the OSPB standards. In other cases, the Physical Security Handbook was outdated. For example, when we visited posts, the Physical Security Handbook contained a physical security standards matrix that did not accurately reflect all the OSPB standards. According to DS officials at headquarters, the matrix has since been updated to address some inconsistencies and is pending final approval. Inconsistencies between the OSPB standards and other policy guidance. OBO and other State bureaus maintain security-related standards that are not incorporated into the OSPB standards. For example, the Bureau of Consular Affairs requires a consular pass- back booth in the consular section of a controlled access compound facility, but this requirement was never incorporated into the physical security standards. According to DS officials, the draft standard to incorporate this requirement in the Physical Security Handbook is currently pending final approval. Furthermore, the State OIG identified several instances in which the OBO Building and Zoning codes covered additional security requirements not captured in the OSPB standards, and we confirmed their findings.

Inconsistencies among various guidance documents may lead to the inconsistent application of security standards if officials rely on one policy guide over another or are not aware of updated standards. Three different RSOs told us that the physical security standards matrix within the Physical Security Handbook—a list of standards for every type of facility at each threat level—is the primary source they use to evaluate facilities’ compliance with physical security standards, because it serves as an easy guide for facilities’ physical security requirements. However, as we previously noted, the physical security standards matrix was not up-to- date and did not accurately reflect all the OSPB standards when we visited posts. Hence, these officials may not have applied the appropriate security standards to the facilities at their posts. Some RSOs told us that State updates the OSPB standards and the Physical Security Handbook infrequently and that they learn about updates through DS cables or DS’s internal website. However, another two of the RSOs we interviewed did not know about updates made to the security standards in the past few years and therefore had not requested funding for relevant upgrades. For example, they were not aware that State had published standards for compound emergency sanctuaries in the Physical Security Handbook. The inconsistencies in the different security-related guidance documents may lead to confusion and inconsistent application of security standards, leaving some facilities at greater risk because they have not taken all appropriate security measures they are required to address.

State Does Not Systematically Reassess Standards against Evolving Threats and Risks

Although OSPB is required to review its security standards on a regular basis, State does not have a systematic process for evaluating the existing security standards against evolving threats and risks. The 1999 Nairobi and Dar es Salaam ARB report recommended that the U.S. government undertake a long-term strategy for protecting American officials overseas, including the assessment of security requirements to ensure that they meet the new range of global terrorist threats. Furthermore, the FAH requires OSPB to review all the OSPB standards periodically—at least once every 5 years; however, the process by which security standards are updated is either triggered by an event—a change within the organization of State, an annual review to identify out- of-date information, or an attack or other event affecting safety—rather than by a periodic and systematic evaluation of the relevance and adequacy of all the standards. Although State has updated the threat categories over the years, many of the physical security standards were developed prior to U.S. diplomatic missions being sustained in or near war zones, where the risks to U.S. personnel and facilities multiply and intensify. Furthermore, State rates numerous posts all over the world as high or critical threat for either political violence or terrorism, but their risk varies greatly due to several factors, including local infrastructure and the host-country government’s willingness and capability to provide security for U.S. facilities. Nevertheless, posts with the same threat rating are required to meet the same standards regardless of the risk each post faces. We identified several instances in which State and other officials deemed existing standards inadequate to meet the perceived threats and risks.

Interagency Security Assessment Teams recommended security upgrades above current standards: Following the attacks of September 2012, the teams traveled to a judgmental sample of high- threat, high-risk posts and made recommendations at each post, many of which exceeded the threat standards at the post.

Several facilities have security features that exceed requirements: While reviewing facilities at posts overseas, we identified several examples of facilities that had implemented security measures that exceeded security requirements. For example, at one post rated as having a medium threat for political violence, we found that an agency leasing two floors in an off-compound tenant office facility installed several security measures that exceeded security requirements, such as doors and a guard booth providing 15-minute forced-entry and ballistic-resistant protection–measures only required for tenant office facilities at posts with a critical threat rating for political violence. According to agency officials, they took this action because they did not believe that the OSPB standards addressed the current threats and risks that they faced in country. The RSO and other post officials approved the increased security measures. In addition, we found that posts in certain conflict zones took numerous measures that exceeded critical security standards, such as the construction of overhead cover, higher walls, and bunkers.

Posts may take additional steps on their own or through DS- and OBO- funded upgrades to implement security measures that exceed OSPB standards, because post or headquarters officials believe the standards are inadequate to mitigate against risks faced by some high-threat, high- risk posts. This leaves the establishment of facility-specific security measures up to the professional judgment of post RSOs, an ad hoc process that does not draw on the collective subject-matter expertise of DS and the interagency OSPB. This current approach to addressing threats and risks not covered by the OSPB standards may leave some high or critical threat posts more vulnerable. In addition, in the absence of standards that address a post’s current threats, it may be difficult for post officials to justify funding requests for security measures that go beyond the OSPB standards.

State Mitigates Vulnerabilities for Work Facilities That Do Not Meet Security Standards, but Its Waivers and Exceptions Process Has Weaknesses

State takes steps to mitigate vulnerabilities for older, acquired, and temporary work facilities that do not meet security standards, primarily through a waivers and exceptions process to document vulnerabilities and corresponding mitigation measures; however, the waivers and exceptions process has several weaknesses. All facilities at a post are expected to meet physical security standards, but when facilities do not or cannot meet certain security standards, State mitigates identified vulnerabilities through various construction programs and its waivers and exceptions process. For example, we found that none of the 43 facilities we reviewed at higher-threat, higher-risk posts met all applicable security standards and therefore required waivers, exceptions, or both. However, we identified several weaknesses with the waivers and exceptions process. Specifically, DS does not systematically track waivers and exceptions or re-evaluate them when threats or risks change. In addition, post officials do not always request waivers and exceptions when required, and requests are not always timely or correct. Moreover, in some instances, the mitigating measures a post has agreed to undertake as a condition of a waiver or exception are not fully implemented.

When Facilities Do Not Meet Standards, State Mitigates Security Vulnerabilities through Various Construction Programs and Its Waivers and Exceptions Process

OBO and DS Address Some Security Vulnerabilities through Construction Programs

State addresses identified security vulnerabilities through a number of construction programs, including the Capital Security Construction Program, the Compound Security Program, and the Major Rehabilitation Program. OBO has a threat- and vulnerability-based planning process for its construction projects that includes input from DS’s analysis of threats, vulnerabilities, and risk. The risk matrix provided by DS—a ranked list of facilities based on an assessment of the physical security conditions and threat levels at each post—guides OBO’s prioritization of new construction projects and compound security projects.

According to OBO documentation, OBO has moved over 30,000 people into safer facilities since 2000 through their various construction programs. The following OBO-managed construction programs address security vulnerabilities:

Capital Security Construction Program. Following the 1998 Africa embassy bombings, State determined that 80 percent of its overseas facilities did not meet security standards and should be replaced. Afterwards, State began a multiyear, multibillion dollar program to replace insecure and aging diplomatic facilities worldwide (see table 2). In 2005, State established the Capital Security Construction Program, through which each agency with an overseas presence contributes funds for construction based on its overseas staffing levels. OBO has constructed 109 new facilities since 1998.

Compound Security Program. The Compound Security Program complements the Capital Security Construction Program by providing interim physical security protection to vulnerable facilities until they are replaced, as well as enhancing physical security protection at facilities that will not be replaced by a new embassy or consulate compound. This program funds, among other things, projects to replace forced-entry and ballistic-resistant doors and windows, install emergency exits, and enhance environmental security by safeguarding against chemical, biological, and radiological attacks.

According to OBO officials, major security upgrades at posts cost on average $6 to $10 million but may cost up to $20 million, and since 2005, OBO has completed 53 major security upgrade projects funded by the Compound Security Program. OBO has allotted about $560 million to the program since fiscal year 2009 (see table 3).

Major Rehabilitation Program. This program provides for renovations, rehabilitations, expansions, or upgrades to systems and space for residential or work facilities that can no longer be physically or economically maintained by routine, preventive, and unscheduled repair activities. In addition, these projects are undertaken when new construction is not scheduled under the Capital Security Construction Program. Although the program is not focused on security upgrades, according to OBO officials, OBO strives to bring facilities up to current security requirements during major rehabilitation projects. State allotted approximately $243 million from fiscal years 2009 to 2014 for major rehabilitation.

DS also provides funding for some physical security upgrades to facilities abroad. Congress appropriates funds for DS through the Worldwide Security Protection account.emergency upgrades to address emerging vulnerabilities or for upgrades to facilities that will not be addressed by OBO. This is primarily the case in conflict zones such as Afghanistan, Iraq, and Pakistan, but also applies to some other high-threat, high-risk locations. For example, DS used some funding for physical security upgrades to install higher walls in at one post and barricades at another. In addition, officials said that DS funded projects in several countries under the new High Threat Programs Directorate in fiscal year 2013 that cost approximately $2 million and included upgrades for drop-arm barriers to protect against vehicle intrusions and other physical security measures.

When Security Vulnerabilities Are Identified, a Post Must Obtain Waivers or Exceptions That Define Agreed-Upon Mitigation Steps

Diplomatic work facilities are required to meet two sets of physical security standards, SECCA requirements and OSPB standards; however, when facilities do not or cannot meet all of the standards, post officials are required to request waivers to SECCA requirements, exceptions to OSPB standards, or both. SECCA requires that any site selected for a new U.S. embassy or consulate constructed after November 1999 accommodate the colocation all U.S. government personnel (except those under the command of an area military commander), and that any new U.S. diplomatic facility be located at least 100 feet from the perimeter wall. If State or other agencies acquire additional office space off compound, they are required to obtain a colocation waiver prior to occupancy of that facility. Furthermore, if a new facility does not meet the 100 foot setback requirement, the post must apply for a setback waiver. The Secretary of State may waive the SECCA requirements if the Secretary determines that security considerations permit and it is in the national interest of the United States. The FAM notes that the flexibility for State to grant waivers was provided by Congress with the expectation that waivers would be infrequent.

According to the FAH, a post must request an exception for a new office construction project or a facility acquired after June 1991 if it does not fully comply with an applicable OSPB standard. Similarly, a post must request an exception for an existing office building if the building does not or cannot fully comply with physical security standards following an upgrade project. A waiver or exception request typically includes a description of mitigation steps planned or taken by the post to address identified vulnerabilities. For example, if an acquired facility does not meet blast resistance construction standards for walls, doors, and windows, the post may install additional anti-ram structures outside the perimeter wall to provide additional setback.

The development of waiver and exception requests involves a collaborative drafting and multilevel review process. According to DS officials, the requests are drafted through a collaborative process, with DS officials in headquarters helping the RSO or the tenant agency write the request to ensure that it complies with department policy and appropriately articulates mitigation steps planned or taken by the post to address vulnerabilities. In addition, each waiver or exception request must pass through several layers of review at the post and within State. The Assistant Secretary of DS serves as the final reviewer for all OSPB exception requests and any SECCA waiver requests for facilities other than an embassy or consulate building. The Secretary of State must approve all SECCA waiver requests for embassy and consulate DS officials said the types of mitigation steps taken in each buildings. situation depend on the collective knowledge of the RSO and other DS staff working to mitigate a risk. In addition, the types of mitigation steps possible at individual posts depend on the availability of materials in country, shipping constraints, and host-government policies.

According to 12 FAM 315.1, the Secretary delegated the authority for waiver approvals for embassies or consulates that do not substantially occupy a building—such as an office located in a large commercial office—to the Assistant Secretary of DS.

Many Overseas Work Facilities Do Not Meet the Most Rigorous Security Standards Set for Newly Constructed or Newly Acquired Facilities

Many older, acquired, and temporary work facilities at U.S. posts overseas do not meet SECCA requirements and OSPB standards for newly constructed or newly acquired facilities.

Since newer facilities are expected to meet more rigorous physical security standards and most existing facilities are not new, most facilities may not meet these standards. Some embassy and consulate compounds are newly constructed and expected to meet most physical security standards. However, a significant number were constructed or acquired prior to June 1991 and are only required to meet many of the OSPB standards to the maximum extent feasible or practicable.

We found that a substantial portion of the approximately 1,245 office facilities overseas do not meet SECCA requirements and OSPB standards and had requested waivers, exceptions, or both. According to DS documentation, State has processed over 400 setback waivers for various types of office facilities and about 300 colocation waivers for off-compound office facilities, in accordance with SECCA. In addition, DS has processed about 280 OSPB exceptions packages for work facilities—and each exceptions package may include requests for multiple OSPB exceptions for one facility.

DS rated about a quarter of office facilities as substantially noncompliant with security standards. When DS completed the most recent version of its risk matrix, it evaluated compliance with OSPB standards for approximately 400 office compounds and facilities— including both facilities on embassy and consulate compounds and off-compound office facilities. According to DS documentation, about a quarter of its facilities worldwide received a low facility-compliance score, indicating that they did not substantially meet current OSPB standards for new facilities. However, as noted above, we found that some of the data DS used to establish its ratings for the facilities we visited were missing or inaccurate, and therefore determined that DS’s scores provide a broad indication of facility vulnerability rather than a precise estimate.

Waivers and Exceptions Are Not Systematically Tracked, Requested, or Reviewed, and Requests Are Not Always Timely, Correct, or Fully Implemented

DS Does Not Systematically Track or Re-evaluate Waivers and Exceptions

As noted above, post officials are required to request waivers to SECCA requirements and exceptions to OSPB standards when facilities do not or cannot meet security standards. Federal internal control standards require the maintenance of complete and accurate documentation and effective use of information technology. However, we identified several weaknesses with the waivers and exceptions process, including tracking problems and missing waivers and exceptions. First, DS is not adequately tracking waivers and exceptions to the security standards. In January 2013, the State OIG reported that DS does not adequately track waivers and exceptions. DS does not maintain a database with waiver and exception documentation, but rather maintains a list of waivers and exceptions in a spreadsheet. When we reviewed DS’s tracking spreadsheet, we identified several problems. For example, we found nine instances in which a line item in the tracking spreadsheet contained inaccurate information about the type of approved waivers or exceptions for a facility. In addition, headquarters and post officials we met with could not always find waiver and exception documentation or were unaware of previously approved waivers and exceptions, even though DS officials stated that copies of approved waivers and exceptions are kept both at DS headquarters and at posts. For example, an official at one post told us that the post had two waivers on file that DS officials in headquarters were unable to locate. In addition, officials at three posts were either unaware of certain previously approved waivers and exceptions or could not find the documentation for them.

We also found that DS did not re-evaluate previously granted waivers and exceptions to security standards for individual facilities when the level of threat or risk changed. For example, the political violence threat rating was low for one post when it obtained approval for exceptions for one facility, but the threat rating has since increased to high. Nevertheless, post and DS officials have not re-evaluated these exceptions. In addition, an agency at one post recently requested and obtained a colocation waiver and exceptions to utilize hotel rooms as office space. There are already two other agencies using the same hotel as office space. The addition of more people at one facility represents an increased risk to this facility, because it becomes a more visible and attractive target. Nonetheless, post and DS officials did not re-evaluate the previously granted waivers and exceptions based on the increased risk.

DS Does Not Systematically Request Waivers and Exceptions

did Many of the facilities we reviewed at higher-threat, higher-risk postsnot meet applicable security standards and did not have required waivers and exceptions. We reviewed 43 facilities at 10 higher-threat, higher-risk posts for compliance with applicable security standards—including existing, newly acquired, and a few newly constructed work facilities. While the level of noncompliance varied, all of the facilities are required to have approved waivers, exceptions, or both.

Furthermore, we found that posts we visited did not always request waivers and exceptions when required. Based on our review of 43 facilities, we identified 3 facilities for which the post did not request a required SECCA waiver and 18 facilities missing approved OSPB exceptions (see table 4). For example, DS did not have appropriate waivers on file for 2 of the 8 tenant commercial office spaces we reviewed that did not meet SECCA’s colocation or setback requirements. In addition, DS did not have appropriate OSPB exceptions on file for 3 of the 20 embassy or consulate compound facilities we reviewed that did not meet the requirements for hardened building exteriors. Similarly, State OIG identified 4 out of 27 posts that did not submit appropriate waivers or exceptions. To address this problem, State OIG recommended that DS institute an annual certification process in which the Chief of Mission at each post would be required to certify that the post either meets all security standards or that all appropriate waivers and exceptions have been obtained. However, DS officials stated that DS has begun piloting an alternative solution to the recommendation to include a similar certification requirement of the waivers and exceptions as part of its new online physical security survey process. When this solution is fully implemented, posts will be required to verify that all relevant waivers and exceptions have been obtained when RSOs at posts fill out the physical security survey once every 3 years.

We identified additional weaknesses with the 32 waivers and exceptions packages we reviewed, including (1) requests for waivers and exceptions that were filed after the facility was already occupied, (2) incorrect waivers or exceptions on file, and (3) conditions outlined in the approved waiver or exception request that were not always implemented (see table 5). Federal internal control standards require the proper execution of management directives.

We obtained these 32 approved waiver and exception packages for 12 of the 14 posts we either visited or for which we interviewed officials by video teleconference.

In our review of these documents, we identified the following problems:

Facilities occupied prior to receiving waivers or exceptions. We identified eight instances in which post officials occupied a facility prior to submitting a required waiver or exception request. For example, officials at one post occupied a temporary facility for over a year and a half before the post obtained a setback waiver. Incorrect waivers or exceptions on file. We identified four instances in which the waivers or exceptions on file did not cover the facility currently in use or post obtained incomplete or inappropriate waivers or exceptions. For example, one post obtained an approval for a colocation waiver and OSPB exceptions for a temporary medical facility that was located on a residential compound. The proposed medical facility was a one-story safe haven container that provided 60-minute forced-entry, ballistic-resistant protection. When visiting the post, however, we learned that the medical facility was no longer located in the safe haven container; rather, the medical facility was now located in a residential building that did not meet any forced- entry, ballistic-resistant standards for office space. The post had not applied for an updated waiver or exceptions for this facility.

Conditions outlined in approved waiver or exception not implemented.

We identified three instances in which posts did not implement mitigating steps that were required conditions for their approved waivers and exceptions. For example, one post obtained a setback waiver and exceptions in July 2010 on the condition that they implement several upgrades. Although some of the upgrades have since been implemented, we identified three upgrades that had not been implemented when we visited the facility, including (1) improving perimeter walls to ensure they measured 9 feet all the way around the compound, (2) reinforcing the perimeter to ensure all walls were anti- ram, and (3) installing shatter-resistant window film on all the windows. Officials stated that it is the responsibility of post officials or tenant agency officials applying for the waiver or exception to ensure that upgrades agreed to as conditions of a waiver or exception are appropriately implemented, and that they do not currently monitor posts’ implementation of conditions agreed to in the granted waivers or exceptions.

Because waivers and exceptions are not always requested, timely, accurate, and fully implemented, State cannot be assured that they have all the information they need and are taking all practical steps to ensure the security of work facilities.

State Follows Some Risk Management Principles but Lacks an Adequate Risk Management Policy for the Physical Security of Work Facilities

State follows some risk management principles; however, it lacks an adequate risk management policy for the physical security of its work facilities. Risk management is a strategy that helps policymakers more efficiently and effectively assess risk, allocate resources, and take actions under conditions of uncertainty. While DS outlined some principles for a risk management policy, it did not fully develop and implement the policy. We found that many of the activities DS takes to manage risk are in line with its risk management principles; however, we found that State’s risk management activities do not operate as a continuous process and do not continually incorporate new information. For example, we found that State does not use all available information when establishing threat levels. We also found that State’s current facility vulnerability assessments are not fully utilized because, among other things, the information reported by posts through a survey template is not always readily available or timely and is not in a form that facilitates automated processing and data analysis. However, State is taking steps to automate and enhance these surveys. In addition, we found examples in which the data informing DS’s risk assessments of facilities had changed, but DS lacked processes to re-evaluate the risk to those facilities. We also found that State lacked a process to re-evaluate interim and temporary facilities that have been in use longer than anticipated. Furthermore, in examining State’s feedback mechanisms, we found that State did not adequately verify that it had followed through on some risk-management related recommendations.

DS Established Principles for a Risk Management Policy, but the Policy Has Not Been Fully Developed or Implemented

Past GAO work has shown that risk management is a strategy that helps policymakers more efficiently and effectively assess risk, allocate As we resources, and take actions under conditions of uncertainty.stated previously, an effective risk management policy establishes a structured process for making informed choices and trade-offs about how best to use available resources and for monitoring the effects of those choices. Risk management requires a continuous process that includes the assessment of threats, vulnerabilities, and potential consequences, with actions taken to reduce or eliminate one or more of these elements of risk. Risk management should include a feedback loop that continually incorporates new information, such as changing threats or the effect of actions taken to reduce or eliminate identified threats, vulnerabilities, or consequences. Because policymakers have imperfect information for assessing risks, there is a degree of uncertainty in the information used for risk assessments—what the threats are and how likely they are to be realized. As a result, it is inevitable that assumptions and policy judgments, as well as hard data, influence decisions in risk analysis and management. It is important, therefore, that key decision makers understand the underlying assumptions and policy judgments that have been made and how these affect the results of the risk analysis and the resource decisions based on that analysis. An effective risk management policy, by providing a structured, continuous process with a feedback loop that incorporate new information and adjusts to changing conditions, can provide policymakers with better information with which to make risk decisions in an uncertain environment.

To provide a basis for examining efforts for carrying out risk management, in prior work we developed a framework for risk management based on best practices and other criteria. Our risk management framework is divided into five phases that form a feedback loop: (1) setting strategic goals and objectives and determining constraints; (2) assessing the risks; (3) evaluating alternatives for addressing these risks; (4) selecting the appropriate alternatives; and (5) implementing the alternatives and monitoring the progress made and the results achieved (see fig. 6). The results generated by monitoring in phase 5 feed back into the ongoing process. In addition, because a framework includes integrated and continually updated information flows, internal controls are crucial. These include the policies, procedures, techniques, and mechanisms that enforce management’s directives and are used to help ensure that actions are taken to address risk. We used this framework, as well as the Standards for Internal Control in the Federal Government, to assess State’s risk management principles and activities.

While DS created a risk management policy statement in 1997, DS has not fully developed and implemented the policy. The one-page policy statement describes six principles: asset identification, threat assessments, vulnerability assessments, risk assessments, risk decisions, and feedback. DS officials noted that a year after the statement was published, its planned implementation was largely overtaken by State’s response to the 1998 U.S. embassy bombings in Africa, and that the policy was not fully developed or implemented. For example, DS’s risk management statement lacks clear roles and responsibilities for all stakeholders and detailed guidance on how to carry out its elements, particularly with regard to implementation and monitoring. Officials further noted that, contrary to what is stated in the policy, there is no formal steering group handling the risk management process. Nevertheless, we also found that many of the activities that DS takes to manage risk align with the DS risk management policy principles and also with our risk management framework, including determining risk by combining the results of asset identification, threat assessments, and vulnerability assessments. Both the Benghazi ARB report and the resulting Report of the Independent Panel on Best Practicesdevelop a risk management policy. State has undertaken several efforts to develop a more comprehensive risk management policy. For example, according to State officials, State is applying its recently completed Vital Presence Validation Process to better manage risk when beginning, restarting, continuing, modifying, or discontinuing operations at posts, particularly high-threat, high-risk posts. However, as of February 2014, some of these efforts, including a fully developed risk management policy, remain incomplete.

State’s Risk Management Activities Do Not Operate as a Continuous Process and Do Not Continually Incorporate New Information

While many of State’s activities align with the DS risk management policy statement, in this report we have identified a number of problems with these activities. Moreover, we found that State’s ongoing activities do not operate as a continuous process that incorporates all relevant data and lack a feedback loop that continually incorporates new information (see fig. 7).

We found several examples that demonstrate that State’s ongoing risk management activities are not fully linked in a continuous process that incorporates all relevant data. For example, we found that DS does not use all available information when establishing threat levels at posts. Specifically, some posts may implement security measures that go above standards, but this type of information is not effectively captured in the triennial facility inspection process to document posts’ compliance with OSPB standards, and according to DS officials, does not inform the Security Environment Threat List threat-level decisions.

Furthermore, DS officials noted that the information from the triennial facility inspection process, which is used to identify facility vulnerabilities, is not currently used in a meaningful way because several issues impede DS’s ability to collect and adequately use this information. For example, because the survey forms are individual documents housed on an intranet site, DS officials in headquarters cannot easily search through the data from the surveys or conduct comparative analyses of posts’ data. In addition, we found that the surveys did not always include all facilities at posts and that headquarters could not always find the most current surveys. DS officials indicated that the new online survey process they are developing will feed certain data into a database, thus improving their ability to analyze and use the survey data. While we have not independently evaluated the online survey forms, DS officials noted that the forms include a checklist for all the current OSPB standards for each of the threat ratings, and RSOs will be required to complete the new survey templates online. In addition, according to officials, DS plans to develop a project management solution that will allow DS officials in headquarters to track and report on the data collected by the completed physical security surveys through an automated system.

Another instance of current information not being fully utilized involves OBO documentation of facility compliance with the physical security standards. According to State’s policies, when OBO initiates a major rehabilitation project on a facility constructed prior to June 1991, it must request OSPB exceptions if the planned rehabilitation will not bring the facility into full compliance with current security standards. Furthermore, according to DS officials, when OBO completes a major rehabilitation project on a facility constructed prior to June 1991, the bureau is required to document with a memorandum what aspects of the facility will still not meet standards after the rehabilitation. However, DS officials told us that no one in DS tracks the OBO memoranda. Without adequately tracking this information, RSOs may not have accurate information to plan mitigation efforts and properly request exceptions to security standards. In addition, as noted above, we also found the DS officials in headquarters do not verify that physical security upgrades included as part of a waiver and exception request are completed.

State’s Risk Management Activities Lack a Feedback Loop that Continually Incorporates New Information

We also identified several instances where State’s risk management activities did not continually incorporate new information through a feedback loop. For example, as noted above, State does not have a process for evaluating the existing security standards against evolving threats and risks, and we found examples where State officials deemed existing standards inadequate to meet perceived threats and risks. Similarly, DS lacks a process to re-evaluate risk decisions such as the granting of waivers and exceptions when risk factors change. DS quantifies risk to facilities by assessing the number of personnel, threat levels, host-country capability and willingness to support the post, and vulnerabilities. At one post we visited, the consulate initially had a diplomatic presence on one floor of a tenant commercial office space. It received a colocation and setback waiver to occupy that one floor. In subsequent years, as the number of personnel grew, the consulate expanded its office space to include a second floor of the facility. However, according to post officials, there was never a reevaluation of the risk to that facility on the basis of the increased personnel presence, and the post did not request a new waiver until years later when an RSO noticed the discrepancy. Similarly, waiver and exception request packages generally include information about the current Security Environment Threat List levels, but when those levels change—from high to critical, for example—there is, according to DS officials, no process in place to notify post or headquarters to re-evaluate the waivers and exceptions previously granted.

Similarly, DS lacks a process to re-evaluate interim and temporary facilities that have been in use longer than anticipated. When State opens an interim or temporary facility and grants waivers or exceptions, it is with the expectation that the facility will be replaced by another or closed within a certain time frame. There is an explicit acceptance of risk in that decision. However, officials noted that there were a number of facilities that were designated to be used on an interim or temporary basis, but because State lacked a process to re-evaluate these facilities, years later these facilities were still in use without any review of the facility designation and without revisiting of the risk decision. Similarly, the Independent Panel on Best Practices found that State redefined missions, such as Benghazi, as temporary or in other ways that did not require them to meet physical security standards. For example, at some posts, State used containerized housing units and other temporary structures as offices for years though these trailer-like facilities do not meet OSPB standards and were only intended to be used on an interim or temporary basis. State officials stated that they do not systematically review interim and temporary facilities that have been in use longer than anticipated. However, effective risk management practices require a feedback loop that continually incorporates new information, and federal standards for internal controls call for proper execution of management directives.

In addition, we found that State did not adequately verify that it had followed through on the feedback it received through all past risk- management related recommendations. Federal standards for internal controls call for ensuring that the findings of audits and other reviews are promptly resolved. For example, M/PRI maintains documentation to track the implementation of all ARB recommendations. Although we did not assess the reliability of these data, we identified two examples of recommended updates to the OSPB standards that M/PRI’s documentation indicated were completed but that our evidence showed had not been completed. During the course of our review, in December 2013, one of these recommendations was completed. Moreover, when we asked DS officials about the status of their efforts to close recommendations resulting from the State OIG’s review of their waivers and exceptions process, the officials indicated that they had addressed all of the recommendations. However, in our fieldwork and document reviews, we found that DS had not addressed all of the OIG recommendations.

Conclusions

Ensuring the safety and security of our personnel and facilities at overseas diplomatic posts has never been more challenging or important than it is today. Between September 2012 and December 2013 alone, there were 53 attacks against U.S. diplomatic personnel and facilities overseas. We found that State has taken a number of measures to enhance the security of and manage the risk to its personnel and facilities. For example, State is prioritizing security-related construction using its evaluation of threat and vulnerability levels at posts. In addition, State established a new directorate to provide additional security attention to high-threat, high-risk posts. Furthermore, we found that many of State’s risk management activities were consistent with best practices. However, we found a number of problems with State’s implementation of some of its activities, rather than with the broader activities themselves. Some of these problems involved the lack of common terminology or the reliability of data that State uses to analyze risk. Others involved the adequacy of its physical security standards. In addition, we found problems with State’s handling of its waivers and exceptions process. While each of these problems is a reason for concern, in and of itself, taken as a whole they raise a greater concern that decision makers at State may not have complete and accurate information with which to make risk management decisions. As a result, there is a greater likelihood that security risks to overseas diplomatic facilities will not be adequately addressed—a situation that could have tragic consequences for U.S. government personnel working overseas.

Furthermore, State lacks a cohesive framework or policy to adequately coordinate and control its multifaceted risk management activities. A good risk management policy includes the use of all relevant information and a feedback loop that ensures that changing conditions are assessed and considered by decision makers. Such a policy helps ensure that despite uncertainty, security personnel have a continuous system in place that identifies weaknesses proactively rather than reactively. The lack of such a policy may make State more prone to not considering data needed to make effective risk decisions. While State is developing a risk management framework in response to several recommendations resulting from the attacks in Benghazi, the framework remains incomplete. Unless State implements a risk management policy that addresses the problems we identified with State’s current security efforts, State cannot be assured that the most effective security measures are in place at a time when personnel working at U.S. diplomatic facilities are facing ever increasing threats to their safety and security.

Recommendations for Executive Action

To enhance the Department of State’s risk management activities, we are making 13 recommendations, which we have categorized into four groups covering (1) consistency and reliability of data; (2) applicability and effectiveness of physical security standards; (3) identification of risks and mitigation of vulnerabilities; and (4) development of risk management policies.

To improve the consistency and data reliability of Department of State risk management data, we recommend that the Secretary of State: 1. Direct M/PRI, DS, and OBO to define the conditions when a warehouse should be categorized as an office facility and meet appropriate office physical security standards. 2. Direct M/PRI, DS, and OBO to harmonize the terminology State uses to categorize facilities in State’s physical security standards and property databases. 3. Direct OBO to establish a routine process for validating the accuracy of the data in OBO’s property database. 4. Direct DS to establish a routine process for validating the accuracy of the data in DS’s risk matrix. 5. Direct the Under Secretary for Management to identify and eliminate inconsistencies between and within the FAM, FAH, and other guidance concerning physical security.

To strengthen the applicability and effectiveness of the Department of State’s physical security standards, we recommend that the Secretary of State work through DS or, in his capacity as chair, through the OSPB to: 6. Develop physical security standards for facilities not currently covered by existing standards. 7. Clarify existing flexibilities in the FAH to ensure that security and life- safety updates to the OSPB standards and Physical Security Handbook are updated through an expedited review process. 8. Develop a process to routinely review all OSPB standards and the Physical Security Handbook to determine if the standards adequately address evolving threats and risks. 9. Develop a policy for the use of interim and temporary facilities that includes definitions for such facilities, time frames for use, and a routine process for reassessing the interim or temporary designation.

To strengthen the effectiveness of the Department of State’s ability to identify risks and mitigate vulnerabilities, we recommend that the Secretary of State: 10. Direct DS to automate its documentation of waivers and exceptions, and ensure that DS officials in headquarters and at each post have ready access to post’s waivers and exceptions documentation. 11. Direct DS to routinely ensure that necessary waivers and exceptions are in place for all work facilities at posts overseas. 12. Direct DS to develop a process to ensure that mitigating steps agreed to in granting waivers and exceptions have been implemented.

To strengthen the effectiveness of the Department of State’s risk management policies, we recommend that the Secretary of State: 13. Develop a risk management policy and procedures for ensuring the physical security of diplomatic facilities, including roles and responsibilities of all stakeholders and a routine feedback process that continually incorporates new information.

Agency Comments

We provided a draft of this report for review and comment to State and USAID. We received written comments from State, which are reprinted in appendix II. State agreed with 12 of our 13 recommendations and highlighted a number of actions it is taking or plans to take to address the problems that we identified. State noted that it is not in a position to agree or disagree with our recommendation that it develop a policy for the use of interim and temporary facilities because an internal State working group is currently in the process of evaluating this issue. USAID did not provide written comments on the report. We also received technical comments from each agency, which we incorporated throughout our report as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of State, and Administrator for USAID. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of our report were to evaluate (1) how the Department of State (State) manages risks to work facilities under chief-of-mission authority overseas; (2) the adequacy of State’s physical security standards for these work facilities; (3) State’s processes to mitigate vulnerabilities when older, acquired, and temporary work facilities overseas do not meet physical security standards; and (4) how State’s risk management activities align with its risk management policy and risk management best practices.

Our scope included older, acquired (purchased or leased), and temporary diplomatic work facilities overseas, such as offices and warehouses built before the June 1991 security-construction standards. For the purposes of travel and review of post-specific documentation, we narrowed our scope to posts determined by State’s Bureau of Diplomatic Security (DS) to be high-threat, high-risk posts and which had older, acquired, and temporary diplomatic work facilities. We selected a judgmental sample of 10 posts from the 50 posts rated as the highest-threat, highest-risk. Our selection included posts placed under the new DS High Threat Programs Directorate, as well as those not placed under the new directorate but excluded posts with new embassy compounds. Our sample included posts in nine countries in three of State’s geographic regions—Africa, the Near East, and South and Central Asia. We are not naming the specific posts we visited for this review due to security concerns. For these posts, we reviewed the asset, threat, vulnerability, and risk documentation related to the post and its nonresidential facilities and conducted a physical security review of their nonresidential facilities. We conducted interviews at each of these posts with post officials, including DS’s Regional Security Officers (RSOs). We also reviewed similar documentation for 4 other high-threat, high-risk posts and interviewed officials about the documentation by video teleconference. In addition to the 14 posts, we traveled to two other posts and conducted interviews with post officials but did not review post-specific documentation or review facilities. Our findings from these posts are not generalizable to all posts. Moreover, our judgmental selection of high-threat, high-risk posts cannot be generalized to other high-threat, high-risk posts.

To provide context and background and address our objectives, we reviewed classified, sensitive-but-unclassified, and unclassified documents, including U.S. laws; State’s physical security policies and procedures as found in memoranda, guidance, the Foreign Affairs Manual (FAM), and Foreign Affairs Handbooks (FAH)—most notably, the Physical Security Handbook and the Overseas Security Policy Board (OSPB) standards; DS documentation of anti-U.S. attacks, overseas posts’ physical security surveys, threat and risk ratings, and physical security waivers and exceptions; post-specific documents pertaining to physical security; State’s Bureau of Overseas Buildings Operations (OBO) facility, construction, and physical security upgrade documentation; U.S. Agency for International Development (USAID) facility and physical security documentation; classified and unclassified Accountability Review Board (ARB) reports resulting from physical security attacks and State’s documents evaluating their response to ARB recommendations; past GAO, State Office of Inspector General (OIG), and Congressional Research Service reports; and reports by congressional committees and independent panels. We also interviewed several officials in Washington, D.C., about risk management and physical security policies and standards and their implementation; these officials were from DS; OBO; State’s Office of Management Policy, Rightsizing, and Innovation (M/PRI); State’s Bureau of Conflict and Stabilization Operations; and State’s Bureau of African Affairs; OIG; as well as USAID security officials.

To provide further context and background, we also analyzed State and USAID data of physical security funding allotments, interviewed officials about the data, and found the data to be sufficiently reliable to report at an aggregated level. However, we found that State runs other programs, such as OBO’s major rehabilitation program and DS’s technical field support efforts, which may include physical security upgrades as part of such projects. We did not include funding from those other State sources in our presentation of the data.

To address how State manages risk to work facilities, we evaluated the reliability of OBO’s facility data in its property database, the timeliness and tracking of posts’ triennial physical security surveys, and the reliability of the data DS uses to assess risk. To evaluate the reliability of the data in OBO’s property database, OBO provided us with work facility records pulled from the database between May 2013 and January 2014. We compared these records to information we collected during discussions with post officials to identify excess facilities, missing facilities, and inaccuracies in the data. Although we identified data reliability issues for some facilities in OBO’s property database, as those issues generally involved the classification or description of facilities, we determined that the data were sufficiently reliable to describe the approximate number of U.S. diplomatic work facilities overseas. To review the timeliness of DS’s tracking of posts’ triennial physical security surveys, we requested and obtained most surveys for work facilities at the 14 posts where we reviewed facility documentation. We reviewed the documentation to determine whether each survey had been completed in the past 3 years and reviewed the documents obtained against our list of facilities for each post to determine if DS provided all the relevant surveys. If DS did not provide us with a survey we expected, we followed up with DS officials in headquarters to determine whether or not survey documentation for a facility existed and if it was appropriately maintained and tracked in headquarters and at post. To evaluate the reliability of the data DS uses to assess risk to office facilities overseas, we examined a copy of the most recent risk matrix completed by DS and identified (1) inaccurate information based on post-specific information gathered throughout the course of the engagement, (2) missing off-compound facilities and inaccurate information based on an analysis of the facilities included in the risk matrix, and (3) missing data points. Although we identified data reliability issues in the risk matrix, which may affect the risk scores for individual posts, we determined that the data were sufficiently reliable to broadly characterize overall facility vulnerability and risk scores at the aggregate level.

To address the adequacy of State’s physical security standards, we evaluated the consistency of select physical security standards across various types of policy guidance and the timeliness of updates to those policies. We conducted a number of activities to evaluate the consistency of physical security standards. We reviewed the physical security standards for work facilities described in the FAM and the FAH— specifically, the FAH sections containing the OSPB standards and the Physical Security Handbook—and identified inconsistencies between the FAM and the FAH and inconsistencies between the two sections of the FAH. We also reviewed policy guidance documented in memoranda and compared that to the physical security standards outlined in the FAH. Finally, we identified inconsistencies between the FAH and the OBO Building and Zoning Codes discussed in an OIG report. To evaluate the timeliness of updates to physical security standards in the FAM and the FAH, we interviewed DS officials to understand the process State follows to update the FAM and the FAH and determined that updates should take approximately 60 to 90 days. We then reviewed (1) all ARB reports resulting from attacks on U.S. diplomatic facilities since 1998 or that included recommendations related to physical security and (2) joint DS- OBO memoranda concerning physical security standards in process. We examined this documentation and identified instances in which it has taken State more than a year to update these standards.

To address how State mitigates vulnerabilities if facilities do not meet applicable physical security standards, we asked post officials a standard set of questions; identified several ways to measure general compliance with physical security standards; and evaluated State’s waivers and exceptions process. Using the judgmental sample described above, we traveled to 12 posts and conducted work focused on 4 other posts by teleconference. Our sample included nine countries in three of State’s geographic regions—Africa, the Near East, and South and Central Asia. As noted above, we selected these posts due to their relatively high DS- established threat and risk ratings and the presence of facilities that fell within our scope. For security reasons, we are not naming the specific posts we visited for this review. At 16 posts overseas, we asked State, USAID, and other agency officials in-person and by video-conference a standard set of questions regarding the implementation of physical security policies and procedures to understand how State identifies and mitigates vulnerabilities.

We also identified three ways to measure general compliance with physical security standards based on State documentation. First, we reviewed the list of embassy and consulate compounds. We found that a significant number were constructed or acquired prior to 1991; because those facilities are only required to meet many of the physical security standards to the maximum extent feasible or practicable, we determined that many of those facilities may not meet standards. Second, we reviewed DS’s list of approved waivers and exceptions, which they use to track this documentation, and counted the number of facilities with colocation and setback waivers and exceptions. We determined that each facility with a waiver or exception does not meet all physical security standards. We interviewed DS officials about the waivers and exceptions spreadsheet. While we found problems with some entries in the spreadsheet, we determined that the data were sufficiently reliable to report a general order of magnitude of the number of waivers and exceptions. Third, we obtained and reviewed the 2013 risk matrix that DS completed in September 2013. We then reviewed the facility compliance scores for each facility ranked in DS’s risk matrix to determine the number of facilities that DS has found do not meet most OSPB standards for new facilities. To make that determination, we identified all facilities with a standards compliance score in the bottom half of the 10-point range. However, because SECCA’s 100-foot setback requirement received its own rating in the matrix and was not considered as part of the facility compliance rating, our analysis of DS’s standards compliance score does not include the extent to which facilities met the 100-foot setback requirement. Due to the limitations with DS’s ratings that we noted earlier, we are only reporting this information to provide a broad indication of concerns with facilities’ compliance with standards and not to provide a precise estimate of the number of facilities with particular ratings.

Furthermore, at 10 posts we visited, we evaluated the compliance of all work facilities—a combined total of 43 different offices and warehouses— against the existing physical security standards. Prior to reviewing overseas facilities, we reviewed prior recommendations made by OIG or the Interagency Security Assessment Teams. We then developed a physical security checklist for each of the four facility types we reviewed— chanceries or consulates, sole occupant of building or compound, tenant of commercial office space, and unclassified warehouse—on the basis of the current security standards specified in the OSPB standards and the Physical Security Handbook. The physical security requirements in the OSPB standards vary by facility type, date of construction or acquisition, and threat level. Because we identified some inconsistencies between these two policy guides, we always included the higher of the two standards in our physical security checklist in those instances in which we identified an inconsistency. For example, the OSPB did not include the compound emergency sanctuary requirement in the OSPB standards until after our post visits in December 2013. However, because State included the standards for compound emergency sanctuaries in the Physical Security Handbook in October 2012, we assessed facilities against this standard during our facility reviews. We then used these checklists to evaluate the compliance of work facilities at the 10 posts we visited. In general, the facilities in our sample were not comparable to those on recently constructed embassy or consulate compounds, which were constructed to meet current security standards. Our findings from these posts are not generalizable to all posts.

To evaluate the adequacy of State’s waivers and exceptions process, which is one process by which State mitigates vulnerabilities when facilities do not meet standards, we reviewed DS’s list of waivers and exceptions, post-specific physical security surveys, waivers and exceptions for 14 of the 16 posts in which we conducted work, and our post-specific physical security checklists for the 10 posts to which we traveled. We then analyzed DS’s list of waivers and exceptions against the other documentation we collected and our physical security checklists to identify any issues with DS’s tracking of waivers and exceptions. We also reviewed our physical security checklists and identified all security deficiencies for which a waiver or exception should have been requested; we then compared that information with DS’s list of waivers and exceptions and the post-specific waivers and exceptions to identify missing waivers and exceptions. In addition, we reviewed the post- specific documentation to determine if post officials requested waivers and exceptions in a timely manner and if the documentation was accurate. Finally, we identified mitigation measures outlined in the approved waiver or exception request that the post was expected to implement and evaluated that information against our physical security checklists to determine if all agreed upon mitigation measures had been implemented.

To address how State’s risk management activities align with its policies and best practices, we assessed DS’s risk management policy and, drawing on our other findings, State’s current risk management efforts against best practices identified by GAO as well as federal standards for internal control. In addition, we reviewed M/PRI’s ARB recommendation matrix to assess the extent to which State had addressed and closed past ARB recommendations. However, based on the work we conducted when reviewing the timeliness of updates to physical security standards, we identified two instances of recommendations that State closed though it had not completed the actions cited in closing them.

We conducted this performance audit from March 2013 to June 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

The original version of this report is a restricted report and was issued on June 5, 2014, copies of which are available for official use only.public version of the original report does not contain certain information that State regarded as Sensitive but Unclassified and requested that we remove. We provided State a draft copy of this public report for sensitivity review, and State agreed that we had appropriately removed all Sensitive but Unclassified information.

Appendix II: Comments from the Department of State

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Michael J. Courts, (202) 512-8980 or courtsm@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Anthony Moran (Assistant Director), Amanda Bartine, Thomas Costa, David Dayton, Etana Finkler, Farhanaz Kermalli, Ann McDonough-Hughes, Brian Tremblay, and Ozzy Trevino made key contributions to this report. John Bauckman, Martin De Alteriis, Mark Dowling, Brandon Hunt, Mary Moutsos, and Ramon Rodriguez provided technical assistance.