2020 Census: Additional Actions Needed to Manage Risk
Released: 2019-05-31T00:00:00

Letter

Background

The decennial census produces data vital to the nation. The data are used to apportion the seats of the U.S. House of Representatives; realign the boundaries of the legislative districts of each state; allocate billions of dollars each year in federal financial assistance; and provide a social, demographic, and economic profile of the nation’s people to guide policy decisions at each level of government. Furthermore, businesses, nonprofit organizations, universities, and others regularly rely on census data to support their work.

Given the importance of the decennial census to the nation, it is important for the Bureau to manage risks that could jeopardize a complete, accurate, and cost-effective enumeration. To assist federal government leaders in managing such complex and inherently risky missions across their organizations, in prior work we developed an ERM framework that, among other things, identifies essential elements for federal ERM and good practices that illustrate those essential elements. Notably, these elements and practices apply at all levels of an organization and across all functions—such as those related to managing risks to the 2020 Census. Furthermore, Office of Management and Budget (OMB) Circulars No. A-11 and A-123 require federal agencies to implement ERM to ensure their managers are effectively managing risks that could affect the achievement of agency strategic objectives. As discussed in our ERM Framework, ERM is a decision-making tool that allows leadership to view risks as an interrelated portfolio rather than addressing risks only within silos.

Fundamental to ERM is the development of risk mitigation and contingency plans. Mitigation plans detail how an agency will reduce the likelihood of a risk event and its impacts, should it occur. Contingency plans identify how an agency will reduce or recover from the impact of a risk after it has been realized. Among other things, these plans provide the roadmap for implementing the agency’s selected risk response and the vehicle for monitoring, communicating, and reporting on the success of that response. In developing these plans, it is important that agencies keep in mind the interaction of risks and risk responses, as the response to one risk may affect the response to another or create a new risk entirely.

We also developed a Fraud Risk Framework to provide a comprehensive set of leading practices that serves as a guide for agency managers developing and enhancing efforts to combat fraud in a strategic, risk- based manner. The framework is designed to focus on preventive activities, which generally offer the most cost-efficient use of resources since they enable managers to avoid a costly and inefficient pay-and- chase model of recovering funds from fraudulent transactions after payments have been made.

The Bureau Identified 360 Active Risks to the 2020 Census

Consistent with our ERM framework, the Bureau developed a decennial risk management plan which, among other things, requires that it identify risks to the 2020 Census at the portfolio and program levels. Portfolio risks are those that could jeopardize the success of the 2020 Census as a whole, and they typically span several years with many potential risk events over the period. Program risks are narrower—they could jeopardize the success of an individual program, including the 35 operations that support the 2020 Census as well as the 2018 End-to-End Test.

As of December 2018, the Bureau had identified 360 active risks to the 2020 Census—meaning the risk event could still occur and adversely impact the census. Of these, 30 were at the portfolio level and 330 were at the program level. As shown in figure 1, the greatest number of active program risks was to the Systems Engineering and Integration operation which manages the Bureau’s delivery of an IT “System of Systems” to meet 2020 Census business and capability requirements. For example, the Bureau’s description of one of the risks to this operation indicated that if certain key system test plans and schedules are not clearly communicated among and collaborated on by relevant Bureau teams, then the 2020 Census systems are at risk of not meeting performance, cost, and schedule goals and objectives.

The Bureau Classified 21 Percent of Active Risks as High Priority

The Bureau’s decennial risk management plan requires that it classify risks by priority level. These classifications are intended to highlight the most critical risks and identify where to allocate additional resources. Figure 2 shows how the Bureau had classified the 360 active risks as of December 2018.

To determine risk priority, the Bureau’s decennial risk management plan requires that it assign each risk numerical ratings for likelihood of occurrence and potential impact. When multiplied, the result is a numerical priority rating, which the Bureau divides into three classifications for high priority, medium priority, and low priority (see figure 3).

The Bureau Determined That It Should Mitigate 67 Percent of Active Risks

According to the Bureau’s decennial risk management plan, all portfolio- level risks must be mitigated to reduce the likelihood of the risk event and its impacts, should it occur. In contrast, when a program-level risk is identified, risk owners—the individuals assigned to manage each risk— are to select from the following risk responses.

Mitigate. This may be an appropriate response where there are actions or techniques that will reduce the likelihood of the risk event and its impact, should it occur.

Watch. This may be an appropriate response where a trigger event can be identified far enough in advance so that mitigation activities can be delayed until then.

Accept. This may be an appropriate response where the probability and potential impact of the risk is so low that mitigation actions do not appear necessary or the impact can be absorbed if the risk occurs.

As of December 2018, the Bureau planned to mitigate 67 percent of the active risks it had identified (see table 1). Notably, this signifies that the Bureau determined there were actions it could take or techniques it could employ to reduce the likelihood of the majority of risks to the enumeration or their impact, should they occur.

The Bureau Had Mitigation and Contingency Plans for Most Risks, but Not Clear Time Frames for Plan Development and Approval or a Clear Status for Mitigation Plans The Bureau Had Mitigation and Contingency Plans for Most Risks That Required Them

The Bureau’s decennial risk management plan sets out the following requirements for developing mitigation and contingency plans:

Mitigation plans are required for all active portfolio risks and for all active program risks with a mitigate risk response.

Contingency plans are required for all active portfolio risks with a high- or medium-priority rating, and a moderate or higher likelihood of occurrence.

Contingency plans are also required for active program risks with a high- or medium-priority rating, a moderate or higher likelihood of occurrence, and a risk response of mitigate or accept.

Of the 360 active risks to the census as of December 2018, 242 (67 percent) met the Bureau’s criteria for requiring a mitigation plan (see table 2). According to the Bureau’s risk registers, 232 of these risks (96 percent) had a mitigation plan. In addition, 146 of the active risks (41 percent) met the Bureau’s criteria for requiring a contingency plan. According to the Bureau’s risk registers, 102 of these risks (70 percent) had a contingency plan.

Our prior reporting similarly found that earlier in the decennial cycle, the Bureau did not have mitigation and contingency plans for all risks that required them. In November 2012, we found that the Bureau had mitigation and contingency plans for each of the portfolio risks it had identified at the time, but none for the program risks. We reported that such plans were needed to help the Bureau fully manage associated risks, and we recommended that the Bureau develop risk mitigation and contingency plans for all program risks. In April 2014, the Bureau provided us with program-level risk registers that contained both risk mitigation and contingency plans where appropriate, and we closed the recommendation as implemented. However, as of December 2018, the Bureau is missing required mitigation and contingency plan for both portfolio and program risks.

The Bureau Has Not Set a Clear Time Frame for Developing Mitigation and Contingency Plans

Example of 2020 Census Risk Without Required Contingency Plan In July 2016, the Bureau added a risk titled, Major Disasters, to its portfolio risk register. The Bureau’s description of the risk stated that if a major disaster—such as an earthquake—occurs during final preparations for or implementation of the 2020 Census, then census operations may not be executed as planned, leading to increased costs, schedule delays, or lower quality data. Leading up to the 2010 Census, Hurricane Katrina devastated the coastal communities of Louisiana, Mississippi, and Alabama; a few weeks later, Hurricane Rita cut across Texas and Louisiana. Damage was widespread. Among other things, in the aftermath of Katrina, the Red Cross estimated that nearly 525,000 people were displaced and their homes were declared uninhabitable. If a major disaster, such as a hurricane, occurs leading up to or during the 2020 Census, having a contingency plan would help ensure that housing units and their residents are accurately counted, particularly when hundreds of thousands of people— temporarily or permanently—may migrate to other areas of the country. As of December 2018, however, the Bureau had neither a draft nor approved contingency plan for this risk, although it required one since first added to the risk register nearly 2.5 years earlier. According to the Bureau, though not documented in a contingency plan, it is taking actions to respond if this risk is realized. However, if such actions are reflected in disparate documents or no documents at all, then decision makers are left without a comprehensive picture of how the Bureau is managing this risk to the 2020 Census.

Some of the risks that were missing required plans had been added to the risk registers in recent months, but others had been added more than 3 years earlier. Specifically, the 10 risks without mitigation plans were added from June to December 2018, and the 44 risks without contingency plans were added from June 2015 to December 2018. The one portfolio risk without a required mitigation plan was added in December 2018, and the five portfolio risks without required contingency plans were added in July 2015, July 2016, October 2017, August 2018, and December 2018, respectively. In some instances, a risk may not meet the Bureau’s criteria for requiring a mitigation or contingency plan when first added to the risk register. However, we found that all 10 risks without required mitigation plans and 37 of the 44 risks without required contingency plans met the Bureau’s criteria for requiring such plans within a month of being added to the register (of the 37 risks without a required contingency plan, five were at the portfolio level and 32 were at the program level).

The Bureau’s decennial risk management plan states that mitigation and contingency plans should be developed as soon as possible after risks requiring such plans are added to the risk registers, but it does not include a clear time frame for doing so. According to the Bureau’s 2020 Census Portfolio Risk and Issue Process Manager—responsible for developing, maintaining, and administering the risk management process for both portfolio and program risks to the 2020 Census—no time frame is included because risk owners are aware of their responsibility and a specific time frame would not speed up the process given competing demands on their time.

However, the official said the Bureau would consider adding a specific time frame when it updates the decennial risk management plan in 2019. Standards for Internal Control in the Federal Government (Standards for Internal Control) states that management should define objectives in specific terms—including the time frames for achievement—so that they are understood at all levels of the entity. In addition, OMB Circular No. A-123 states that effective risk management is systematic, structured, and timely. Without setting a clear time frame for developing mitigation and contingency plans, some risks may go without them for extended periods, potentially leaving the 2020 Census open to the impact of unmanaged risks.

The Bureau’s Risk Registers Clearly Indicated the Status of Contingency but Not Mitigation Plans

The Bureau’s decennial risk management plan requires that both portfolio and program risk registers include the word “draft” or “approved” alongside each contingency plan. As of December 2018, this status showed that 41 percent of contingency plans in the Bureau’s risk registers were still in draft form and had not been approved by management (29 percent at the portfolio level and 42 percent at the program level). Specifically, management had approved 60 of the 102 contingency plans (five at the portfolio level and 55 at the program level) but not the remaining 42 (two at the portfolio level and 40 at the program level).

On the other hand, the Bureau’s decennial risk management plan includes no requirements for indicating the status of either portfolio or program risk mitigation plans in the risk registers. Our review of the risk registers found that some of the portfolio risk mitigation plans included the word “draft” alongside the plan, but none included any indication of whether the plan had been approved by management. In addition, none of the program risk mitigation plans indicated whether the plan was in draft or had been approved by management, but we found that at least some appeared to be in draft. For example, one program risk mitigation plan stated that the Risk Review Board had recommended contacting three individuals for next steps; however, the plan did not appear finalized because it did not discuss any next steps and it is not clear that further action had been taken.

Although the Bureau had mitigation plans in place for 96 percent of risks that required them, without a clear indication of the status of these plans in the risk registers, we were unable to determine how many had been approved by management. According to Bureau officials, the risk registers are Bureau management’s primary source of information regarding risks to the census. Standards for Internal Control states that management should use quality information from reliable sources and clearly document internal controls to achieve the entity’s objectives and respond to risks. Including a clear indication of the status of both mitigation and contingency plans in the risk registers would help to support Bureau officials’ management of risks to the census; in addition, it would help to ensure that those plans are finalized and that the census is not left open to unmanaged risks.

The Bureau Does Not Have a Clear Time Frame for Obtaining Management Approval of Mitigation and Contingency Plans

Of the 42 contingency plans awaiting approval, many had been added to the risk registers in recent months, but others had been added more than 4 years earlier. Specifically, the two portfolio risks were added in September 2014 and August 2017, and the 40 program risks were added from October 2015 to December 2018. Moreover, we found that both of the portfolio risks and 34 of the 40 program risks without finalized contingency plans met the Bureau’s criteria for requiring such a plan within a month of being added to the register.

The Bureau’s decennial risk management plan requires risk owners to present mitigation and contingency plans to management for approval as soon as possible after risks requiring such plans are added to the risk registers. However, as with development of the mitigation and contingency plans, the Bureau’s decennial risk management plan does not include a clear time frame for doing so because, according to the Bureau’s 2020 Census Portfolio Risk and Issue Process Manager, a specific time frame would not speed up the process given competing demands on risk owners’ time. As previously noted, Standards for Internal Control states that management should define objectives in specific terms—including the time frames for achievement—so that they are understood at all levels of the entity. In addition, OMB Circular No. A- 123 states that effective risk management is systematic, structured, and timely. Without setting a clear time frame for approving draft mitigation and contingency plans, some risks may not be finalized.

The Bureau Did Not Consistently Include Key Information for Managing Risks in the Mitigation and Contingency Plans We Reviewed

Mitigation and contingency plans assist agencies in managing and communicating to agency stakeholders the status of risks. We reviewed the mitigation and contingency plans for six portfolio-level risks to the 2020 Census which the Bureau identified as among the “major concerns that could affect the design or successful implementation of the 2020 Census” (see table 3). We found that the Bureau’s mitigation and contingency plans for these risks did not consistently include key information needed to manage them. These six risks, if not properly managed, could adversely affect the cost and quality of the 2020 Census.

According to the Bureau’s decennial risk management plan, for each portfolio-level risk the risk owner must develop mitigation and contingency plans using the Bureau’s mitigation and contingency plan templates (see appendixes III and IV for the Bureau’s templates). Those templates require, among other things, that the Bureau specify key activities for reducing the likelihood of the risk and its impacts. We found that the Bureau’s decennial risk management plan generally aligns with our ERM framework which is designed to help agencies, among other actions, identify, assess, monitor, and communicate risks. However, we also found some instances where the Bureau’s risk management plan did not require mitigation and contingency plans to include certain key attributes we identified, which we discuss below. See figure 4 for a list of key attributes that we used when reviewing mitigation and contingency plans. As indicated in the attribute descriptions, six of the seven attributes are applicable to mitigation plans. Clearly defined trigger events do not apply to mitigation plans because they signal when a risk has been realized and contingency activities must begin. Each of the seven attributes are applicable to contingency plans, although two attributes—activity start and completion dates and activity implementation status—are only applicable if the risk has been realized.

As of December 2018, the results of our review of the Bureau’s mitigation and contingency plans for the six portfolio-level risks we selected were in most cases mixed: some mitigation and contingency plans aligned with a particular key attribute, while others did not (see table 4). For two attributes—activity start and completion dates and activity implementation status—we found the Bureau generally included the relevant information across the six selected mitigation plans, which should help ensure that activities are carried out in a timely manner and that agency officials and stakeholders are informed and assured that the risks are being effectively managed. On the other hand, none of the mitigation or contingency plans included a monitoring plan, which would help the Bureau to track whether plans are working as intended.

We found that where attributes are required but not consistently implemented, the gap stems from the Bureau not always holding risk owners accountable for fulfilling all of their risk management responsibilities, such as keeping plans up to date. Bureau officials responsible for overseeing risk management for the 2020 Census stated that they encourage risk owners to complete all of their risk management responsibilities; however, risk owners do not always do so because they have competing demands on their time. Therefore, the officials said they are generally satisfied if the risk owners have completed at least some of their risk management responsibilities. However, they also agreed that risk management should be among the Bureau’s top priorities and that risk owners should fulfill all of their risk management responsibilities.

Bureau officials also stated that the Bureau is managing risks to the census, even if not always reflected in the mitigation and contingency plans. We acknowledge that the Bureau is taking actions to manage risks to the 2020 Census beyond those reflected in its mitigation and contingency plans. However, if these actions are reflected in disparate documents or are not documented at all, then Bureau officials, program managers, and other decision makers are left without an integrated and comprehensive picture of how the Bureau is managing risks to the 2020 Census. Consequently, the Bureau’s risk management efforts are neither clear nor transparent, which may create challenges for decision makers’ ability to quickly and accurately identify essential information to set priorities, allocate resources, and restructure their efforts, as needed, to ensure an accurate and cost-effective enumeration. In addition, where mitigation and contingency plans are not clearly documented and only certain individuals know about them, there is potential for the loss of organizational knowledge, particularly as key personnel change roles or leave the agency altogether. Below we provide examples of gaps, by attribute, in the Bureau’s mitigation and contingency plans for the six risks we reviewed.

Risk-Register Entries Were Missing Key Information

For each portfolio and program risk mitigation and contingency plan, the Bureau’s decennial risk management plan requires risk owners to enter a description of the plan in the relevant risk register. However, our review of risk register entries for both mitigation and contingency plans across all active risks as of December 2018 found they were missing some key attributes, including monitoring plans, activity start and completion dates for most activities, the implementation status for some activities, individuals responsible for activity completion, and clearly defined trigger events. In some instances, the missing attributes were a result of the Bureau not requiring them in the risk register descriptions.

In other instances, where the Bureau’s decennial risk management plan does require the attribute in the risk register descriptions, the gap was due to the Bureau not holding risk owners accountable for them. Some of the attributes missing from the registers were included in the separate mitigation and contingency plans. However, at the program level there are no separate mitigation plans, making the risk registers the only source of information for program-level mitigation activities. According to Bureau officials, after the 2020 Census they plan to require separate mitigation plans for program risks as well. At the same time, Bureau officials noted that they primarily rely on the risk registers to monitor risks to the census and usually do not refer to the separate mitigation and contingency plans.

Standards for Internal Control states that management should use quality information from reliable sources that is appropriate, current, complete, accurate, accessible, and provided on a timely basis to achieve the entity’s objectives. Similarly, OMB Circular No. A-123 states that effective risk management is based on the best available information. Because the risk registers are Bureau management’s primary source of information regarding risks to the census—and currently their only source of information on program-level risk mitigation—including this information in the risk registers would help to support Bureau officials’ ability to manage risks to the 2020 Census.

The Bureau’s Approach to Managing Fraud Risk for the 2020 Census Generally Aligns with Selected Components of the Fraud Risk Framework but Does Not Yet Include a Fraud Risk Tolerance or Fraud Referral Plan

The Bureau has designed an approach for managing fraud risk for responses to the 2020 Census. We found that the approach generally aligns with leading practices in the commit, assess, and design and implement components of the Fraud Risk Framework. Specifically, the Bureau demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts for the 2020 Census, conducted a fraud risk assessment, and developed a risk response plan, among other actions, consistent with leading practices from the selected components. However, the Bureau has not yet determined the program’s fraud risk tolerance or outlined plans for referring potential fraud to the Department of Commerce Office of Inspector General (OIG) to investigate. Bureau officials described plans and milestones to address these steps but not for updating the antifraud strategy to include them. Standards for Internal Control states that management should clearly document internal controls to achieve the entity’s objectives and respond to risks. In addition, management should use quality information that is current and complete. Updating the antifraud strategy to include the Bureau’s fraud risk tolerance and plan for OIG referral will help to ensure that the strategy is current, complete, and conforms to leading practices. Appendix IV presents additional details of our review of applicable leading practices.

Managers of federal programs maintain the primary responsibility for enhancing program integrity and managing fraud risks. Those who are effective at managing their fraud risks collect and analyze data, identify fraud trends, and use the information to improve fraud risk management activities. Implementing effective fraud risk management processes is important to help ensure that federal programs fulfill their intended purpose, funds are spent effectively, and assets are safeguarded. The Fraud Risk Framework provides a comprehensive set of leading practices that serve as a guide for agency managers developing and enhancing efforts to combat fraud in a strategic, risk-based manner. The Fraud Risk Framework is also aligned with Principle 8 (“Assess Fraud Risk”) of Standards for Internal Control. It is designed to focus on preventive activities, which generally offer the most cost-efficient use of resources. The leading practices in the Fraud Risk Framework are organized into four components—commit, assess, design and implement, and evaluate and adapt—as depicted in figure 5.

The Bureau Designated an Entity to Manage Fraud Risk and Took Steps to Develop an Organizational Culture Conducive to Fraud Risk Management

The commit component of the Fraud Risk Framework calls for an agency to commit to combating fraud by creating an organizational culture and structure conducive to fraud risk management. This component includes demonstrating a senior-level commitment to integrity and combating fraud, and establishing a dedicated entity to lead fraud risk management activities.

The Bureau has taken steps that align with all applicable leading practices in this component, according to our review. Specifically, senior- level commitment to combating fraud helps create an organizational culture to combat fraud. The Bureau showed this commitment by creating an antifraud group, made up of multiple operational divisions within the Bureau—the Decennial Census Management Division, Decennial Information Technology Division, and Decennial Contracts Execution Office—and staff from the Bureau’s technical integration contractor. Staff from these divisions make up the Self-Response Quality Assurance (SRQA) group with the primary purpose of identifying and responding to potentially fraudulent responses received in the 2020 Census. SRQA members were assigned roles and responsibilities to combat fraud in the 2020 Census.

According to the framework, antifraud entities should understand the program and its operations; have defined responsibilities and the necessary authority across the program; and have a direct reporting line to senior-level managers within the agency. We found that SRQA met these leading practices through our interviews with knowledgeable officials who discussed the Bureau’s strategy for managing fraud risk for the 2020 Census, and our review of documentation such as the fraud risk assessment, which listed roles and responsibilities for staff from the divisions in the antifraud group and the technical integration contractor. The group also directly reports to senior-level managers within the agency through weekly status reports that include milestones, activities, and challenges.

According to the Fraud Risk Framework, the antifraud entity, among other things, serves as the repository of knowledge on fraud risks and controls; manages the fraud risk-assessment process; leads or assists with trainings and other fraud-awareness activities; and coordinates antifraud initiatives across the program. The Bureau staffed the antifraud entity with members knowledgeable of the program and tasked them with managing the fraud risk assessment process. Also, the members facilitated communication with management and among stakeholders on fraud- related issues through weekly status reports. According to SRQA officials, issues and concerns are escalated to senior-level managers on an as- needed basis so they can be coordinated across the program.

The Bureau Assessed Fraud Risks and Developed a Risk Profile but Has Not Yet Determined Fraud Risk Tolerances

The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and to assess risks to determine a fraud risk profile. This includes assessing the likelihood and effect of fraud risks and determining a risk tolerance. Risk tolerance is the acceptable level of variation in performance relative to the achievement of objectives. In the context of fraud risk management, if the objective is to mitigate fraud risks—in general, to have a low level of fraud—the risk tolerance reflects managers’ willingness to accept a higher level of fraud risks. Risk tolerance can be either qualitative or quantitative, but regardless of the approach, Standards for Internal Control states that managers should consider defining risk tolerances that are specific and measurable.

The first part of the fraud risk assessment process includes leading practices on tailoring the assessment to the program; planning to conduct assessments both at regular intervals and when there are changes to the program or operating environment; identifying specific tools, methods, and sources for gathering information about fraud risks; and involving relevant stakeholders in the assessment process. The Bureau has met all the leading practices in the first part of the assess component, according to our review. Specifically, the Bureau tailored the fraud risk assessment to the 2020 Census as this is the first time an internet-response option will be available for a decennial census in the United States. To identify specific tools, methods, and sources for gathering information about fraud risks, the Bureau met with relevant stakeholders, along with subject- matter experts, and conducted focus groups to develop various fraud scenarios that became a key part of the assessment. The Bureau also involved relevant stakeholders in the assessment process by outlining their roles and responsibilities for the 2020 Census. For example, the Decennial Census Management Division serves as the fraud lead and oversees managing risks such as operational implementation, methodology, and workload demands with support from the other operational divisions in the antifraud group.

According to the Fraud Risk Framework while the timing can vary, effective antifraud entities plan to conduct fraud risk assessments at regular intervals and when there are changes to the program or operating environment, as fraud risk assessments are iterative and not meant to be onetime exercises. The Bureau’s assessment takes this into account by acknowledging that risk assessment is an ongoing process. The assessment also states that the SRQA team will continue to evaluate and develop modeling techniques to train against existing fraud scenarios, and SRQA welcomes input from all stakeholders to ensure the Bureau identifies fraud risks, and works to implement controls and mitigation plans throughout the 2020 Census.

The second part of the fraud risk assessment process includes identifying inherent fraud risks affecting the program; assessing the likelihood and effect of inherent fraud risks; determining a fraud risk tolerance; examining the suitability of existing fraud controls and prioritizing residual fraud risks; and documenting the program’s fraud risk profile (see figure 6).

The Bureau met three out of these five leading practices, including identifying inherent fraud risk; assigning numeric rankings for likelihood and impact of various fraud scenarios; and documenting the 2020 Census fraud risk profile, which outlines the strengths and weaknesses of the program. We concluded that one leading practice, examining the suitability of existing fraud controls and prioritizing residual fraud risks, was not applicable since the fraud detection system is new to the 2020 Census and changes the way the Bureau will detect different fraud scenarios. As a result, all fraud risks for the 2020 Census are residual risks. In reviewing the remaining leading practice in the fraud assessment processes, we found that after identifying inherent fraud risk and assigning numeric rankings for likelihood and impact of various fraud scenarios, the Bureau did not take the next step to determine a fraud risk tolerance.

Some of the steps the Bureau took to develop a risk response plan are similar to steps for developing a fraud risk tolerance. Specifically, the Bureau developed a process that classifies self-responses into risk categories of low, medium, or high. Bureau officials stated that they plan to use the classification to determine appropriate follow-up steps based on risk scores generated by its Fraud Detection Analytics Model that was develop by SRQA for the 2020 Census. However, the Bureau did not define thresholds for the low-, medium-, and high-risk categories. These thresholds, if defined, would meet the intent of a fraud risk tolerance by indicating the acceptable level of variation in self-responses.

SRQA officials stated that they are developing these thresholds, and therefore its fraud risk tolerance, and plan to have them completed in August 2019. This includes reviewing available information collected through the 2018 End-to-End Test, running simulations, defining thresholds, and then evaluating the results to make adjustments. Responses will receive a score, but until the Bureau defines fraud risk tolerance thresholds for the low-, medium-, and high-risk categories, it cannot effectively implement its antifraud strategy to allocate responses for follow-up or inclusion. This may also affect the Bureau’s ability to evaluate and adapt its antifraud strategy if initial benchmarks are not in place to use for monitoring, with subsequent adjustments potentially requiring additional time and resources. While officials described steps and time frames to develop a fraud risk tolerance, they did not do so for updating the antifraud strategy to include the tolerance. Updating the antifraud strategy to include the Bureau’s fraud risk tolerance will help to ensure that the strategy is current, complete, and conforms to leading practices.

The Bureau Designed a Response Plan and Collaborated Internally to Mitigate Fraud Risks but Did Not Include Plans to Refer Potential Fraud to the Office of Inspector General

The design and implement component of the Fraud Risk Framework calls for federal managers to design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation. This includes determining risk responses and documenting an antifraud strategy; designing and implementing specific control activities; developing a plan outlining how the program will respond to identified instances of fraud; and establishing collaborative relationships and creating incentives to help ensure effective implementation of the antifraud strategy.

For determining risk responses and documenting an antifraud strategy, the framework states that managers should (a) use the fraud risk profile to help decide how to allocate resources to respond to residual fraud risks; (b) develop, document, and communicate an antifraud strategy to employees and stakeholders that describes the program’s activities for preventing, detecting, and responding to fraud, as well as monitoring and evaluation; (c) establish roles and responsibilities of those involved in fraud risk management activities, such as the antifraud entity and external parties responsible for fraud controls, and communicate the role of the Office of Inspector General (OIG) to investigate potential fraud; (d) create timelines for implementing fraud risk management activities, as appropriate, including monitoring and evaluations; (e) demonstrate links to the highest internal and external residual fraud risks outlined in the fraud risk profile; and (f) link antifraud efforts to other risk management activities, if any.

The Bureau developed and documented an antifraud strategy (the fraud risk assessment and the risk response plan) and communicated it to applicable employees. Bureau officials provided final versions of the antifraud strategy in October 2018 and stated that all stakeholders were provided with excerpts applicable to their area. The antifraud strategy outlines the beginning and end dates for fraud detection operations, and links to the highest residual fraud risks. The risk response includes links to other risk management activities such as a security layer that is designed, created, and maintained by the technical integration contractor security group in coordination with the Office of Information Security and Decennial Information Technology Division. According to the risk response plan, this group protects the fraud detection system and its associated systems from outside attacks such as hacks and distributed denial of service attacks.

However, we found that the Bureau’s approach to managing fraud risk did not fully align with two leading practices in this component. First, until the Bureau defines its fraud risk tolerances, such as defining low-, medium-, or high-risk thresholds, it will not be able to effectively allocate resources to respond to residual fraud risks consistent with the Fraud Risk Framework’s leading practices. Second, the Bureau did not initially coordinate with the Department of Commerce (Commerce) OIG about its antifraud strategy, which is not consistent with the leading practices. Such lack of coordination could have precluded the OIG from determining if potentially fraudulent activities should be investigated. After discussing the results of our review with the Bureau, the Bureau contacted and met with the Commerce OIG in February 2019. Based on the Bureau’s notes from this meeting, the Bureau is on track to addressing the leading practice regarding coordination.

The framework states that to design and implement specific control activities to prevent and detect fraud, managers should (a) focus on fraud prevention over detection; (b) consider the benefits and costs of control activities to address identified residual risks; and (c) design and implement the control activities such as data-analytics to prevent and detect fraud. The 2020 Census antifraud control activities focus on detecting potentially fraudulent responses. The Bureaus plans to use a combination of data analytics and follow up to review response data before they are added to the Bureau’s overall Census counts. The Bureau’s efforts for the 2020 Census also focus on minimizing costs. Specifically, if the Bureau’s fraud detection can minimize the amount of cases that require manual investigation or work by field operations staff to collect the information again, it can reduce the cost and workload to the Bureau.

The framework states the antifraud strategy should also ensure that responses to identified instances of fraud are prompt and consistent. In addition, effective managers of fraud risks are to refer instances of potential fraud to the OIG or other appropriate parties, such as law- enforcement entities or the Department of Justice, for further investigation. The Bureau’s plan describes its process for scoring responses using its Fraud Detection Analytics Model and then sorting responses into a low-, medium-, or high-risk category. The plan also outlines risk responses that depend on the risk category. For example, medium-risk responses are reviewed internally and could be incorporated into the census count or sent for additional follow up.

However, the Bureau’s antifraud strategy does not call for instances of potential fraud to be referred to the Commerce OIG. Specifically, the Bureau’s fraud risk assessment and risk response plan do not mention the Commerce OIG. Bureau officials stated that the Commerce OIG did not participate in the development of these documents. In February 2019, after we discussed the results of our review with the Bureau, the Bureau met with the Commerce OIG to discuss potential referrals. As a result, the Bureau agreed to develop and share with the Commerce OIG a plan that outlines a potential referral process by summer 2019.

Managers who effectively manage fraud risks collaborate and communicate with stakeholders to share information on fraud schemes and the lessons learned from fraud control activities. The framework describes collaborative relationships as including other offices within the agency; federal, state, and local agencies; private-sector partners; law- enforcement entities; and entities responsible for control activities. In addition, managers should collaborate and communicate with the OIG to improve their understanding of fraud risks and align their efforts to address fraud. The Bureau collaborated internally with groups such as the Security Operations Center that maintain the security layer that protects Bureau systems and the nonresponse follow-up groups that visit households to collect information again. The Bureau also provided contractors with guidance by finalizing the antifraud strategy and incentives by entering into an agreement with the technical integrator contractor, which allows the Bureau to exercise an option to continue the contract for another year. However, the Bureau did not begin to collaborate and communicate with the Commerce OIG to improve its understanding of fraud risks and align efforts to address fraud until after we discussed the results of our review with the Bureau.

Bureau officials viewed the primary purpose of the fraud detection system as a way to improve data reliability, according to interviews. As a result, in 2018, the Bureau changed the name of the operation from Fraud Detection to SRQA. According to Bureau officials, the change better reflects the operation’s focus on detecting potential falsification in decennial census response data and referring suspected responses to a field resolution operation to collect the data again. Bureau officials initially stated that SRQA would not conduct investigations that lead to the kind of law enforcement activities traditionally associated with fraud detection. As mentioned above, the Bureau met with the Commerce OIG in February 2019 to discuss the potential for referrals and, according to the Bureau, initiate a process for doing so. However, officials did not discuss steps and a time frame for updating the antifraud strategy to include this process. Doing so will help to ensure that the strategy is current, complete, and conforms to leading practices.

Conclusions

Adequately addressing risks to the census is critical for ensuring a cost- effective and high-quality enumeration. The Bureau has taken important steps to address risks to the 2020 Census, but with less than a year until Census Day, the Bureau has not developed mitigation and contingency plans for all risks that require them. In addition, the Bureau does not have clear time frames for developing and obtaining management approval of mitigation and contingency plans, and some risks have gone without required plans for months and years. Moreover, the status of some plans is unclear and not all plans have received management approval. Some of the plans the Bureau has developed are missing key attributes we identified for helping to ensure the plans contain the information needed to manage risks. For example, none of the Bureau’s plans described how the Bureau will monitor the risk response, so the Bureau may not be able to track whether the plans are working as intended. These issues have arisen in some instances because the Bureau’s decennial risk management plan does not require mitigation and contingency plans to have each of the seven key attributes we identified; in other instances, the issues have arisen because Bureau officials do not always hold risk owners accountable for fulfilling all their risk management responsibilities. Consistently documenting risk management activities would support management’s ability to more quickly make informed decisions in response to risks confronting the 2020 Census. It would also help protect the Bureau from losing institutional knowledge in the event risk owners change roles or leave the agency.

The Bureau’s fraud risk strategy generally aligned with our Fraud Risk Framework, including developing response plans and collaborating internally to address risks. However, the Bureau has not yet determined the program’s fraud risk tolerance or outlined a plan for referring potential fraud to the Commerce OIG to investigate, but plans to do so later this year. Setting a tolerance would help the Bureau monitor risks, and referring potential fraud to the Commerce OIG would allow it to determine if further investigation is appropriate. In addition to taking these actions, updating the antifraud strategy to include the Bureau’s fraud risk tolerance and plan for OIG referral will help to ensure that the strategy is current, complete, and conforms to leading practices.

Recommendations for Executive Action

We are making the following seven recommendations to the Department of Commerce and the Census Bureau: The Secretary of Commerce should ensure that the Director of the Census Bureau develops and obtains management approval of mitigation and contingency plans for all risks that require them. (Recommendation 1)

The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau’s decennial risk management plan to include clear time frames for developing and obtaining management approval of mitigation and contingency plans. (Recommendation 2)

The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau’s decennial risk management plan to require that portfolio and program risk registers include a clear indication of the status of mitigation plans. (Recommendation 3)

The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau’s decennial risk management plan to require that risk mitigation and contingency plans, including the risk register descriptions and separate plans, have the seven key attributes for helping to ensure they contain the information needed to manage risk. (Recommendation 4)

The Secretary of Commerce should ensure that the Director of the Census Bureau holds risk owners accountable for carrying out their risk management responsibilities. (Recommendation 5)

The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau’s antifraud strategy to include a fraud risk tolerance prior to beginning the 2020 Census and adjust as needed. (Recommendation 6)

The Secretary of Commerce should ensure that the Director of the Census Bureau updates the Bureau’s antifraud strategy to include the Bureau’s plans for referring instances of potential fraud to the Department of Commerce Office of Inspector General for further investigation. (Recommendation 7)

Agency Comments

We provided a draft of this report to the Secretary of Commerce. In its written comments, reproduced in appendix V, the Department of Commerce agreed with our findings and recommendations and said it would develop an action plan to address them. The Census Bureau also provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the Secretary of Commerce, the Director of the U.S. Census Bureau, and the appropriate congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report please contact Robert Goldenkoff at (202) 512-2757 or goldenkoffr@gao.gov or Rebecca Shea at (202) 512-6722 or shear@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI.

Appendix I: Objectives, Scope, and Methodology

The objectives of this study were to examine (1) what risks to the 2020 Census the Census Bureau (Bureau) has identified, (2) the risks for which the Bureau has mitigation and contingency plans, (3) the extent to which the Bureau’s mitigation and contingency plans included information needed to manage risk, and (4) the extent to which the Bureau’s approach to managing fraud risks to the 2020 Census aligns with leading practices outlined in our Fraud Risk Framework.

To answer the first three objectives, we reviewed Bureau documentation regarding its approach to managing risks facing the 2020 Census, including its decennial risk management plan, operational plan, governance management plan, Risk Review Board meeting minutes and agendas, and guidance and training documents. In addition, we interviewed Bureau officials responsible for overseeing risk management for the 2020 Census.

To describe what risks to the 2020 Census the Bureau has identified and the risks for which the Bureau has mitigation and contingency plans, we also reviewed the Bureau’s portfolio- and program-level decennial risk registers.

To assess the extent to which the Bureau’s mitigation and contingency plans included information needed to manage risk, we selected a nongeneralizable sample of six risks from the Bureau’s risk registers based on factors such as likelihood of occurrence and potential impact (see table 3).

To select these risks, we began with the 12 risks identified by the Bureau in its 2020 Census Operational Plan as the “major concerns that could affect the design or successful implementation of the 2020 Census.” Next, we sorted the risks by numerical priority rating as of June 2018, a Bureau-assigned figure calculated by multiplying numerical scores for likelihood of occurrence and potential impact (see figure 3). We then selected the six risks with the highest priority ratings. For each selected risk, we reviewed relevant Bureau documentation—including risk mitigation and contingency plans—and we conducted semistructured interviews with the Bureau officials responsible for managing the risk.

In addition, drawing principally from our Enterprise Risk Management (ERM) framework as well as secondary sources, we identified seven key attributes for risk mitigation and contingency plans to help ensure they contain the information needed to manage risks (see figure 4). Specifically, we reviewed our ERM framework and other relevant prior work on risk management, as well as commonly used risk management publications from sources including the Office of Management and Budget, the Project Management Institute, and the Chief Financial Officers Council and Performance Improvement Council. We analyzed these publications to identify portions relevant to risk mitigation and contingency planning. Next, we synthesized the information and derived attributes that appeared most important for effective risk mitigation and contingency plans. We assessed the attributes against the essential elements laid out in our ERM framework and found that each attribute aligned with one or more of the elements. Six of the seven attributes—all but clearly defined trigger events—are applicable to mitigation plans. Each of the seven attributes are applicable to contingency plans, although two attributes—activity start and completion dates and activity implementation status—are only applicable if the risk has been realized. We assessed the risk mitigation and contingency plans entered in the Bureau’s risk registers as of December 2018, as well as the separate mitigation and contingency plans for the six selected risks, against the seven key attributes.

To evaluate the extent to which the Bureau’s approach to managing fraud risks to the 2020 Census aligns with leading practices outlined in our Fraud Risk Framework, we reviewed Bureau documentation related to the 2020 Census antifraud strategy. This strategy includes a fraud risk assessment that identifies and evaluates scenarios in which fraudulent activity could impact the 2020 Census results. It also includes a concept of operations that uses the fraud risk assessment to develop risk responses and its fraud detection systems. In addition, we interviewed Bureau officials responsible for antifraud efforts for the 2020 Census. We evaluated the information gathered based on the commit, assess, and design and implement components of our Fraud Risk Framework.

Our assessment was limited to a review of the presence or absence of leading practices from the framework, not whether they were sufficient. We also did not review the leading practices for the “evaluate and adapt” component of the framework. This component focuses on evaluating outcomes using a risk-based approach and then adapting activities established in the other components to improve fraud risk management.

Because the census is not scheduled to start until 2020, the Bureau will not be able to implement leading practices such as: monitoring and evaluating the effectiveness of preventive activities; measuring outcomes, in addition to outputs, of fraud risk management or using the results of monitoring and evaluations to improve the design and implementation of fraud risk management activities.

We conducted this performance audit from May 2018 to May 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: U.S. Census Bureau Operations Supporting the 2020 Census

Appendix II: U.S. Census Bureau Operations Supporting the 2020 Census Purpose Define and implement program management policies, processes, and the control functions for planning and implementing the 2020 Census to ensure an efficient and well- managed program.

Manage the delivery of an Information Technology (IT) “System of Systems” to meet 2020 Census business and capability requirements.

Ensure all 2020 Census operations and systems adhere to laws, policies, and regulations that ensure appropriate systems and data security, and protect respondent and employee privacy and confidentiality.

Identify and finalize content and design of questionnaires and other associated nonquestionnaire materials. Ensure consistency across data collection modes and operations. Provide optimal design and content of the questionnaires to encourage high response rates.

Assess and support language needs of non-English speaking populations. Determine the number of non-English languages and level of support for the 2020 Census. Optimize the non-English content of questionnaires and associated nonquestionnaire materials across data collection modes and operations. Ensure cultural relevancy and meaningful translation of 2020 Census questionnaires and associated nonquestionnaire materials.

Provide the geographic foundation to support 2020 Census data collection and tabulation activities within the Master Address File/Topologically Integrated Geographic Encoding and Referencing System. This system serves as the national repository for all spatial, geographic, and residential address data needed for census and survey data collection, data tabulation, data dissemination, geocoding services, and map production.

Provide an opportunity for tribal, federal, state, and local governments to review and improve the address lists and maps used to conduct the 2020 Census as required by Public Law 103-430.

Deliver a complete and accurate address list and spatial database for enumeration and determining the type and address characteristics for each living quarter.

Print and distribute internet invitation letters, reminder cards or letters or both, questionnaire mailing packages, and materials for other special operations, as required. Other materials required to support field operations are handled in the Decennial Logistics Management operation.

Capture and convert data from the 2020 Census paper questionnaires, including mail receipt, document preparation, scanning, optical character and mark recognition, data delivery, checkout, and form destruction.

Communicate the importance of participating in the 2020 Census to the entire population of the 50 states, the District of Columbia, and Puerto Rico to support field recruitment efforts, engage and motivate people to self-respond (preferably via the internet), raise and keep awareness high throughout the entire 2020 Census to encourage response, and effectively support dissemination of Census data to stakeholders and the public.

Internet Self-Response Maximize online response to the 2020 Census via contact strategies and improved access for respondents. Collect response data via the internet to reduce paper and nonresponse follow-up.

Purpose Make it easy for people to respond anytime and anywhere to increase self-response rates by providing response options that do not require a unique Census ID. Maximize real-time matching of non-ID respondent addresses to the census living quarters address inventory, assigning nonmatching addresses to census blocks.

Update the address and feature data and enumerate respondents in person. Designated to occur in areas where the initial visit requires enumerating while updating the address frame, particularly in remote geographic areas that have unique challenges associated with accessibility.

Update the address and feature data and leave a choice questionnaire package at every housing unit identified to allow the household to self-respond. Designed to occur in areas where the majority of housing units do not have a city-style address to receive mail.

Enumerate people living or staying in group quarters and provide an opportunity for people experiencing homelessness and receiving service at service-based locations, such as soup kitchens, to be counted in the census.

Enumerate individuals in occupied units at transitory locations who do not have a usual home elsewhere, such as recreational vehicle parks, campgrounds, racetracks, circuses, carnivals, marinas, hotels, and motels.

Provide questionnaire assistance for respondents by answering questions about specific items on the census form or other frequently asked questions about the 2020 Census, and provide an option for respondents to complete a census interview over the telephone. Also provide outbound calling support of nonresponse follow-up reinterview and coverage improvement.

Determine housing unit status for nonresponding addresses that do not self-respond to the 2020 Census and enumerate households that are determined to have a housing unit status of occupied.

Create and distribute the initial 2020 Census enumeration universe, assign the specific enumeration strategy for each living quarter based on case status and associated paradata, create and distribute workload files required for enumeration operations, track case enumeration status, run postdata collection processing actions in preparation for producing the final 2020 Census results, and check for fraudulent returns.

Obtain counts by home state of U.S. military and federal civilian employees stationed or deployed overseas and their dependents living with them.

Prepare and deliver the 2020 Census population counts to the President of the United States for congressional apportionment, tabulate and disseminate 2020 Census data products for use by the states for redistricting, and tabulate and disseminate 2020 Census data for use by the public.

Provide to each state the legally required Public Law 94-171 redistricting data tabulations by the mandated deadline of 1 year from Census Day (April 1, 2021).

Enhance the accuracy of the 2020 Census through remediating potential gaps in coverage by implementing an efficient and equitable process to identify and correct missing or geographically misallocated large group quarters and their population, and positioning remaining count issues for a smooth transition to the Count Question Resolution Operation.

Provide a mechanism for governmental units to challenge their official 2020 Census results.

Area

Purpose Coordinate storage of the materials and data and provide 2020 Census records deemed permanent, including files containing individual responses, to the National Archives and Records Administration and to the National Processing Center to use as source materials to conduct the Age Search Service. Also store data to cover in-house needs.

Island Areas Censuses Enumerate all residents of American Samoa, the Commonwealth of the Northern Mariana Islands, Guam, and the U.S. Virgin Islands; process and tabulate the collected data; and disseminate data products to the public.

Develop the survey design and sample for the Post-Enumeration Survey of the 2020 Census and produce estimates of census coverage based on the Post-Enumeration Survey.

Identify matches, nonmatches, and discrepancies between the 2020 Census and the Post-Enumeration Survey for both housing units and people in the same areas. Both computer and clerical components of matching are conducted.

Collect person and housing unit information (independent from the 2020 Census operations) for the sample of housing units in the Post-Enumeration Survey to help understand census coverage and to detect erroneous enumerations.

Document how well the 2020 Census was conducted, and analyze, interpret, and synthesize the effectiveness of census components and their impact on data quality or coverage or both. Measure the success of critical 2020 Census operations. Formulate and execute an experimentation program to support early planning and inform the transition and design of the 2030 Census and produce an independent assessment of population and housing unit coverage.

Support 2020 Census field operations for decennial staff (i.e., headquarters, PDC, Regional Census Center, Area Census Office, Island Areas Censuses, remote workers, and listers/enumerators.)

Provide the administrative infrastructure for data collection operations covering the 50 states, the District of Columbia, and Puerto Rico.

Coordinate space acquisition and lease management for the regional census centers, area census offices, and the Puerto Rico area office; and provide logistics management support services (e.g., kit assembly, supplies to field staff).

Provide the IT-related Infrastructure support to the 2020 Census, including enterprise systems and applications, 2020 Census-specific applications, Field IT infrastructure, mobile computing, and cloud computing.

Appendix III: 2020 Census Portfolio Risk Mitigation and Contingency Plan Templates

Appendix IV: Leading Practices from GAO’s Fraud Risk Framework

For the 2020 Census, the Census Bureau (Bureau) is trying to increase participation and reduce costs by offering more self-response options to households. This includes self-responses received via internet, phone, or mail. In 2018, the Self-Response Quality Assurance group finalized its antifraud strategy that includes a fraud risk assessment and risk response plan that focuses specifically on these responses. We developed a data collection instrument to structure our review of the antifraud strategy as it related to the commit, assess, and design and implement components of our Fraud Risk Framework.

Our assessment was limited to a review of the presence or absence of leading practices from the framework, not whether they were sufficient. We also did not assess the Bureau’s approach against leading practices in the “evaluate and adapt” component of the framework because the Bureau will not be able to implement practices in this component until the 2020 Census begins. The following table summarizes our comparison of the Bureau’s antifraud strategy to leading practices in the fraud risk framework.

Appendix V: Comments from the Department of Commerce

Appendix VI: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contacts named above, Lisa Pearson and Philip Reiff (Assistant Directors), Emmy Rhine Paule and Ariel Vega (Analysts-in- Charge), Carole Cimitile, Ann Czapiewski, Robert Gebhart, Maria McMullen, Ty Mitchell, James Murphy, Carl Ramirez, Kayla Robinson, Kate Sharkey, Andrea Starosciak, Michael Steinberg, Umesh Thakkar, and Jon Ticehurst made significant contributions to this report.