The United States shares nearly 4,000 miles of border with Canada stretching from the Pacific to the Atlantic coasts, and the U.S.-Canadian border is considered to be the world's longest open border between two nations. There is a great deal of trade and travel across this border, and approximately 90 percent of Canada's population lives within 100 miles of the U.S. border. While legal trade is predominant, DHS reports networks of illicit criminal activity and smuggling of drugs, currency, people, and weapons between the two countries. Annually, CBP reports making approximately 4,000 arrests and interdicts approximately 40,000 pounds of illegal drugs at and between the northern border ports of entry. Historically, these numbers have been significantly lower than those of the southwest border; however, DHS reports that the terrorist threat on the northern border is higher, given the large expanse of area with limited law enforcement coverage. DHS agencies are charged with protecting the nation and its citizens from threats of terrorism, as shown in table 1. CBP is the lead federal agency in charge of securing our nation's borders, and has three components with a mission to interdict illegal contraband and persons seeking to enter illegally at and between the land ports of entry. Two other DHS agencies, ICE and USCG, also have key roles. The ICE mission includes investigating and dismantling criminal organizations that transport persons and goods across the border illegally, while USCG executes its maritime security mission by providing patrol presence and operational response for all navigable waterways on the northern border, including the Great Lakes. DHS agencies leverage their border security efforts through partnerships with state, local, tribal, and Canadian law enforcement agencies to share intelligence, information, and conduct joint operations for interdiction and investigation of cross-border crime. DHS considers these collaborative efforts particularly important for the northern border in remote, sparsely populated areas. There has been growing concern within Congress over the number of personnel assigned to the northern border, the increasing amount of illegal activity, and the potential for terrorists to gain unlawful entry into the United States. There has also been concern with respect to the adequacy of facilities and physical infrastructure to accommodate the increasing volume of traffic. Congress has shown increasing interest in issues surrounding security of the northern border--first authorizing, and later directing--resource allocations to the northern border for personnel and improved technology. Congress has also established various reporting requirements in laws that are to provide updates on the status of northern border security. In addition to the 9/11 Act, for example, the Consolidated Appropriations Act, 2008, directs DHS to prepare and submit a biennial National Land Border Security Plan. This plan is to include a vulnerability, risk, and threat assessment of each port of entry located on the northern border or the southern border, beginning in January 2009. The DHS report--issued to Congress on February 29, 2008--was overseen and facilitated by CBP's Office of the Executive Secretariat (OES). OES was formed in August 2007 to assign responsibilities for and coordinate the development of all CBP congressional reports, correspondence, and external requests for information. OES tasked the CBP Office for Secure Border Initiative with taking the lead in coordinating information gathering from the relevant CBP components. OES also received input from ICE and USCG in formulating the report. The information from these sources was compiled and reviewed within CBP, DHS, and the Office of Management and Budget (OMB) before submission to Congress. While the DHS report to Congress discusses northern border vulnerabilities and ongoing initiatives in place as required in law, information is missing that identifies the extent that various vulnerabilities remain unaddressed, and recommendations and resources to address these security gaps. Without this information, it is difficult for Congress to consider future actions and resources needed on the northern border in the broader context of national security. The DHS report to Congress discusses northern border vulnerabilities and ongoing initiatives to improve northern border security consistent with the content of its planning, performance, and budget documents, but DHS does not link this information to show the extent that security gaps remain on the northern border. The DHS report states that the northern border is vulnerable to the primary threats of terrorism, drug trafficking, and illegal immigration. These facts were consistently supported by threat information obtained from Canadian officials, and officials from DHS and CBP. According to these sources, northern border vulnerabilities are most actively exploited to smuggle illegal drugs and contraband; illegal immigration is a lesser problem. While DHS reports significant concern that terrorists can enter the United States undetected at or between the northern ports of entry, U.S. and Canadian officials agree that there is currently no credible intelligence or evidence indicating that there are terrorists in Canada planning an attack on U.S. soil. The DHS report lists initiatives its component agencies have underway to address vulnerabilities and achieve operational control of the border but does not mention progress made in this regard, or how many border miles are under operational control. CBP reports on these indicators--border miles under effective (or operational) control, and border miles with increased situational awareness--as two of its key performance measures and reports that it plans to increase and achieve control of the northern border by deploying a proper mix of personnel, technology, facilities, and partnerships at and between the ports of entry. While the DHS report lists initiatives in each of these areas, they are not linked to the reported vulnerabilities, and the extent that these initiatives mitigate or eliminate vulnerabilities at and between the ports of entry is not mentioned. Also not mentioned in the report is the timeline DHS is using to request and deploy resources necessary to increase the levels of control of the northern border. The absence of such information makes it difficult for Congress to consider future action and resources needed on the northern border in the context of other areas of national security. In terms of personnel, DHS lists ongoing initiatives for adequately staffing the northern ports of entry, and hiring initiatives to increase staffing between the ports of entry by 2010. For the ports of entry, DHS describes its implementation of a workload staffing model that considers workload and processing times to help identify the number of personnel that should be deployed at each location, which has resulted in the deployment of 190 CBP officers. Between the ports of entry, DHS does not provide its methodology for identifying adequate staffing, but does describe initiatives to more than double the number of border patrol agents from fiscal years 2007 to 2010, in response to direction from Congress. It is unclear, however, to what extent these staffing initiatives will result in obtaining effective control of the border. For example, the report states that 190 CBP officers have been deployed to ports of entry as indicated in part by the workload staffing model; however, DHS reports in its strategic plan for fiscal years 2008-2013 that additional CBP officers are needed at many ports of entry. Similarly, while DHS reports a commitment to meet statutory staffing goals between the ports of entry by the year 2010, OBP officials indicated that a greater number of agents would be needed to gain operational control of the northern border. In discussing technology initiatives, CBP reports that technology has been employed at the northern ports of entry to address a number of vulnerabilities, but between the ports of entry, discussion is focused on pilot projects intended to test capabilities for potential use on the northern border. At the ports of entry, CBP reports that much technology is in place to address vulnerabilities related to the transport of illegal radiological and nuclear materials, illegal contraband, and misrepresentation of identity through the use of fraudulent documents. Between the ports of entry, pilot projects address vulnerabilities related to the inability to detect low-flying aircraft; the inability to detect unauthorized border crossings in areas without law enforcement patrol; and to share communications. The report does not discuss when the results of the projects will be available or the extent that DHS would use these technologies, if successful, to address existing vulnerabilities. DHS also does not discuss initiatives to address the vulnerabilities cited in the report related to maritime security, such as the lack of video capabilities in marinas, unregulated access that small private vessels have on the Great Lakes and other border waterways, and insufficient resources to access boats on the open water. Subsequent to the report issued to Congress, DHS provided a thorough discussion of the vulnerabilities and challenges in addressing these aspects of maritime security in the DHS Small Vessel Security Strategy, issued April 2008. USCG stated that an implementation plan would be finalized at the end of December 2008, to guide agency actions in implementing the strategy, but this plan would not be released to the public due to its security classification. In discussing facilities, the DHS report describes ongoing initiatives to systematically review the port of entry inspection facilities to identify the need for upgrade or replacement, and to develop a new standard station concept to accommodate the growth in number of border agents between the ports of entry. The report describes the age and condition of some facilities and volume of traffic and use. However, while the DHS strategic plan states that the department's secure border program depends significantly on modernizing the ports of entry, there is no discussion in the report to Congress on the status of these efforts, when they will be completed, and how they currently affect northern border security. The DHS report lists various initiatives underway that establish binational partnerships or partnerships among U.S. federal, state, and local agencies to share information and improve communication and cooperation among agencies working along the border. Five binational partnerships were discussed, four with a broad focus on cross-border law enforcement efforts, and one with a specific focus on preventing illegal air incursions. Six U.S. partnerships were also mentioned, one specific to smuggling on Indian reservations, two related to drug trafficking, two related to intelligence gathering, and one related to augmenting enforcement capacity by cross-designating federal authority to other agencies. DHS and CBP management documents support the report's discussion of these partnerships as a key strategy for northern border security; however, there is no discussion of the extent that these partnerships were responsible for increasing the level of control across the border or how they will do so in the future. The DHS report contains a section for recommendations to address northern border vulnerabilities, but the information provided is a restatement of initiatives in place without mention of recommendations for further action or additional resources as required by law. Officials from DHS component agencies provided several reasons this information was missing from the report. One reason was that the Secure Border Initiative (SBI) office--which was tasked with coordinating component agency contributions to the report--directed them to discuss their resource needs in terms of the existing budget; therefore, they did not discuss actions or resource requirements for future years. A second reason was that some components were satisfied with their current budget allocation. CBP officials stated that they supported the President's budget and had nothing further to recommend or request in the report to Congress. A third reason is that some components did not have the information necessary to identify recommendations or additional resources. USCG officials indicated that the lack of departmentwide strategic direction for the northern border has made it difficult to identify specific resource needs. Similarly, ICE officials said that information was lacking to compare and assess overall resources devoted across various northern border agencies, initiatives, and border locations. DHS is developing strategic plans, a risk-management process, and new initiatives that could change the level and mix of resources needed to protect the northern border; however, most efforts were incomplete and unavailable for our review. Over the years, we have conducted evaluations of various border security activities and our reports included a number of recommendations for improvement. DHS action to fully implement these recommendations would provide benefit in addressing northern border vulnerabilities. DHS and CBP have reported the need to provide a coherent framework to coordinate federal, state, local, and tribal northern border security efforts, and are developing northern border strategic plans, as well as a risk- management process to further these goals. Completion of these efforts should provide DHS with useful information in developing future reports to Congress on northern border security. DHS has completed, or begun efforts to develop, three strategic plans that will help address vulnerabilities on the northern border. Strategic plans help ensure that missions requiring a multiagency response are firmly aligned with articulated goals and objectives, and help keep agencies focused on the desired "end state." While DHS has developed a broad strategic plan to outline the department's overall mission and objectives, it has begun to focus on the need to develop coordinated and unified strategies to address more specific concerns, such as northern border security. A key effort under development is an overall northern border strategic plan that will, for the first time, take all DHS component agencies into account in efforts to address vulnerabilities necessary for control of the northern border. CBP did not indicate when this plan may be completed. A second strategic plan under development will address security vulnerabilities in the air environment, such as the inability to detect low-flying aircraft. CBP officials stated that they were working on performance measures for this plan, and estimate that it will be released in April 2009. DHS issued its third strategic plan, the Small Vessel Security Strategy, in April 2008 to help close existing maritime security gaps on waterways such as the Great Lakes, related to the small vessel environment. To help component agencies achieve the major goals outlined in each of these strategic plans, DHS plans to develop implementation plans that are to describe specific actions component agencies will take in support of each objective, identify lead component agencies for these actions, and provide target completion dates. USCG has stated that the implementation plan for the small vessel strategic plan is scheduled to be issued for use by component agencies at the end of December 2009, but will be considered security sensitive. Dates are not yet available for implementation plans to follow the remaining two strategic plans. Some DHS component agencies have acted to incorporate risk- management principles that provide information to prioritize and allocate resources for their individual programs and activities as required by law and presidential directive, but DHS has not yet completed efforts to implement this approach departmentwide. Risk management is important for strengthening homeland security resource allocations, as the nation cannot afford to fully protect against every type of threat. Therefore, an approach is needed that considers how best to allocate resources based on factors such as probability and adverse consequence. The DHS goal is to develop a risk-management process that will assess risk and inform strategic planning, programming, budgeting, and execution processes across all of its component agencies and that will evaluate the risk- reduction effects among relevant DHS programs. However, achieving this goal has been difficult. While risk management has been used in the private and public sectors for decades, its application for homeland security and combating terrorism is relatively new and without a precedent framework. As such, the effort to assess risk across DHS component agencies and programs is still in its very early stages of development. DHS component agencies have identified resources to increase and achieve northern border security, but the need for these resources constantly evolves in response to various factors. For example, the DHS report described many pilot projects for new technology. If successful, OBP officials report that these projects could reduce security vulnerabilities and current needs for other resources, such as existing technology, personnel, or infrastructure. However, these officials also indicate that new technology must be fully tested for operational effectiveness, and delays coupled with uncertainties of success have made it difficult to balance future resource investments in new technology with current investments in existing technology. Such balance is necessary to ensure security as well as effective stewardship of taxpayer dollars. Similarly, DHS officials discussed partnerships among federal, state, and local agencies to coordinate information and operations--either newly created or still in development--that could result in greater efficiencies in border security. However, time will tell if these partnerships are sustainable and warrant a decrease or change in current estimated needs for personnel. External factors--such as the interplay among private parties, governments, and agencies--also influence actions in addressing security vulnerabilities. In Detroit, for example, CBP officials said that action to improve facilities at northern ports of entry was stymied by private ownership of property and landlocked facilities. In addition, the Small Vessel Security Strategy indicates that efforts to address maritime vulnerabilities were challenged by different practices or views among federal, state, and Canadian governments in balancing security needs with the freedom of the waterways expected by the small-vessel community. Further, ICE officials said that the scope of their authority in pursuing narcotics investigations influenced their actions in addressing some cross- border crimes. DHS has an opportunity to address some northern border vulnerabilities by fully implementing recommendations made in past evaluations of its security efforts. Over the past few years, we have conducted evaluations and issued a number of reports related to the security of the U.S. border both at and between ports of entry (see Related GAO Products section at end of this report). In some instances, our reports included recommendations addressing vulnerabilities in border security--including the northern border--while in other cases, our reports and recommendations were more general, but when implemented, would provide benefit to the northern border. We reviewed recommendations resulting from GAO evaluations conducted from fiscal years 2005 through 2008 and identified 11 reports containing 50 recommendations that had potential to address vulnerabilities in border security, or to address weaknesses in key initiatives. At the time of our review, DHS had implemented 11 of these 50 recommendations. For example, DHS implemented a recommendation to formalize a performance measure for the traveler inspection program that would help agency management and Congress monitor effectiveness in apprehending inadmissible aliens and other violators. However, 39 recommendations from the 11 GAO reports are still open. In some cases, recommendations were open because DHS and other federal agencies had not yet had time to implement them. For example, 18 of the 39 open recommendations were from GAO reports issued within the last fiscal year. In regard to the remaining 21 recommendations, DHS and other agencies agreed to take action, but at least 1 and, in some cases, over 3 years have passed without full implementation. Standards for Internal Control in the Federal Government state that agencies are to ensure that findings of audits and other reviews are promptly resolved. The time necessary to resolve recommendations varies depending on the type of action required. However, DHS does not have a transparent process to show how long it will take to implement each recommendation considering the resources, risk level, and complexity of effort required. Timely implementation of recommendations would help address vulnerabilities related to a variety of border security initiatives. Some of the older recommendations that have not been fully implemented include those to improve screening of travelers at ports of entry to ensure legal entry, preclude cross-border transport of illicit nuclear materials, reduce risks in delivering key technology for border surveillance and for information sharing, and increase information sharing and coordination among federal, state, and local law enforcement agencies, as shown in table 2 and appendix I. We believe that these outstanding recommendations continue to have merit and should be implemented. Federal agency reporting requirements, such as those contained in the 9/11 Act, can provide Congress with important information for debating policy and allocating scarce resources, and the level of agency responsiveness can either support or hinder these efforts. While the DHS report to Congress provided information on the status of its efforts, there is little sense of the relative effect these efforts have had in protecting the northern border, and what additional action or resources may be needed in the future. Requirements in law to periodically assess the status of northern border security provide DHS with additional opportunity to highlight information that can best meet congressional needs. Completion of DHS efforts to develop a northern border strategic plan and risk management process to prioritize action and funding could lead to better understanding among DHS, its component agencies, and Congress in determining whether resources are most effectively allocated across initiatives, border locations, and responsible agencies. However, balancing current and future funding for border security will remain challenging as the resource needs for the northern border will continue to evolve in response to the relative success of new initiatives. In the meantime, implementing recommendations for improving border security in a more timely fashion would help reduce the nation's risk due to unaddressed vulnerabilities. To provide Congress with information that will facilitate policy discussions and resource decisions for northern border security, we recommend that for future reporting requirements the Secretary of Homeland Security include more specific information on the actions, resources, and time frame needed to improve security of the northern border along with any attendant uncertainties, and the basis used to prioritize action and resources for northern border security relative to other areas of national security. We requested comments on a draft of this report from the Secretary of Homeland Security and Attorney General. In its response, DHS and CBP agreed with our recommendation and stated that CBP will work with the department to implement it through the approved budget process. DOJ did not provide formal comments. In its comments, DHS stated that our report said DHS and other agencies should proceed to adopt and address all of the recommendations from previous reports without any assessment of priority based on risk. Our intent in discussing these recommendations was to point out potential security vulnerabilities that exist, not to imply that all of these recommendations were of equal importance, or that risk-based prioritization should not be applied when addressing them. GAO has advocated the use of risk management principles, and using them to sequence actions on open recommendations would seem to be appropriate. We have added language to clarify that while the definition of timely implementation will vary across recommendations, DHS lacks a transparent process to show how long it will take to implement each recommendation considering the resources, risk level, and complexity of effort required. DHS's comments are reprinted in appendix II. DHS and DOJ also offered technical comments, which we considered and incorporated where appropriate. We are providing copies of this report to the Senate and House committees that have authorization and oversight responsibilities for homeland security. We are also sending copies to the Secretary of Homeland Security, the Attorney General, and other interested parties. In addition, this report will be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8777, or stanar@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. In the past, GAO has offered numerous recommendations to the Department of Homeland Security (DHS) related to border security. Although previous recommendations are not specific to the northern border, many touch on different aspects that do affect various elements of northern border security. Many recommendations made by GAO concerning general border security, nuclear security, technology, and interagency cooperation and information sharing, have yet to be implemented by DHS. Fully implementing these recommendations could provide great benefits to DHS and the nation in terms of strengthening general border security, and by extension, security of the northern border. Tables 3 through 6 detail 39 selected open recommendations related to border security vulnerabilities. In addition to the contact named above, Cindy Ayers, Assistant Director, and Adam Couvillion, Analyst-in-Charge, managed this assignment. David Holt made significant contributions to the work. Amanda Miller and Michele Fejfar assisted with design, methodology, and data analysis. Linda Miller provided assistance in report preparation; and Frances Cook provided legal support. Secure Border Initiative: DHS Needs to Address Significant Risks in Delivering Key Technology Investment. GAO-08-1086. Washington, D.C.: September 22, 2008. Secure Border Initiative: Observations on Deployment Challenges. GAO- 08-1141T. Washington, D.C.: September 10, 2008. Risk Management: Strengthening the Use of Risk Management Principles in Homeland Security. GAO-08-904T. Washington, D.C.: June 25, 2008. Nuclear Security: NRC and DHS Need to Take Additional Steps to Better Track and Detect Radioactive Materials. GAO-08-598. Washington, D.C.: June 19, 2008. Border Security: Summary of Covert Tests and Security Assessments for the Senate Committee on Finance, 2003-2007. GAO-08-757. Washington, D.C.: May 16, 2008. Homeland Security: DHS Has Taken Actions to Strengthen Border Security Program and Operations, but Challenges Remain. GAO-08-542T. Washington, D.C.: March 6, 2008. Border Security: Despite Progress, Weaknesses in Traveler Inspections Exist at Our Nation's Ports of Entry. GAO-08-329T. Washington, D.C.: January 3, 2008. Border Security: Despite Progress, Weaknesses in Traveler Inspections Exist at Our Nation's Ports of Entry. GAO-08-219. Washington, D.C.: November 5, 2007. Homeland Security: Federal Efforts Are Helping to Alleviate Some Challenges Encountered by State and Local Information Fusion Centers. GAO-08-35. Washington, D.C.: October 30, 2007. Secure Border Initiative: Observations on Selected Aspects of SBInet Program Implementation. GAO-08-131T. Washington, D.C.: October 24, 2007. Terrorist Watch List Screening: Opportunities Exist to Enhance Management Oversight, Reduce Vulnerabilities in Agency Screening Processes, and Expand Use of the List. GAO-08-110. Washington, D.C.: October 11, 2007. Border Security: Despite Progress, Weaknesses in Traveler Inspections Exist at Our Nation's Ports of Entry. GAO-08-123SU. Washington, D.C.: October 5, 2007, SBU. Border Security: Security Vulnerabilities at Unmanned and Unmonitored U.S. Border Locations. GAO-07-884T. Washington, D.C.: September 27, 2007. Combating Nuclear Smuggling: Additional Actions Needed to Ensure Adequate Testing of Next Generation Radiation Detection Equipment. GAO-07-1247T. Washington, D.C.: September 18, 2007. Border Security: Security of New Passports and Visas Enhanced, but More Needs to Be Done to Prevent Their Fraudulent Use. GAO-07-1006. Washington, D.C.: July 31, 2007. Border Security: Long-term Strategy Needed to Keep Pace with Increasing Demand for Visas. GAO-07-847. Washington, D.C.: July 13, 2007. Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry. GAO-07-378T. Washington, D.C.: January 31, 2007. Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry. GAO-07-248. Washington, D.C.: December 6, 2006. Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry. GAO-07-56SU. Washington, D.C.: November 13, 2006 SBU. Homeland Security: Opportunities Exist to Enhance Collaboration at 24/7 Operations Centers Staffed by Multiple DHS Agencies. GAO-07-89. Washington, D.C.: October 20, 2006. Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program. GAO-06-1090T. Washington, D.C.: September 7, 2006. Border Security: Continued Weaknesses in Screening Entrants into the United States. GAO-06-976T. Washington, D.C.: August 2, 2006. Combating Nuclear Smuggling: DHS Has Made Progress Deploying Radiation Detection Equipment at U.S. Ports-of-Entry, but Concerns Remain. GAO-06-389. March 22, 2006. Risk Management: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. December 15, 2005. Border Security: Opportunities to Increase Coordination of Air and Marine Assets. GAO-05-543. August 12, 2005.

Summary:
Covering nearly 4,000 miles of land and water from Washington to Maine, the U.S.-Canadian border is the longest undefended border in the world. Various Department of Homeland Security (DHS) component agencies share responsibility for northern border security, primarily U.S. Customs and Border Protection (CBP), in collaboration with other federal, state, local, tribal, and Canadian entities. The Implementing Recommendations of the 9/11 Act of 2007 required the Secretary of Homeland Security to submit a report to Congress that addresses the vulnerabilities along the northern border, and provides recommendations and required resources to address them. The act also required GAO to review and comment on this report. In response to this mandate, GAO examined (1) the extent to which the DHS report to Congress is responsive to the legislative requirements and (2) actions that may be necessary to address northern border vulnerabilities in addition to the actions addressed in the report. To conduct this work, GAO reviewed DHS plans, reports, and other documents, and interviewed DHS officials. The DHS February 2008 report to Congress is not fully responsive to legislative requirements in providing information for improving northern border security. In particular, DHS provided a listing of northern border vulnerabilities and initiatives to address them, but did not include recommendations and additional resources that are needed to protect the northern border. DHS officials provided several reasons for the lack of specificity and gaps in reported information, including the fact that the component agencies' priorities for action and resources are reflected in the existing budget process, and that they had nothing further to recommend or request through this report. However, budget documents do not reflect the resources needed over time to achieve control of the northern border. The lack of this information makes it difficult for Congress to consider future actions and resources needed. DHS is developing northern border strategic plans and a risk-management process to help guide and prioritize action and resources, and fully implementing recommendations from past GAO evaluations would also provide benefit in addressing northern border security vulnerabilities. DHS is currently developing strategic plans that are intended to provide overall direction in addressing vulnerabilities in northern border security. DHS is also developing a risk-management process to assist in prioritizing efforts and resources that will provide greatest benefit to national security. DHS officials have said that the success of various pilot projects, such as DHS's testing of new technology, will likely change the level and mix of resources needed to protect the northern border. In the meantime, DHS could take action to reduce vulnerabilities by implementing recommendations made in past evaluations. DHS has implemented 11 GAO recommendations designed to improve border security, but 39 recommendations are yet to be fully addressed. Eighteen of these open recommendations were made within the last year. However, 21 recommendations for improving use of air and marine assets, improving screening processes at the ports of entry, and deploying nuclear detection equipment--which DHS and other agencies generally agreed to take action to implement--have remained open for at least 1 year and, in some cases, over 3 years. GAO believes these outstanding recommendations continue to have merit and should be implemented.