Our experience has shown that the key elements needed to make progress in high-risk areas are top-level attention by the administration and agency leaders grounded in the five criteria for removal from the High-Risk List, as well as any needed congressional action. The five criteria for removal that we issued in November 2000 are as follows: Leadership commitment. Demonstrated strong commitment and top leadership support. Capacity. Agency has the capacity (i.e., people and resources) to resolve the risk(s). Action plan. A corrective action plan exists that defines the root cause, solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended. Monitoring. A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures. Demonstrated progress. Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area. Starting in our 2015 update, we added clarity and specificity to our assessments by rating each high-risk area’s progress on the five criteria and used the following definitions: Met. Actions have been taken that meet the criterion. There are no significant actions that need to be taken to further address this criterion. Partially met. Some, but not all, actions necessary to meet the criterion have been taken. Not met. Few, if any, actions towards meeting the criterion have been taken. We are removing two areas—DOD Supply Chain Management and Mitigating Gaps in Weather Satellite Data—from the list due to the progress that was made in addressing the high-risk issues. As we have with areas previously removed from the High-Risk List, we will continue to monitor these areas to ensure that the improvements we have noted are sustained. If significant problems again arise, we will consider reapplying the high-risk designation. We added two areas to the High-Risk List since our 2017 update—Government-Wide Personnel Security Clearance Process and VA Acquisition Management. We are removing the area of DOD Supply Chain Management from the High-Risk List because, since 2017, DOD has addressed the remaining two criteria (monitoring and demonstrated progress) for the asset visibility and materiel distribution segments. Congressional attention, DOD leadership commitment, and our collaboration contributed to the successful outcome for this high-risk area, which had been on GAO’s High-Risk List since 1990. DOD’s actions for the asset visibility segment of this high-risk area included (1) providing guidance for the military components to consider key attributes of successful performance measures during metric development for their improvement initiatives; (2) incorporating into after- action reports, information relating to performance measures; and (3) demonstrating sustained progress by, for example, increasing its visibility of assets through radio-frequency identification (RFID), an automated data-capture technology that can be used to electronically identify, track, and store information contained on a tag. According to DOD, the use of RFID tags to provide visibility of sustainment cargo at the tactical leg (i.e., the last segment of the distribution system) resulted in $1.4 million annual cost savings. DOD’s actions for the materiel distribution segment of this high-risk area included (1) making progress in developing its suite of distribution performance metrics; (2) incorporating distribution metrics, as appropriate, on the performance of all legs of the distribution system, including the tactical leg; (3) making progress in refining its Materiel Distribution Improvement Plan and incorporating additional actions based on interim progress and results; and (4) improving its capability to comprehensively measure distribution performance, identifying distribution problems and root cause, and implementing solutions. According to DOD, initiatives focused on distribution process and operational improvements have resulted in at least $1.56 billion in distribution cost avoidances to date. As we have with areas previously removed from the High-Risk List, we will continue to monitor this area to ensure that the improvements we have noted are sustained. Appendix II provides additional information on this high-risk area. We are removing the area of Mitigating Gaps in Weather Satellite Data from the High-Risk List because—with strong congressional support and oversight—the National Oceanic and Atmospheric Administration (NOAA) and DOD have made significant progress since 2017 in establishing and implementing plans to mitigate potential gaps in weather satellite data. The United States relies on polar-orbiting satellites to provide a global perspective on weather every morning and afternoon. NOAA is responsible for the polar satellite program that crosses the equator in the afternoon while DOD is responsible for the polar satellite program that crosses the equator in the early morning orbit. NOAA’s actions for polar- orbiting weather satellites that addressed the remaining criteria of action plan and demonstrated progress included (1) issuing three updates to its gap mitigation plan between January 2016 and February 2017 to address shortfalls we had identified previously; and (2) successfully launching the NOAA-20 satellite in November 2017, which is currently operational and is being used to provide advanced weather data and forecasts. Moreover, NOAA is also working to build and launch the next satellites in the polar satellite program. DOD’s actions for polar-orbiting weather satellites, pursuant to statutes and accompanying congressional direction, included DOD leadership (1) developing and implementing plans to acquire satellites as part of a family of systems to replace its aging legacy weather satellites, including awarding a contract for its Weather System Follow-on–Microwave program, planned for launch in 2022; (2) establishing plans to meet its highest-priority weather monitoring data collection needs that will not be covered by the Weather System Follow-on–Microwave program, including by acquiring and launching the Electro-Optical/Infrared Weather Systems satellite in 2024; and (3) monitoring the Weather System Follow-on- Microwave satellite program’s progress toward addressing critical needs and assessing its operations and sustainment costs. As we have with areas previously removed from the High-Risk List, we will continue to monitor this area to ensure that the improvements we have noted are sustained. Appendix II provides additional information on this high-risk area. Executive branch agencies are not meeting investigation timeliness objectives, and these processing delays have contributed to a significant backlog that the National Background Investigations Bureau (NBIB)—the agency responsible for personnel security clearance investigations— reported to be approximately 565,000 investigations as of February 2019. In addition, the executive branch has not finalized performance measures to ensure the quality of background investigations and some long- standing key reform initiatives remain incomplete. Further, information technology (IT) security concerns may delay planned milestones for the development of a new background investigation IT system. We included the DOD program on our High-Risk List in 2005 and removed it in 2011 because of improvements in the timeliness of investigations and adjudications, and steps toward measuring the quality of the process. We put the government-wide personnel security clearance process on our High-Risk List in January 2018 because of significant challenges related to the timely processing of security clearances and completing the development of quality measures. In addition, thITe government’s effort to reform the personnel security clearance process, starting with the enactment of the Intelligence Reform and Terrorism Prevention Act of 2004, has had mixed progress, and key reform efforts have not been implemented government-wide. Since adding this area to the High-Risk List, the Security Clearance, Suitability, and Credentialing Performance Accountability Council (PAC), including its four principal members—the Deputy Director for Management of the Office of Management and Budget (OMB), the Director of National Intelligence (DNI); the Under Secretary of Defense for Intelligence; and the Director of the Office of Personnel Management (OPM)—have not fully met the five criteria for high-risk removal. Several issues contribute to the risks facing the government-wide personnel security clearance process: Clearance processing delays. Executive branch agencies are not meeting most investigation timeliness objectives. The percentage of executive branch agencies meeting established timeliness objectives for initial secret clearances, initial top secret clearances, and periodic reinvestigations decreased each year from fiscal years 2012 through 2018. For example, 97 percent of the executive branch agencies we reviewed did not meet the timeliness objectives for initial secret clearance investigations in fiscal year 2018. Lack of quality measures. While the executive branch has taken steps to establish government-wide performance measures for the quality of background investigations—including establishing quality assessment standards and a quality assessment reporting tool—it is unclear when this effort will be completed. Security clearance reform delays. The executive branch has reformed many parts of the personnel security clearance process— such as updating adjudicative guidelines to establish common adjudicative criteria for security clearances; however, some long- standing key initiatives remain incomplete—such as completing plans to fully implement and monitor continuous evaluation. IT security. DOD is responsible for developing a new system to support background investigation processes, and DOD officials expressed concerns about the security of connecting to OPM’s legacy systems since a 2015 data breach compromised OPM’s background investigation systems and files for 21.5 million individuals. As of December 2018, OPM has not fully taken action on our priority recommendations to update its security plans, evaluate its security control assessments, and implement additional training opportunities. However, since we added this area to our High-Risk List, the PAC has demonstrated progress in some areas. For example, NBIB reported that the backlog of background investigations decreased from almost 715,000 cases in January 2018 to approximately 565,000 cases in February 2019. NBIB officials credit an Executive Memorandum—issued jointly in June 2018 by the DNI and the Director of OPM and containing measures to reduce the investigation backlog—as a driver in backlog reduction. Further, in response to a requirement in the Securely Expediting Clearances Through Reporting Transparency (SECRET) Act of 2018, in September 2018, NBIB reported to Congress, for each clearance level, (1) the size of the investigation backlog, (2) the average length of time to conduct an initial investigation and a periodic reinvestigation, and (3) a discussion of the factors contributing to investigation timeliness. The PAC is also reporting publicly on the progress of key reforms through www.performance.gov, and for fiscal year 2018, the website contains quarterly action plans and progress updates, which present figures on the average timeliness of initial investigations and periodic reinvestigations for the executive branch as a whole, investigation workload and backlog, and investigator headcounts. We have made numerous recommendations to PAC members to address risks associated with the personnel security clearance process between 2011—when we removed DOD’s personnel security clearance program from the High-Risk List, and 2018—when we placed the government-wide personnel security clearance process on the High-Risk List. We consider 27 of these recommendations key to addressing the high-risk designation. Eight recommendations key to the high-risk designation have been implemented, including three since January 2018. Nineteen of these key recommendations remain open—including recommendations that the principal members of the PAC (1) conduct an evidence-based review of investigation and adjudication timeliness objectives, (2) develop and report to Congress on investigation quality measures, (3) prioritize the timely completion of efforts to modernize and secure IT systems that affect clearance holders government-wide, and (4) develop and implement a comprehensive workforce plan that identifies the workforce needed to meet current and future demand for background investigations services and to reduce the investigations backlog. See page 170 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. VA spends tens of billions of dollars to procure a wide range of goods and services—including medical supplies, IT, and construction of hospitals, clinics, and other facilities—to meet its mission of providing health care and other benefits to millions of veterans. VA has one of the most significant acquisition functions in the federal government, both in obligations and number of contract actions. The Veterans Health Administration (VHA) provides medical care to veterans and is by far the largest administration in the VA. Since we began focusing on VA’s acquisition management activities in 2015, we have reported numerous challenges in this area. Since 2015, we have made 31 recommendations, 21 of which remain open, that cover a range of areas to address challenges in VA’s acquisition management. In fiscal year 2019, VA received the largest discretionary budget in its history—$86.5 billion, about $20 billion higher than in 2015. About a third of VA’s discretionary budget in fiscal year 2017, or $26 billion, has been used to contract for goods and services. VA’s acquisition management continues to face challenges including (1) outdated acquisition regulations and policies; (2) lack of an effective medical supplies procurement strategy; (3) inadequate acquisition training; (4) contracting officer workload challenges; (5) lack of reliable data systems; (6) limited contract oversight and incomplete contract file documentation; and (7) leadership instability. In light of these challenges and given the significant taxpayer investment, it is imperative that VA show sustained leadership commitment to take steps to improve the performance of its procurement function so that it can use its funding in the most efficient manner possible to meet the needs of those who served our country. This area has been added to the High-Risk List for the following reasons in particular: Outdated acquisition regulations and policies. VA’s procurement policies have historically been outdated, disjointed, and difficult for contracting officers to use. In September 2016, we reported that the acquisition regulations contracting officers currently follow have not been fully updated since 2008 and that VA had been working on completing a comprehensive revision of its acquisition regulations since 2011. VA’s delay in updating this fundamental source of policy has impeded the ability of contracting officers to effectively carry out their duties. We recommended in September 2016 that VA identify measures to expedite the revision of its acquisition regulations and clarify what policies are currently in effect. VA concurred with this recommendation but has not yet fully implemented it. Lack of an effective medical supplies procurement strategy. VA’s Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program for purchasing medical supplies to meet the needs of about 9 million veterans at 172 medical centers has not been effectively executed, nor is it in line with practices at leading hospitals that have launched similar programs. We reported in November 2017 that VA’s approach to developing its catalog of supplies was rushed and lacked key stakeholder involvement and buy-in. As a result, VA was not able to accomplish some of the key efficiencies the program was intended to achieve, such as streamlining the purchase of medical supplies and saving money. We recommended in November 2017 that VA develop, document, and communicate to stakeholders an overarching strategy for the program. VA concurred with this recommendation and reported that it would develop a new strategy by March 2019. Contracting officer workload challenges. The majority of our reviews since 2015 have highlighted workload as a contributing factor to the challenges that contracting officers face. Most recently, in September 2018, we reported that about 54 percent of surveyed VA contracting officers said their workload was not reasonable. In addition, in September 2016, we reported that VHA contracting officers processed a large number of emergency procurements of routine medical supplies, which accounted for approximately 20 percent of VHA’s overall contract actions in fiscal year 2016, with obligations totaling about $1.9 billion. Contracting officers told us that these frequent and urgent small-dollar transactions reduce contracting officers’ efficiency and ability to take a strategic view of procurement needs. We recommended in November 2017 that VHA network contracting offices work with medical centers to identify opportunities to more strategically purchase goods and services frequently purchased on an emergency basis. VA concurred with this recommendation and reported in December 2018 that it is utilizing a supply chain dashboard to track items purchased on an emergency basis and determine which of those items to include on the catalog. VA noted that it added 13,300 items to the catalog from June 2018 to December 2018, including items often purchased on an emergency basis. We requested documentation showing which items added to the catalog were previously purchased on an emergency basis, but as of January 2019, VA had not yet provided it. Among other things, VA should implement our 21 open recommendations and specifically needs to take the following steps to demonstrate greater leadership commitment and strategic planning to ensure efficient use of its acquisition funding and staffing resources: Prioritize completing the revision of its acquisition regulations, which has been in process since 2011. Develop, document, and communicate to stakeholders a strategy for the Medical Surgical Prime Vendor program to achieve overall program goals. Identify opportunities to strategically purchase goods and services that are frequently purchased on an emergency basis. See page 210 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. In addition to specific areas that we have designated as high-risk, other important challenges facing our nation merit continuing close attention. One of these is the use of illicit drugs and the misuse of prescription drugs and the ways they affect individuals, their families, and the communities in which they live. Over 70,000 people died from drug overdoses in 2017—about 191 people every day—according to the Centers for Disease Control and Prevention, with the largest portion of these deaths attributed to opioids. Further, drug overdoses are the leading cause of death due to injuries in the United States. They are currently at their highest ever recorded level and, since 2011, have outnumbered deaths by firearms, motor vehicle crashes, suicide, and homicide, according to the Drug Enforcement Administration. The Council of Economic Advisors estimates that in 2015, the economic cost of the opioid crisis alone was more than $500 billion when considering the value of lives lost due to opioid-related overdose. Federal drug control efforts spanning prevention, treatment, interdiction, international operations, and law enforcement represent a considerable federal investment. According to the President’s fiscal year 2019 budget, federal drug control funding for fiscal year 2017 was $28.8 billion. Multiple federal agencies have ongoing efforts to respond to this crisis, including efforts to reduce the supply and demand for illicit drugs, to prevent misuse of prescription drugs, and to treat substance use disorders. However, we previously found that many efforts lacked measures to gauge the success of the federal response. Further, we have long advocated an approach to decision-making based on risk management. Such an approach would (1) link agencies’ plans and budgets to achieving their strategic goals, (2) assess values and risks of various courses of actions to help set priorities and allocate resources, and (3) provide for the use of performance measures to assess progress. The Office of National Drug Control Policy (ONDCP) is responsible for overseeing and coordinating the implementation of U.S. drug policy, including developing the National Drug Control Strategy (Strategy). ONDCP released the 2019 Strategy on January 31, 2019. The Strategy focuses on approaches related to prevention, treatment and recovery, and steps to reduce the availability of illicit drugs in the United States. We will continue to monitor the extent to which ONDCP and other federal agencies are employing a risk management and coordinated approach to their efforts to limit drug misuse. In particular, we have ongoing and planned work to assess ONDCP’s operations, including its (1) leadership and coordination of efforts across the federal government; (2) the effects of the drug crisis on labor force participation and productivity and on people with disabilities and other vulnerable populations; (3) key federal efforts to reduce the availability of illicit drugs; and (4) agency efforts around drug education and prevention. We will determine whether this issue should be added to the High-Risk List once we have completed this ongoing and planned work. Agencies can show progress by addressing our five criteria for removal from the list: leadership commitment, capacity, action plan, monitoring, and demonstrated progress. As shown in table 1, 24 high-risk areas, or about two-thirds of all the areas, have met or partially met all five criteria for removal from our High-Risk List; 20 of these areas fully met at least one criterion. Compared with our last assessment, 7 high-risk areas showed progress in one or more of the five criteria without regressing in any of the criteria. Ten high-risk areas have neither met nor partially met one or more criteria. Two areas showed mixed progress by increasing in at least one criterion and also declining in at least one criterion. Three areas declined since 2017. These changes are indicated by the up and down arrows in table 1. Figure 1 shows that since our 2017 update, the most progress was made on the action plan criterion—four high-risk areas received higher ratings. We rated two areas lower on leadership commitment and two areas lower on monitoring. Table 2 shows that 17 of the 34 high-risk areas we rated have met the leadership commitment criterion while two high-risk area ratings regressed on leadership commitment from met to partially met since our last report. Leadership commitment is the critical element for initiating and sustaining progress, and leaders provide needed support and accountability for managing risks. Leadership commitment is needed to make progress on the other four high-risk criteria. Table 2 shows that only three high-risk areas met the criterion for capacity, six met the criterion for action plan, and two met the criterion for demonstrated progress. One high-risk area—U.S. Government’s Environmental Liability—has partially met only one criterion since we added the area to our list in 2017 and the rest are not met. As noted, seven areas showed improvement in one or more criterion without regressing in any criteria. Two areas showed sufficient progress to be removed from the High-Risk List. The other five high-risk areas remaining on the 2019 list demonstrated improvement and are described below. Three of these five improving high-risk areas are the responsibility of the Department of Defense (DOD)—DOD Support Infrastructure Management, DOD Financial Management, and DOD Business Systems Modernization. The two other improving areas are Department of Energy’s (DOE's) Contract Management for the National Nuclear Security Administration and Office of Environmental Management, and Medicare Program & Improper Payments. DOD Support Infrastructure Management: DOD manages a portfolio of real property assets that, as of fiscal year 2017, reportedly included about 586,000 facilities—including barracks, maintenance depots, commissaries, and office buildings. The combined replacement value of this portfolio is almost $1.2 trillion and includes about 27 million acres of land at nearly 4,800 sites worldwide. This infrastructure is critical to maintaining military readiness, and the cost to build and maintain it represents a significant financial commitment. Since our 2017 High-Risk Report, DOD’s rating for two criteria—leadership commitment and action plan—improved from partially met to met. DOD has demonstrated leadership commitment by stating its commitment to addressing key recommendations we have made by, for example, (1) better forecasting the initial Base Realignment and Closure (BRAC) costs for military construction, IT, and relocating military personnel and equipment; (2) better aligning infrastructure to DOD force structure needs by, for example, improving the accuracy and sufficiency of its excess capacity estimates; and (3) pursuing an effort to consolidate and standardize leases, which includes analyzing whether it is feasible to relocate functions from commercial leased space to existing space on an installation, thereby reducing leases and better utilizing excess space. DOD has developed action plans to better identify excess infrastructure and thus be positioned to dispose of it. For example, in the 2017 High- Risk Report, we stated that DOD’s Real Property Efficiency Plan includes DOD’s goals for reducing the footprint of its real property inventory and metrics to gauge progress, to be implemented by the end of 2020. We also found in 2018 that DOD was achieving cost savings and cost avoidances as it had begun using intergovernmental support agreements between military installations and local governments to obtain installation services, such as waste removal, grounds maintenance, and stray animal control. As a result of these and other actions, DOD now meets the action plan criterion for this high-risk area. As of December 2018, 23 recommendations related to this high-risk area remain open. DOD continues to partially meet the criteria for capacity, monitoring, and demonstrated progress. See page 158 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. DOD Financial Management: Since our 2017 High-Risk Report, ratings for the DOD Financial Management high-risk area improved for the criteria of leadership commitment and monitoring. For the leadership commitment criterion, the high-risk area rating improved from partially met to met in 2019 due to several DOD leadership actions. For example, in 2018, DOD leadership met the goal of undergoing an agency-wide financial statement audit and established a process to remediate any audit findings—ultimately to improve the quality of financial information that is most valuable in managing the department’s day-to-day operations. In addition, according to a DOD official, audit remediation efforts have produced benefits in certain inventory processes that have led to operational improvements. DOD leadership demonstrated its commitment to making needed improvements by developing a database that tracks hundreds of findings and recommendations that came out of the audits. In addition, senior leadership has been meeting bimonthly with military services’ leadership for updates on the status of corrective action plans to address audit findings and recommendations, and the Under Secretary of Defense (Comptroller) has been meeting frequently with the Secretary of Defense to review the plans. These same DOD actions also led to the high-risk area’s rating for the criterion of monitoring to improve from not met to partially met. For example, the database mentioned above is intended to capture, prioritize, and assign responsibility for auditor findings and related corrective action plans, which are meant to be used to measure progress towards achieving a clean audit opinion. Further, DOD leadership has held frequent meetings to discuss the status of corrective action plans. In addition, DOD also established councils in certain areas (e.g., financial reporting) to review the status of audit remediation activities and challenges. All of these actions demonstrate an improvement in DOD’s monitoring activities for its financial management function. However, DOD’s efforts to improve its financial management continue to be impaired by long-standing issues—including its decentralized environment; cultural resistance to change; lack of skilled financial management staff; ineffective processes, systems, and controls; incomplete corrective action plans; and the need for more effective monitoring and reporting. DOD remains one of the few federal entities that cannot accurately account for and report on its spending or assets. As of December 2018, 53 recommendations for this high-risk area are open. The DOD Financial Management high-risk area continues to partially meet the capacity and action plan criteria and not meet the demonstrated progress criterion. See page 147 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. DOD Business Systems Modernization: DOD spends billions of dollars each year to acquire modernized systems, including systems that address key areas such as personnel, financial management, health care, and logistics. This high-risk area includes three critical challenges facing DOD: (1) improving business system acquisition management, (2) improving business system investment management, and (3) leveraging DOD’s federated business enterprise architecture. DOD’s capacity for modernizing its business systems has improved over time and, since our 2017 High-Risk Report, DOD’s overall rating for the criterion of action plan improved from not met to partially met in 2019. DOD established a plan for improving its federated business enterprise architecture (i.e., description of DOD’s current and future business environment and a plan for transitioning to the future environment). Specifically, the rating improved for DOD’s federated business enterprise architecture segment of the high-risk area because DOD’s assistant deputy chief management officer approved a business architecture improvement plan in January 2017. Since 2017, we have made 10 recommendations related to this high-risk issue. As of December 2018, 27 recommendations are open. The leadership, capacity, monitoring, and demonstrated progress criteria remain partially met as in 2017. See page 152 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. . DOE's Contract Management for the National Nuclear Security Administration and Office of Environmental Management: DOE oversees a broad range of programs related to nuclear security, science, energy, and waste cleanup, among other areas. As the largest civilian contracting agency in the federal government, DOE relies primarily on contractors to carry out its programs. For instance, DOE spends about 90 percent of its annual budget on contracts and acquiring capital assets. In fiscal year 2018, DOE’s budget was $34.5 billion. The high-risk area focuses on contracts, as well as major projects—those with an estimated cost of $750 million or greater—managed by DOE’s National Nuclear Security Administration (NNSA) and Office of Environmental Management (EM). Since our 2017 High-Risk Report, DOE has made progress by improving from a not met to a partially met rating for the demonstrated progress criterion. Specifically, through its Office of Cost Estimating and Program Evaluation, NNSA has enhanced its capability to estimate costs and schedules, and to assess alternatives for programs and projects, among other things. NNSA also made progress by adopting best practices in several areas, such as those for estimating costs and schedules in nuclear weapons refurbishment activities and capital asset acquisitions. For example, we determined that DOE’s revised cost estimate of $17.2 billion to construct a Mixed Oxide Fuel Fabrication Facility to dispose of surplus, weapons-grade plutonium substantially met best practices— providing assurance that the estimated costs could be considered reliable. This finding contributed to DOE’s reevaluation of the project and ultimate termination, in October 2018, in favor of a potentially less costly disposal approach. Fifty-one of our recommendations were open as of December 2018; 15 recommendations were made since the last high-risk update in February 2017. DOE continues to meet the criterion of leadership commitment, partially meet the criteria for action plan and monitoring, and not meet the criterion for capacity. See page 217 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. . Medicare Program & Improper Payments: In calendar year 2017, Medicare, which is overseen by the Centers for Medicare & Medicaid Services (CMS), financed $702 billion worth of health services for approximately 58 million elderly and disabled beneficiaries. Medicare faces a significant risk with improper payments—payments that either were made in an incorrect amount or should not have been made at all— which reached an estimated $48 billion in fiscal year 2018. Since our 2017 High-Risk Report, estimated improper payment rates declined more than one percent across the Medicare program. In addition, CMS’ rating for the capacity criterion of the improper payments segment improved from partially met to met in 2019 due to several actions. First, the Center for Program Integrity’s (CPI) budget and resources have increased over time and the agency has established work groups and interagency collaborations to extend its capacity. For example, CMS allocated more staff to CPI after Congress provided additional funding. CPI’s full-time equivalent positions increased from 177 in 2011 to 419 in 2017. Additionally, in August 2017, we reported that CMS’s Fraud Prevention System, which analyzes claims to identify health care providers with suspect billing patterns, helped speed up certain fraud investigation processes. Further, the Healthcare Fraud Prevention Partnership helped improve information sharing among payers inside and outside of the government. Since 1990, when we added Medicare to our High-Risk List, we have made many recommendations related to the Medicare program, 28 of which were made since the last high-risk update in February 2017. As of December 2018, more than 80 recommendations remain open. CMS continues to meet the criterion of leadership commitment and to partially meet the remaining three criteria of action plan, monitoring, and demonstrated progress. See page 241 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. Congress enacted several laws since our last report in February 2017 to help make progress on high-risk issues. Table 3 lists selected examples of congressional actions taken on high-risk areas. Congressional oversight also plays a vital role in addressing high-risk issues. For example, at a May 2018 hearing, we testified that the Census Bureau’s (Bureau) cost estimate was not reliable, and that the actual cost could be higher than planned. Further, the Secretary of Commerce created a dedicated team to provide oversight and guidance to the Bureau on cost estimation. In addition to its instrumental role in supporting progress in individual high-risk areas, Congress also enacted the following statutes that, if implemented effectively, will help foster progress on high-risk issues government-wide: Fraud Reduction and Data Analytics Act of 2015 (FRDAA):FRDAA is intended to strengthen federal antifraud controls. FRDAA requires OMB to use our Fraud Risk Framework to create guidelines for federal agencies to identify and assess fraud risks, and then design and implement control activities to prevent, detect, and respond to fraud. Agencies, as part of their annual financial reports beginning in fiscal year 2017, are further required to report on their fraud risks and their implementation of fraud reduction strategies, which should help Congress monitor agencies’ progress in addressing and reducing fraud risks. To aid federal agencies in better analyzing fraud risks, FRDAA requires OMB to establish a working group tasked with developing a plan for creating an interagency library of data analytics and data sets to facilitate the detection of fraud and the recovery of improper payments. This working group and the library should help agencies coordinate their fraud detection efforts and improve their ability to use data analytics to monitor databases for potential improper payments. The billions of dollars in improper payments, some of which may be a result of fraud, are a central part of the Medicare Program, Medicaid Program, and Enforcement of Tax Laws (Earned Income Tax Credit) high-risk areas. We reported in 2018 that, among other things, OMB did not involve all agencies subject to the act as required by FRDAA or hold the required minimum number of working-group meetings in 2017. As shown in figure 2, a majority of the 72 agencies surveyed indicated a lack of involvement with and information from the working group as challenges in implementing FRDAA. We made three recommendations, including that OMB ensure the working group meets FRDAA’s requirements to involve all agencies that are subject to the act and ensure that mechanisms to share controls, best practices, and data-analytics techniques are in place. OMB did not concur with our recommendations. We continue to believe the recommendations are valid, as discussed in the 2018 report. IT Acquisition Reform, statutory provisions known as the Federal Information Technology Acquisition Reform Act (FITARA): FITARA, enacted in December 2014, was intended to improve how agencies acquire IT and better enable Congress to monitor agencies’ progress in reducing duplication and achieving cost savings. Since the enactment of these provisions, OMB and federal agencies have paid greater attention to IT acquisition and operation, resulting in improvements to the government-wide management of this significant annual investment. These efforts have been motivated in part by sustained congressional support for improving implementation of this law, as highlighted in agencies’ FITARA implementation scores issued biannually by the House Committee on Oversight and Reform. This continuing oversight has produced positive results. For example, in the committee’s December 2018 FITARA implementation scorecard, 18 of the 24 major federal agencies received the highest possible rating for their efforts to improve the management of software licenses, of which we have found there are thousands annually across the government. Seven months earlier, in the prior scorecard, only eight agencies had achieved this rating. Moreover, federal agencies have taken actions to address 106 of the 136 related recommendations that we have made in this area since 2014. FITARA includes specific requirements related to seven areas: the federal data center consolidation initiative, enhanced transparency and improved risk management, agency Chief Information Officer authority enhancements, portfolio review, expansion of training and use of IT acquisition cadres, government-wide software purchasing, and maximizing the benefit of the federal strategic sourcing initiative. In November 2017, Congress extended or removed the sunset dates of several of these statutory requirements that were originally to end in 2018 and 2019. While all of the 24 federal agencies covered by this law have developed FITARA implementation plans, the agencies need to effectively execute these plans. Successfully addressing FITARA requirements is central to making progress in Improving the Management of IT Acquisitions and Operations, which has been on our High-Risk List since 2015. Program Management Improvement Accountability Act (PMIAA): Enacted in December 2016, the act is intended to improve program and project management in certain larger federal agencies. Among other things, the act requires the Deputy Director for Management of OMB to adopt and oversee implementation of government-wide standards, policies, and guidelines for program and project management in executive agencies. The act also requires the Deputy Director to conduct portfolio reviews to address programs we identify as high-risk. It further creates a Program Management Policy Council to act as the principal interagency forum for improving practices related to program and project management. The council is to review programs identified as high-risk and make recommendations to the Deputy Director or designee. OMB has produced a general strategy for implementing the law through 2022 and met some initial milestones required by PMIAA. For example, in June 2018, OMB issued OMB Memorandum M- 18-19, which includes: (1) agency guidance for implementing PMIAA, (2) a five-year strategic outline for improving program and project management, and (3) initial program management standards and principles. Further, agencies have designated Program Management Improvement Officers to guide their implementation of PMIAA. According to OMB, it began implementing PMIAA’s requirement to conduct portfolio reviews on high-risk areas by requiring relevant agencies to provide several items for discussion during the 2018 Strategic Review meetings. These annual meetings are to consist primarily of a discussion of agency progress towards each of the strategic objectives outlined in their strategic plans, but also cover other management topics such as enterprise risk management and high-risk area progress. According to OMB documents, in advance of these meetings, OMB required agencies to provide a high-level summary of (1) any disagreements with our recommendations, (2) progress barriers, and (3) actions needed by OMB, other agencies, or Congress to help the agency achieve progress towards removal from our High-Risk List. OMB officials told us their 2018 Strategic Review meetings did not address each high-risk area but did address government-wide high-risk areas, such as cybersecurity, information technology, and strategic human capital as they related to the President’s Management Agenda. In the past, senior management officials from OMB, applicable agencies, and our agency have met to address areas where additional management attention could be beneficial to high-risk issues. These trilateral meetings, beginning in 2007 and pre- dating PMIAA’s 2016 enactment, have continued across administrations. However, OMB has organized only one of these high-risk meetings since the last high-risk update in 2017, on the Government-wide Personnel Security Clearance Process. In November 2018, OMB told us of plans to hold additional meetings on priority high-risk areas, including the 2020 Decennial Census, Strategic Human Capital Management, Ensuring the Cybersecurity of the Nation, National Aeronautics and Space Administration (NASA) Acquisition Management, and Managing Federal Real Property. Effective implementation of PMIAA provides an important opportunity to enhance progress on high-risk areas by focusing leadership attention through the portfolio reviews and trilateral meetings. Further, a number of high-risk areas have longstanding or significant program and project management concerns, including the acquisition-related high-risk areas for DOD, DOE, NASA, and VA. These and other programs can benefit from improving program and project management. In December 2019, we will report on OMB’s progress in implementing PMIAA, including what further steps it has taken to use the portfolio review process required in PMIAA to address issues on our High-Risk List. Agency leaders took actions to implement our recommendations. These resulted in numerous improvements to programs and operation and improved service. Further, these actions to implement our recommendations resulted in significant financial benefits. Table 4 shows some examples of the financial benefits achieved since our last High-Risk Report. In the 2 years since our last High-Risk Report, three areas—NASA Acquisition Management, Transforming EPA's Process for Assessing and Controlling Toxic Chemicals, and Limiting the Federal Government's Fiscal Exposure By Better Managing Climate Change Risks—have regressed in their ratings against our criteria for removal from the High- Risk List. In addition, while progress is needed across all high-risk areas, we have identified nine additional areas that require significant attention to address imminent, longstanding, or particularly broad issues affecting the nation. NASA plans to invest billions of dollars in the coming years to explore space, improve its understanding of the Earth’s environment, and conduct aeronautics research, among other things. We designated NASA’s acquisition management as high risk in 1990 in view of NASA’s history of persistent cost growth and schedule delays in the majority of its major projects. Following several years of continuing a generally positive trend of limiting cost growth and schedule delays for its portfolio of major projects, we found that NASA’s average launch delay increased from 7 to 12 months between May 2017 and May 2018. Further, the overall development cost growth increased from 15.6 percent to at least 18.8 percent over the same time period. NASA’s largest science project, the James Webb Space Telescope, has experienced schedule delays of 81 months and cost growth of 95 percent since the project’s cost and schedule baseline was first established in 2009. NASA is at risk for continued cost growth and schedule delays in its portfolio of major projects. Since our 2017 high-risk update, we have lowered NASA acquisition management from meeting the rating to partially meeting the rating in two criteria—leadership commitment and monitoring. The other three criteria ratings remained the same as in 2017. Ratings for capacity and demonstrated progress remain partially met and the rating for action plan remains met. Over the next several years, NASA plans to add new, large, and complex projects to the portfolio, including a lunar Gateway—currently being discussed as a platform in a lunar orbit to mature deep space exploration capabilities. In addition, many of NASA’s current major projects, including some of the most expensive ones, are in the phase of their life cycles when cost growth and schedule delays are most likely. NASA acquisition management requires significant attention for the following reasons: NASA leadership has approved risky programmatic decisions for complex major projects, which compounded technical challenges. For example, leadership has approved some programs to proceed (1) with low cost and schedule reserves, (2) with overly aggressive schedules, and (3) without following best practices for establishing reliable cost and schedule baselines. NASA leadership has also not been transparent about cost and schedule estimates for some of its most expensive projects. Without transparency into these estimates, both NASA and Congress have limited data to inform decision making. NASA has not yet instituted a program for monitoring and independently validating the effectiveness and sustainability of the corrective action measures in its new action plan, which NASA finalized in December 2018. In addition, while NASA has taken some steps to build capacity to help reduce acquisition risk, including updating tools aimed at improving cost and schedule estimates, other areas still require attention. For example, we reported in May 2018 that several major NASA projects experienced workforce challenges, including not having enough staff or staff with the right skills. NASA has also identified capability gaps in areas such as scheduling, earned value management, and cost estimating, and has efforts underway to try to improve capacity in these areas. Since 2017, we have made 9 recommendations on this high-risk area, and as of December 2018, 15 recommendations remain open. These recommendations include that NASA needs to improve transparency of major project cost and schedule estimates, especially for its human spaceflight programs, as well as continue to build capacity to reduce acquisition risk. NASA will also need to implement its new action plan and track progress against it. See page 222 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. The Environmental Protection Agency’s (EPA’s) ability to effectively implement its mission of protecting public health and the environment is dependent on it assessing the risks posed by chemicals in a credible and timely manner. Such assessments are the cornerstone of scientifically sound environmental decisions, policies, and regulations under a variety of statutes. Based on our work since our 2017 High-Risk Report, the overall rating for leadership commitment decreased from met to partially met due to limited information for completing chemical assessments and proposed budget cuts in the Integrated Risk Information System (IRIS) Program. The ratings for the remaining four criteria remain unchanged and are partially met. The EPA Acting Administrator indicated his commitment to fulfill the agency’s obligations under the Toxic Substances Control Act (TSCA) as amended by the 2016 Frank R. Lautenberg Chemical Safety for the 21 Century Act (Lautenberg Act) and ensure chemicals in the marketplace are safe for human health and the environment. Nonetheless, EPA needs to give more attention to several areas to fully realize the benefits of the new law, and to demonstrate additional progress in the IRIS Program, such as: While EPA released a document in late December 2018 called the IRIS Program Outlook, the Outlook fails to list the projected date for most of the assessments and includes no information regarding assessment prioritization—including how these assessments will meet program and regional office needs. The Lautenberg Act increases both EPA’s responsibility for regulating chemicals and its workload. EPA recently issued a rule under the act to collect fees from certain companies to defray a portion of the implementation costs, but it is unclear whether the fees collected will be sufficient to support relevant parts of the program. EPA issued a First Year Implementation Plan in June 2016 noting that this document is intended to be a roadmap of major activities EPA will focus on during the initial year of implementation. As of mid- February 2019 the plan has not been updated, according to publically available information, although EPA had indicated that it is a living document that will be further developed over time. EPA needs to ensure that the people and resources dedicated to the IRIS Program and TSCA implementation are sufficient. Our March 2019 report on chemical assessments provides information on what remains to be done to address challenges in the IRIS program and implement the Lautenberg Act. Since we added this area to our High-Risk List in 2009, we have made 12 recommendations to EPA related to IRIS and TSCA. As of February 2019, seven recommendations remain open. See page 204 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. Numerous studies have concluded that climate change poses risks to many environmental and economic systems and creates a significant fiscal risk to the federal government. The rising number of natural disasters and increasing reliance on the federal government for assistance is a key source of federal fiscal exposure. As of December 2018, total federal funding for disaster assistance since 2005 is approaching half a trillion dollars (about $430 billion), most recently for catastrophic hurricanes, flooding, wildfires, and other losses in 2017 and 2018. The costliness of disasters is projected to increase as extreme weather events become more frequent and intense due to climate change. There are five areas where government-wide action is needed to reduce federal fiscal exposure, including, but not limited to, the federal government’s role as (1) the insurer of property and crops; (2) the provider of disaster aid; (3) the owner or operator of infrastructure; (4) the leader of a strategic plan that coordinates federal efforts and informs state, local, and private-sector action; and (5) the provider of data and technical assistance to decision makers. Neither global efforts to mitigate climate change causes nor regional adaptation efforts currently approach the scales needed to avoid substantial damages to the U.S. economy, environment, and human health over the coming decades, according to the November 2018 Fourth National Climate Assessment. Government-wide action is needed to improve the nation’s resilience to natural hazards and reduce federal fiscal exposure to climate change impacts. Congress continues to show its commitment to progress on this high-risk issue by enacting legislation. For example, in October 2018, the Disaster Recovery Reform Act was enacted, which, among other things, allows the President to set aside, with respect to each major disaster, a percentage of certain grants to use for pre-disaster hazard mitigation. In addition, the National Defense Authorization Act of 2018, required, among other things, DOD to report on climate impacts to its installations. However, the federal government has not made measurable progress since 2017 to reduce its fiscal exposure to climate change, and in some cases, has revoked prior policies designed to do so. Specifically, since 2017, the ratings for four criteria remain unchanged—three at partially met and one at not met. The rating for one criterion—monitoring—regressed to not met. Limiting the federal government’s fiscal exposure to climate change requires significant attention because the federal government has revoked prior policies that had partially addressed this high-risk area and has not implemented several of our recommendations that could help reduce federal fiscal exposure. For example, since our 2017 high-risk update, the federal government: revoked Executive Order 13690, which had established a government-wide federal flood risk management standard to improve the resilience of communities and federal assets against the impacts of flooding. This action could increase federal fiscal exposure, as taxpayer-funded projects may not last as long as intended because they are not required to account for future changes in climate-related risk. rescinded its guidance directing agencies to consider climate change in their National Environmental Policy Act of 1969 reviews for certain types of federal projects. has not implemented our July 2015 recommendation to establish a comprehensive investment strategy identifying, prioritizing, and implementing federal disaster resilience investments that could reduce federal fiscal exposure to climate change. has not implemented our November 2015 recommendations to create a national climate information system providing authoritative, accessible information useful for state, local, and private-sector decision making. We have made 62 recommendations related to this high-risk area, 12 of which were made since our February 2017 high-risk update. As of December 2018, 25 remain open. The federal government needs a cohesive strategic approach with strong leadership and the authority to manage climate change risks across the entire range of federal activities. See page 110 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. Federal agencies and the nation’s critical infrastructures—such as energy, transportation systems, communications, and financial services— are dependent on information technology systems to carry out operations. The security of these systems and the data they use is vital to public confidence and national security, prosperity, and well-being. The risks to systems underpinning the nation’s critical infrastructure are increasing as security threats evolve and become more sophisticated. We first designated information security as a government-wide high-risk area in 1997. This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015. In 2018, we updated this high-risk area to reflect the lack of a comprehensive cybersecurity strategy for the federal government. Since 2010, we have made over 3,000 recommendations to agencies aimed at addressing cybersecurity shortcomings, including protecting cyber critical infrastructure, managing the cybersecurity workforce, and responding to cybersecurity incidents. Of those 3,000 recommendations, 448 were made since our last high-risk update in February 2017. Although many recommendations have been addressed, about 700 have not yet been implemented. Despite the number of unimplemented recommendations, since our 2017 High-Risk Report, the administration has made progress in this high-risk area as it continues to meet the leadership commitment criterion through various actions. These include the President issuing (1) an executive order in May 2017 requiring federal agencies to take a variety of actions, including better managing their cybersecurity risks and coordinating to meet reporting requirements related to cybersecurity of federal networks and critical infrastructure and (2) a National Security Strategy in December 2017 citing cybersecurity as a national priority and identifying needed actions. Further, the administration issued a government-wide reform plan and reorganization recommendations in June 2018 with, among other things, proposals for solving the federal cybersecurity workforce shortage. Additionally, the administration released a National Cyber Strategy in September 2018 outlining activities such as securing critical infrastructure, federal networks, and associated information. However, additional actions are needed. We have identified four major cybersecurity challenges facing the nation: (1) establishing a comprehensive cybersecurity strategy and performing effective oversight, (2) securing federal systems and information, (3) protecting cyber critical infrastructure, and (4) protecting privacy and sensitive data. To address the four major cybersecurity challenges, we identified 10 critical actions the federal government and other entities need to take. These critical actions include, for example, developing and executing a more comprehensive federal strategy for national cybersecurity and global cyberspace; addressing cybersecurity workforce management challenges; and strengthening the federal role in protecting the cybersecurity of critical infrastructure (see figure 3). Until these shortcomings are addressed, federal agencies’ information and systems will be increasingly susceptible to the multitude of cyber- related threats that exist. See page 178 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. The expanded federal role in housing finance that began during the 2007–2009 financial crisis has substantially increased the government’s exposure to potential mortgage losses. Federally supported mortgages include those backed by the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac)—collectively, the enterprises—which the Federal Housing Finance Agency (FHFA) placed into government conservatorships in 2008. Federal support also occurs through Federal Housing Administration (FHA) mortgage insurance and Government National Mortgage Association (Ginnie Mae) guarantees on mortgage-backed securities. The substantial financial assistance the enterprises required during and after the crisis, coupled with the large fiscal exposure they and other federal mortgage entities represent today, underscore the need to reform the federal role in housing finance. Delay in resolving the federal role in housing finance poses considerable risks. Through the enterprises, FHA, and Ginnie Mae, the federal government is exposed to potential losses on several trillion dollars in mortgage debt. A severe economic downturn could trigger significant taxpayer assistance to one or more of these entities. Congress and federal agencies have taken some steps to facilitate the transition to a revised federal role, such as holding hearings, introducing legislation, issuing regulations, and developing market monitoring tools. For example, in 2013 and 2014, housing and regulatory agencies finalized rules designed to prevent a recurrence of risky practices in originating and securing mortgages that contributed to the financial crisis. Additionally, FHFA and the Consumer Financial Protection Bureau have developed a representative database of mortgage information that could be useful for examining the effect of mortgage market reforms. However, overall progress on resolving the federal role will be difficult to achieve until Congress provides further direction by enacting changes to the housing finance system. Several issues contribute to the risks facing federal housing finance, including the following: More than 10 years after entering federal conservatorships, the enterprises’ futures remain uncertain and billions of taxpayer dollars remain at risk. Under agreements with the Department of the Treasury (Treasury), the enterprises have received $191.4 billion in capital support as of the end of fiscal year 2018 and have paid dividends to the department exceeding that amount. If they were to incur major additional losses, they would draw required amounts from their remaining $254.1 billion in Treasury commitments. In addition, prolonged conservatorships could hinder development of the broader mortgage securities market by creating uncertainty and crowding out private investment. Nonbanks (lenders and loan servicers that are not depository institutions) have played an increasingly large role in the mortgage market in recent years. While nonbanks have helped provide access to mortgage credit, they also may pose additional risks, in part because they are not federally regulated for safety and soundness. However, FHFA lacks statutory authority to examine nonbank mortgage servicers and other third parties who do business with and pose potential risks to the enterprises. The statutory 2 percent capital requirement for FHA’s $1.26 trillion mortgage insurance fund is not based on a specified risk threshold, such as the economic conditions the fund would be expected to withstand. As a result, it may not provide an adequate financial cushion under scenarios in which Congress may anticipate the fund would be self-sufficient. During the last housing downturn, the fund’s capital ratio fell below the required level and remained there for 6 consecutive years. At the end of fiscal year 2013, the fund required supplemental funds—about $1.7 billion—for the first time in its history. Six of our federal housing recommendations remain open, including those we made in June 2015 on assessing the effects of mortgage reforms already in place. Further, as we previously recommended in November 2016 and January 2019, Congress should consider housing finance reform legislation that: establishes objectives for the future federal role in housing finance, including the role and structure of the enterprises within the housing finance system; provides a transition plan to a reformed system that enables the enterprises to exit federal conservatorship; and addresses all relevant federal entities, including FHA and Ginnie Mae. As we recommended in March 2016 and November 2017, respectively, Congress also should consider granting FHFA explicit authority to examine nonbank servicers and other third parties that do business with the enterprises, and specifying the economic conditions FHA’s insurance fund would be expected to withstand without a substantial risk of requiring supplemental funds. See page 95 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. Due to the significance and risk associated with Resolving the Federal Role in Housing Finance, we are separating it from the high-risk area of Modernizing the U.S. Financial Regulatory System. These areas were combined in our 2017 High-Risk report. See page 95 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. The Pension Benefit Guaranty Corporation (PBGC) is responsible for insuring the defined benefit pension plans for nearly 37 million American workers and retirees, who participate in about 24,800 private sector plans. PBGC faces an uncertain financial future due, in part, to a long- term decline in the number of traditional defined benefit plans and the collective financial risk of the many underfunded pension plans that PBGC insures. PBGC’s financial portfolio is one of the largest of all federal government corporations. While PBGC’s single employer program had a net surplus of about $2.4 billion at the end of fiscal year 2018, its multiemployer program had a net deficit of about $54 billion—or a combined net accumulated financial deficit of over $51 billion. Its deficit has increased by nearly 45 percent since fiscal year 2013. PBGC has estimated that, without additional funding, its multiemployer insurance program will likely be exhausted by 2025 as a result of current and projected pension plan insolvencies. The agency’s single-employer insurance program is also at risk due to the continuing decline of traditional defined benefit pension plans, as well as premiums that are not well aligned to the financial risk presented by the plans it insures. While Congress and PBGC have taken significant and positive steps to strengthen the agency in the past 5 years, challenges related to PBGC’s funding and governance structure remain. Congress established a temporary Joint Select Committee on multiemployer pension plans in 2018—with the goal of improving the solvency of the multiemployer program. However, the committee did not release draft legislation. Addressing the significant financial risk and governance challenges that PBGC faces will require additional congressional action. Over the years since we added PBGC to the High-Risk List, we have suggested a number of matters for congressional consideration, including: (1) authorizing a redesign of PBGC’s single employer program premium structure to better align premium rates with sponsor risk; (2) adopting additional changes to PBGC’s governance structure—in particular, expanding the composition of its board of directors; (3) strengthening funding requirements for plan sponsors as appropriate given national economic conditions; (4) working with PBGC to develop a strategy for funding PBGC claims over the long term as the defined benefit pension system continues to decline; and (5) enacting additional structural reforms to reinforce and stabilize the multiemployer system, and balance the needs and potential sacrifices of contributing employers, participants, and the federal government. Absent additional steps to improve PBGC’s finances, the long-term financial stability of the agency remains uncertain, and the retirement benefits of millions of American workers and retirees could be at risk of dramatic reductions. See page 267 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. VA operates one of the largest health care delivery systems in the nation through its Veterans Health Administration (VHA), with 172 medical centers and more than 1,000 outpatient facilities organized into regional networks. VA has faced a growing demand by veterans for its health care services—due, in part, to the needs of an aging veteran population—and that trend is expected to continue. The total number of veterans enrolled in VA’s health care system rose from 7.9 million to more than 9 million from fiscal year 2006 through fiscal year 2017. Over that same period, VHA’s total budgetary resources have more than doubled, from $37.8 billion in fiscal year 2006 to $92.3 billion in fiscal year 2017. Given the importance of VHA’s mission, coupled with its lack of progress in addressing its high-risk designation, we continue to be concerned about VHA’s ability to ensure its resources are being used effectively and efficiently to improve veterans’ timely access to safe and high-quality health care. We have identified five areas of concern: (1) ambiguous policies and inconsistent processes; (2) inadequate oversight and accountability; (3) IT challenges; (4) inadequate training for VA staff; and (5) unclear resource needs and allocation priorities. VHA has begun to address each of these areas but, prior to Secretary Robert Wilkie’s July 2018 confirmation, its efforts were impeded by leadership instability. Since taking office, Secretary Wilkie has demonstrated his commitment to addressing the department’s high-risk designation by, among other things, creating an office to direct an integrated, focused high-risk approach and communicating to VA leaders the importance of addressing our recommendations. While VHA completed root cause analyses for each area of concern and developed an action plan in response, the plan lacks milestones and metrics needed to effectively monitor its implementation and demonstrate progress made in addressing the high-risk designation. Additionally, many of VHA’s capacity-building initiatives are either in the initial stages of development or are lacking necessary funding and resources. As such, VHA has not made sufficient progress since our 2017 update to improve its overall ratings, as two high-risk criteria remain partially met and three criteria remain unmet. We remain concerned about VHA’s ability to oversee its programs, hold its workforce accountable, and avoid ambiguous policies and inconsistent processes that jeopardize its ability to provide safe, high-quality care to veterans: In November 2017, we reported that, due in part to misinterpretation or lack of awareness of VHA policy, VA medical center officials did not always document or conduct timely required reviews of providers when allegations were made against them. As a result, we concluded that VA medical center officials may have lacked necessary information to reasonably ensure that their providers were competent to provide safe, high-quality care to veterans and to grant approvals about these providers’ privileges to perform specific clinical services at VA medical centers. We made four recommendations related to this and other findings, all of which remain open. In June 2018, we reported that VHA could not systematically monitor the timeliness of veterans’ access to Veterans Choice Program (VCP) care because it lacked complete, reliable data to do so. We also found that veterans, who were referred to the VCP for routine care because health care services were not available in a timely manner, could potentially wait for care up to 70 calendar days if the maximum amount of time allowed by VA processes is used. This wait time exceeds the statutory requirement that veterans receive VCP care within 30 days of the dates their VA health care providers indicated they should receive appointments, or if no such date existed, within 30 days of the veteran’s preferred date. We made 10 recommendations related to this and other findings, all of which remain open. Similarly, in July 2018, we reported that VA collected data related to employee misconduct and disciplinary actions, but data fragmentation and reliability issues impeded department-wide analysis of those data. Additionally, we found that VA did not consistently ensure that allegations of misconduct involving senior officials were reviewed according to its investigative standards or ensure these officials were held accountable. We made 16 recommendations related to this and other findings, all of which remain open. In November 2018, we reported that VHA’s suicide prevention media outreach activities declined in recent years due to leadership turnover and reorganization. Additionally, we found that VHA did not assign key leadership responsibilities or establish clear lines of reporting for its suicide prevention media outreach campaign, which hindered its ability to oversee the campaign. Consequently, we concluded that VHA may not be maximizing its reach with suicide prevention media content to veterans, especially those who are at-risk. This is inconsistent with VHA’s efforts to reduce veteran suicides, which is VA’s highest clinical priority. We made two recommendations related to this and other findings, both of which remain open. VA needs to further develop its capacity-building initiatives and establish metrics to monitor and measure its progress addressing the high-risk areas of concern. It is also important that our recommendations continue to be implemented. The department has implemented 209 of the 353 recommendations related to VA health care that we made from January 1, 2010 through December 2018, but more than 125 recommendations remain open as of December 2018. This includes 17 that are older than 3 years. In addition to addressing our recommendations, VA needs to make systemic change to department management and oversight in order to fully address the high-risk issues and improve the health care provided to our nation’s veterans. See page 275 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. Mission-critical skills gaps both within federal agencies and across the federal workforce impede the government from cost-effectively serving the public and achieving results. For example, the difficulties in recruiting and retaining skilled health care providers and human resource staff at VHA’s medical centers make it difficult to meet the health care needs of more than 9 million veterans. As a result, VHA’s 168 medical centers have large staffing shortages, including physicians, registered nurses, physician assistants, psychologists, physical therapists, as well as human resource specialists and assistants. OPM continues to demonstrate top leadership commitment through its numerous efforts to assist agencies’ in addressing mission-critical skills gaps within their workforces. This includes providing guidance, training and on-going support for agencies on the use of comprehensive data analytic methods for identifying skills gaps and the development of strategies to address these gaps. However, since we first added strategic human capital management to our High-Risk List in 2001, we have reported on the need for agencies to address their workforce skills gaps. As of December 2018, OPM had not fully implemented 29 of our recommendations made since 2012 relating to this high-risk area. Staffing shortages and the lack of skills among current staff not only affect individual agencies but also cut across the entire federal workforce in areas such as cybersecurity and acquisition management. Skills gaps caused by insufficient number of staff, inadequate workforce planning, and a lack of training in critical skills are contributing to our designating other areas as high-risk. As table 5 shows, of the 34 other high-risk areas covered in this report, skills gaps played a significant role in 16 of the areas. Over the years since we added this area to our High-Risk List, in addition to recommendations to address critical skills gaps in individual high-risk areas, we have made numerous recommendations to OPM related to this high-risk issue, 29 of which remain open. Agencies also need to take action to address mission-critical skills gaps within their own workforces – a root cause of many high-risk areas. See page 75 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. The 2010 Census was the costliest in history at about $12.3 billion; as of October 2017, the 2020 Census is projected to cost about $15.6 billion, a 27 percent increase. For the 2020 Census, the U.S. Census Bureau (Bureau) plans to implement several innovations, including new IT systems. Implementing these innovations, along with other challenges, puts the Bureau’s ability to conduct a cost-effective census at risk. The decennial census is mandated by the U.S. Constitution and provides vital data for the nation. Census data are used, among other purposes, to apportion seats in the Congress and allocate billions of dollars in federal assistance to state and local governments. To ensure its success, this complicated and costly undertaking requires careful planning, risk management, and oversight. Census activities, some of which are new for the 2020 cycle, must be carried out on schedule to deliver the state apportionment counts to the President by December 31, 2020. The Bureau and the Department of Commerce (Commerce) have strengthened leadership commitment with executive-level oversight of the 2020 Census by holding regular meetings on the status of IT systems and other risk areas. In addition, in 2017 Commerce designated a team to assist senior Bureau management with cost estimation challenges. These examples demonstrate both the Bureau’s and Commerce’s strong leadership commitment to implementing the 2020 Census. One of the Bureau’s major challenges is to control any further cost growth and develop cost estimates that are reliable and reflect best practices for the 2020 Census. According to the Bureau, the total cost of the 2020 Census is now estimated to be approximately $15.6 billion, more than $3 billion higher than previously estimated by the Bureau. The higher estimated life-cycle cost is due, in part, to the Bureau’s failure to previously include all cost associated with the decennial census. The Bureau’s schedule for developing IT systems has experienced delays that have compressed the time available for system testing, integration testing, and security assessments. These schedule delays have contributed to systems experiencing problems after deployment, as well as cybersecurity challenges. For example, as of December 2018, the Bureau had identified nearly 1,100 system security weaknesses that needed to be addressed. Continued schedule management challenges may compress the time available for the remaining system testing and security assessments, and increase the risk that deployed systems will either not function as intended, have security vulnerabilities, or both. As of January 2019, 30 of our recommendations related to this high-risk area had not been implemented. To make continued progress, the Bureau needs to ensure that its approach to strategic planning, IT management, cybersecurity, human capital management, internal collaboration, knowledge sharing, as well as risk and change management are all aligned toward delivering more cost-effective outcomes. Among other things, the Bureau needs to ensure cost growth is controlled and that the development and testing of key systems is completed and fully integrated with all census operations before the 2020 Census. In addition, the Bureau needs to address cybersecurity weaknesses in a timely manner and ensure that security risks are at an acceptable level before systems are deployed. See page 134 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. An improper payment is any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. Reducing improper payments—such as payments to ineligible recipients or duplicate payments—is critical to safeguarding federal funds. However, the federal government has consistently been unable to determine the full extent of improper payments and reasonably assure that appropriate actions are taken to reduce them. Since 2003—when certain agencies were required by statute to begin reporting improper payments—cumulative improper payment estimates have totaled about $1.5 trillion. As shown in figure 4, for fiscal year 2018, federal entities estimated about $151 billion in improper payments. Medicare and Medicaid improper payments and the Earned Income Tax Credit (EITC) improper payments—a part of the Enforcement of Tax Laws high-risk area—accounted for about 68.5 percent of this total. Federal spending for Medicare programs and Medicaid is expected to significantly increase in the coming years, so it is especially critical to take appropriate measures to reduce improper payments in these programs. Internal Revenue Service estimates also show that the EITC has consistently had a high improper payment rate. OMB has designated Medicare programs, Medicaid, and EITC as high-priority programs for improper payments, indicating they are amongst the highest-risk programs where the government can achieve the greatest return on investment for the taxpayer by ensuring that improper payments are eliminated. Our work has identified a number of strategic and specific actions agencies can take to reduce improper payments, which could yield significant savings, and help ensure that taxpayer funds are adequately safeguarded. Continued agency attention is needed to (1) identify susceptible programs, (2) develop reliable methodologies for estimating improper payments, (3) report as required by statute, and (4) implement effective corrective actions based on root cause analysis. Absent such continued efforts, the federal government cannot be assured that taxpayer funds are adequately safeguarded. See pages 241, 250, and 235 of the report (respectively) for additional detail on the Medicare Program & Improper Payments, Strengthening Medicaid Program Integrity, and Enforcement of Tax Laws high-risk areas, including more details on actions that need to be taken. The Internal Revenue Service (IRS) continues to face two pressing challenges in enforcing tax laws: addressing the tax gap—amounting to hundreds of billions of dollars each year when some taxpayers fail to pay the taxes that they owe—and combatting identity theft (IDT) refund fraud. Enforcement of Tax Laws has been on GAO’s high risk list since 1990. IRS enforcement of tax laws helps fund the U.S. government by collecting revenue from noncompliant taxpayers and, perhaps more importantly, promoting voluntary compliance by giving taxpayers confidence that others are paying their fair share. In 2016, IRS estimated that the average annual net tax gap, the difference between taxes owed and taxes paid on time, was $406 billion, on average, for tax years 2008-2010. While IRS continues to demonstrate top leadership support to address the tax gap, IRS’s capacity to implement new initiatives and improve ongoing enforcement and taxpayer service programs remains a challenge. For example, IRS’s strategic plan includes a goal to facilitate voluntary compliance and deter noncompliance that could address the tax gap. However, IRS could do more to identify specific efforts for improving compliance in its strategic plan, measure the effects of compliance programs—such as those used for large partnerships—and develop specific quantitative goals to reduce the tax gap. Such efforts would help IRS make more effective use of its resources and gauge the success of its strategies. The second challenge facing IRS is IDT refund fraud, which occurs when an identity thief files a fraudulent tax return using a legitimate taxpayer’s identifying information and claims a refund. IRS estimates that at least $12.2 billion in individual IDT tax refund fraud was attempted in 2016, of which it prevented at least $10.5 billion (86 percent). Of the amount attempted, IRS estimated that at least $1.6 billion (14 percent) was paid. IRS’s ability to combat IDT fraud continues to be challenged as more personally identifiable information has become readily available as a result of large-scale cyberattacks on various entities. This makes it more difficult for IRS to distinguish between fraudsters and legitimate taxpayers. While IRS has demonstrated some progress by developing tools and programs to further detect and prevent IDT refund fraud, it has not completed updating its authentication procedures to be in compliance with new government standards. As a result, IRS may be missing an opportunity to implement the most secure, robust technologies to protect taxpayers. As of December 2018, 189 GAO recommendations related to this high- risk area had not been implemented. To make continued progress on closing the tax gap, IRS needs to re-establish goals for improving voluntary compliance and develop and document a strategy that outlines how it will use its data to help address this issue. Reducing the tax gap will also require targeted legislative actions, including additional third- party information reporting, enhanced electronic filing, expanded math error authority (also referred to as correctible error authority), and paid preparer regulation. To help stay on top of IDT refund fraud, IRS should develop a comprehensive process to evaluate alternative options for improving taxpayer authentication. Given that IDT refund fraud continues to be a challenge, targeted legislative action, such as requiring a scannable code on returns prepared electronically but filed on paper could help IRS address such fraud. See page 235 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. The federal government currently invests more than $90 billion annually in IT, and OMB has implemented several key initiatives intended to help better manage this investment. Additionally, enactment of FITARA, in conjunction with greater attention paid to the acquisition and operation of IT, has helped further improve the government-wide management of this significant annual investment. OMB’s current level of top leadership support and commitment to ensure that agencies successfully execute its guidance on implementing FITARA and related IT initiatives has helped this high-risk area meet the leadership commitment high-risk criteria. Additional positive government-wide actions have enabled this high-risk area to partially meet the four remaining high-risk criteria. For example, OMB has established an IT Dashboard—a public website that provides detailed information on major IT investments at 26 federal agencies—and agencies’ data center consolidation efforts have resulted in a total savings of slightly more than 80 percent of the agencies’ planned $5.7 billion in savings since 2011. However, major federal agencies have yet to fully address the requirements of FITARA and realize billions of dollars in planned or possible savings and improved government performance through more efficient budgeting and management of IT. As government-wide spending on IT increases every year, the need for appropriate stewardship of that investment increases as well. However, OMB and federal agencies have not made significant progress since 2017 in taking the steps needed to improve how these financial resources are budgeted and utilized. While OMB has continued to demonstrate its leadership commitment through guidance and sponsorship of key initiatives, agencies still have not fully implemented all requirements of FITARA, such as putting into place authorities the law requires for chief information officers (CIO). Additionally, while the President’s Management Agenda has a goal to improve IT spending transparency, agencies are underreporting IT contract obligations by billions of dollars. OMB and the agencies also have not yet implemented hundreds of our recommendations on improving shortcomings in IT acquisitions and operations. In an August 2018 review of the 24 federal agencies covered by FITARA, none had IT management policies that fully addressed the role of their CIOs consistent with federal laws and guidance. Specifically, the majority of the agencies only minimally addressed, or did not address, their CIO’s role in assessing agency IT workforce needs and developing strategies and plans for meeting those needs. Correspondingly, the majority of the 24 CIOs acknowledged that they were not fully effective at implementing IT management responsibilities, such as IT strategic planning and investment management. Further, in January 2018, we reported that the majority of 22 agencies did not identify all of their IT acquisition contracts, totaling about $4.5 billion in IT-related contract obligations beyond those reported by agencies. In addition, in November 2018 we reported that four selected agencies lacked quality assurance processes for ensuring that billions of dollars requested in their IT budgets were informed by reliable cost information. Until agencies properly identify IT contracts and establish processes for ensuring the quality of cost data used to inform their budgets, agency CIOs are at risk of not having appropriate oversight of IT acquisitions and may lack adequate transparency into IT spending to make informed budget decisions. As of December 2018, OMB and federal agencies had fully implemented only 59 percent of the recommendations we have made since fiscal year 2010 to address shortcomings in IT acquisitions and operations. OMB and agencies should work toward implementing our remaining 456 open recommendations related to this high-risk area. These remaining recommendations include 12 priority recommendations to agencies to, among other things, report all data center consolidation cost savings to OMB, plan to modernize or replace obsolete systems as needed, and improve their implementation of PortfolioStat—an initiative that is to consolidate and eliminate duplicative systems. OMB and agencies need to take additional actions to (1) implement at least 80 percent of our open recommendations related to the management of IT acquisitions and operations, (2) ensure that a minimum of 80 percent of the government’s major IT acquisitions deliver functionality every 12 months, and (3) achieve at least 80 percent of the over $6 billion in planned PortfolioStat savings. See page 123 of the report for additional detail on this high-risk area, including more details on actions that need to be taken. Our high-risk program continues to be a top priority at GAO and we will maintain our emphasis on identifying high-risk issues across government and on providing recommendations and sustained attention to help address them, by working collaboratively with Congress, agency leaders, and OMB. As part of this effort, we hope to continue to participate in regular meetings with the OMB Deputy Director for Management and with top agency leaders to discuss progress in addressing high-risk areas. Such efforts have been critical for the progress that has been made. This high-risk update is intended to help inform the oversight agenda for the 116th Congress and to guide efforts of the administration and agencies to improve government performance and reduce waste and risks. Thank you, Chairman Johnson, Ranking Member Peters, and Members of the Committee. This concludes my testimony. I would be pleased to answer any questions. For further information on this testimony, please contact J. Christopher Mihm at (202) 512-6806 or MihmJ@gao.gov. Contact points for the individual high-risk areas are listed in the report and on our high-risk website. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. The following pages provide summaries of selected high-risk areas. These summaries are included in our High-Risk Report and are also available on our High-Risk List website, http://www.gao.gov/highrisk/overview. Embassy Construction: Pace is Slower Than Projected, and State Could Make Program Improvements. GAO-18-653. Washington, D.C.: September 25, 2018. Tax Administration: Opportunities Exist to Improve Monitoring and Transparency of Appeal Resolution Timeliness. GAO-18-659. Washington, D.C.: September 21, 2018. Information Technology: IRS Needs to Take Actions to Address Significant Risks to Tax Processing. GAO-18-298. Washington, D.C.: June 28, 2018. Cybersecurity Workforce: Agencies Need to Improve Baseline Assessments and Procedures for Coding Positions. GAO-18-466. Washington, D.C.: June 14, 2018. Defense Acquisition Workforce: Opportunities Exist to Improve Practices for Developing Program Managers. GAO-18-217. Washington, D.C.: February 15, 2018. Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements. GAO-18-175. Washington, D.C.: February 6, 2018. Bureau of Prisons: Better Planning and Evaluation Could Help Ensure Effective Use of Retention Incentives. GAO-18-147. Washington, D.C.: December 7, 2017. National Weather Service: Actions Have Been Taken to Fill Increasing Vacancies, but Opportunities Exist to Improve and Evaluate Hiring. GAO-17-364. Washington, D.C.: May 24, 2017. Strategic Human Capital Management: NRC Could Better Manage the Size and Composition of Its Workforce by Further Incorporating Leading Practices. GAO-17-233. Washington, D.C.: April 27, 2017. Veterans Health Administration: Actions Needed to Better Recruit and Retain Clinical and Administrative Staff. GAO-17-475T. Washington, D.C.: March 22, 2017. The ratings for capacity and action plan improved since our 2017 High-Risk Report and the remaining three criteria remain unchanged. Leadership commitment: met. OMB and GSA continue to take action to reduce costly leasing. For example, OMB proposed the creation of a capital revolving fund designed to facilitate ownership over operating leases for large-dollar buildings, although no action has been taken to implement it. An OMB staff member said that the legislative proposal to establish a capital fund was similar to an option we identified in a 2014 report. Additionally, GSA has developed a strategy to reduce leasing costs by a projected $4.7 billion by fiscal year 2023, through steps that include focusing resources on high-value lease renewals. Capacity: partially met. GSA made improvements and now partially meets the capacity criterion. Specifically, GSA implemented our September 2013 recommendation to develop a strategy to increase ownership investments for a prioritized list of high-value leases. These leases are for properties where it would be less expensive in the long run to own. GSA plans to purchase at least one leased building in 2019. In addition, as noted in our 2017 high-risk update, GSA could potentially help tenant agencies save millions of dollars from some leases by loaning them funds to improve newly leased spaces instead of agencies financing these costs with private-sector owners at private-sector interest rates. While GSA officials agreed that doing so would save money in interest fees, it has not yet developed a legislative proposal to obtain the needed authority, as we recommended in 2016. Action plan: met. GSA has made improvements and now meets the action plan criterion. GSA created an action plan to purchase buildings when it is more cost-effective than leasing by establishing criteria to rank and prioritize leased spaces that would benefit from federal ownership as discussed above. Additionally, GSA is implementing strategies to better manage leases that include avoiding short-term extensions and identifying opportunities to enter into long-term and lower cost leases. Monitoring: partially met. GSA continues to partially meet this criterion through implementation of the National Strategy, as noted in our 2017 high-risk update. However, GSA should also implement our recommendations to reduce the costs to tenants by exploring strategies to enhance competition for GSA leases and reducing unneeded fees. Additionally, GSA has identified actions to better monitor leases at different points along the process in order to minimize the need to enter into short-term, costly lease extensions. Demonstrated progress: partially met. GSA has made some progress in reducing the long-term costs of leasing by stemming the growth in leasing according to GSA data and committing to further reducing leasing costs. However, GSA must follow through on its plans to purchase leased buildings and reduce costs. GSA could also further reduce costs by loaning tenant agencies the funds needed to improve newly leased spaces but still needs to develop a legislative proposal to obtain authority to do so. GSA should develop a legislative proposal to obtain authority to loan agencies funds needed to improve newly leased spaces, as we recommended in 2016. Ratings for one criterion improved since our 2017 High-Risk Report and the other four criteria remain unchanged. Leadership commitment: met. In December 2017, GSA continued efforts to improve data reliability by completing a major effort to make the Federal Real Property Profile (FRPP) public. Also, as we reported in our 2017 High-Risk Report, GSA issued its Federal Real Property Data Validation and Verification (V&V) Guidance in May 2016 and required agencies to address 13,257 data anomalies it found in fiscal year 2016 data. Capacity: met. OMB and GSA continue to help agencies’ increase their capacity to submit accurate data. For example, GSA revised certain data elements’ definitions in 2016 and incorporated them in the 2018 FRPP Data Dictionary. In addition, OMB and GSA have further increased the capacity of FRPP to act as a government-wide database since additional agencies are required to report. Action plan: met. GSA has made progress by developing an action plan in 2017 for federal agencies to develop processes to assess, address, and track FRPP data quality. Specifically, this plan identifies data elements to appropriately indicate data quality, identifies best practices and other methods that help agencies measure and assess improvements, and enables federal agencies to develop performance metrics. Monitoring: partially met. While GSA required agencies to research the anomalies it found in its V&V process, only some agencies have identified and committed to correct mistakes. Further, of the 13,257 anomalies GSA identified in the fiscal year 2016 data, agencies overall acknowledged that less than 8 percent of the anomalies (1,004 anomalies) represented erroneous data to be corrected, while indicating that the others were correct. Furthermore, some agencies acknowledged less than 1 percent of the anomalies represented erroneous data. In addition, we found in 2018 that DOD did not correct discrepancies identified by its own V&V process. Demonstrated progress: partially met. While GSA and some agencies have taken action to correct data, serious data reliability challenges remain with some individual agencies that undermine the reliability of the FRPP. In 2018, we found that DOD’s real property data continue to be inaccurate and incomplete, and that DOD lacks a plan for making the necessary improvements. OMB and GSA should continue working with federal agencies to improve the reliability of their real property data through V&V efforts and encouraging agencies to implement action plans to better assess, address, and track data quality, as discussed in the above action plan. In particular, DOD should take steps to ensure that DOD improves the reliability of its real property data, as we recommended in 2018. Ratings for this segment remain unchanged since our 2017 High-Risk Report. Leadership commitment: met. DHS’s Federal Protective Service (FPS) continues to take action to address our recommendations. The Interagency Security Committee (ISC), an organization chaired by DHS that sets standards for physical security for federal nonmilitary facilities, also continues to implement the updated Risk Management Process—a consolidated set of standards for physical security at federal facilities. In addition, in 2018, GSA, the Administrative Office of the U. S. Courts (AOUSC), the U.S. Marshals Service, and FPS implemented our 2017 recommendation to establish a national-level working forum for courthouse security, known as the Interagency Judicial Security Council. Capacity: partially met. FPS has taken several actions to address identified physical security issues since our 2017 High-Risk Report. For example, in 2018 FPS improved its risk assessment tool to incorporate all necessary elements recommended by the ISC, which has now certified it. In 2018, FPS also addressed our recommendation related to improving training for instructors and identified actions to address our recommendations associated with tracking guard training. Finally, in 2018, FPS also implemented several actions associated with our recommendation to develop human capital-related performance measures to evaluate progress towards agency goals. Some agencies may not have the capacity to conduct adequate risk assessments because their processes do not fully align with the ISC Risk Management Process. To improve their capacity, the U.S. Customs and Border Protection, Federal Aviation Administration, and the Department of Veterans’ Affairs still need to complete an assessment of their policies against the ISC’s standards in response to our 2017 and 2018 recommendations. Action plan: partially met. In September 2018, FPS and GSA signed a memorandum of agreement (MOA) clarifying their respective roles and responsibilities for federal facility security. However, FPS, GSA, and the Department of Justice have not yet addressed our 2011 recommendation to address a number of courthouse security challenges. Specifically, FPS, the U.S. Marshals Service, AOUSC, and GSA are still working to finalize the draft MOA on courthouse security. Monitoring: partially met. FPS continues to develop a system that will allow FPS to verify independently that FPS’s contract guards are current on all training and certification requirements, and are taking steps to close this recommendation as implemented. FPS expects that system to be in place in 2019. In 2018, we also found that actions were needed to better address various emerging security threats to federal facilities. Demonstrated progress: not met. The federal government has not demonstrated progress to improve physical security. Although agencies have taken some actions, time is needed for agencies to demonstrate the results of these actions. Additionally, agencies need to complete other actions. For example, once FPS, the U.S. Marshals Service, AOUSC, and GSA sign their MOA on courthouse security, they will be able to better protect federal facilities. Further, once FPS fully implements its guard management system and it interacts with its training system, FPS will be able to obtain information to assess its guards’ capability to address physical security risks across its portfolio. To improve the physical security of federal buildings, the following steps are necessary: Clarify roles and responsibilities for the protection of federal facilities by finalizing the MOA for federal courthouse security between GSA, FPS, the U.S. Marshals, and AOUSC, as we recommended in 2011. FPS must validate training information being entered to ensure that guards are getting critical training, as we recommended in 2012. Implement our recommendations for agencies to improve their monitoring of collaborative efforts to protect federal facilities, as we recommended in 2015. Take actions to better address emerging security threats to federal facilities, as we recommended in 2018. Federal Facility Security: Actions Needed to Better Address Various Emerging Threats. GAO-19-32SU. Washington, D.C.: October 17, 2018. Defense Real Property: DOD Needs to Take Additional Actions to Improve Management of Its Inventory Data. GAO-19-73. Washington, D.C.: November 13, 2018. Federal Buildings: More Consideration of Operations and Maintenance Costs Could Better Inform the Design Excellence Program. GAO-18-420. Washington, D.C.: May 22, 2018. Federal Real Property: Agencies Make Some Use of Telework in Space Planning but Need Additional Guidance. GAO-18-319. Washington, D.C.: March 22, 2018. Federal Buildings: Agencies Focus on Space Utilization As They Reduce Office and Warehouse Space. GAO-18-304. Washington, D.C.: March 8, 2018. VA Facility Security: Policy Review and Improved Oversight Strategy Needed. GAO-18-201. Washington, D.C.: January 11, 2018. Federal Facility Security: Selected Agencies Should Improve Methods for Assessing and Monitoring Risk. GAO-18-72. Washington, D.C.: October 26, 2017. Federal Real Property: GSA Should Inform Tenant Agencies When Leasing High-Security Space from Foreign Owners. GAO-17-195. Washington, D.C.: January 3, 2017. Postal Retiree Health Benefits: Unsustainable Finances Need to Be Addressed. GAO-18-602. Washington, D.C: August 31, 2018. U.S. Postal Service: Projected Capital Spending and Processes for Addressing Uncertainties and Risks. GAO-18-515. Washington, D.C.: June 28, 2018. International Mail: Information on Changes and Alternatives to the Terminal Dues System. GAO-18-112. Washington, D.C.: October 12, 2017. U.S. Postal Service: Key Considerations for Potential Changes to USPS’s Monopolies. GAO-17-543. Washington, D.C.: June 22, 2017. U.S. Postal Service: Key Considerations for Restoring Fiscal Sustainability. GAO-17-404T. Washington, D.C.: February 7, 2017. U.S. Postal Service: Continuing Financial Challenges and the Need for Postal Reform. GAO-16-651T. Washington, D.C.: May 11, 2016. U.S. Postal Service: Financial Challenges Continue. GAO-16-268T. Washington, D.C.: January 21, 2016. Information Technology: Departments Need to Improve Chief Information Officers’ Review and Approval of IT Budgets. GAO-19-49. Washington, D.C.: November 13, 2018. Federal Chief Information Officers: Critical Actions Needed to Address Shortcomings and Challenges in Implementing Responsibilities. GAO-18-93. Washington, D.C.: August 2, 2018. Data Center Optimization: Continued Agency Actions Needed to Meet Goals and Address Prior Recommendations. GAO-18-264. Washington, D.C.: May 23, 2018. Information Technology: Agencies Need to Involve Chief Information Officers in Reviewing Billions of Dollars in Acquisitions. GAO-18-42. Washington, D.C.: January 10, 2018. Information Technology: OMB Needs to Report On and Improve Its Oversight of the Highest Priority Programs. GAO-18-51. Washington, D.C.: November 21, 2017. Information Technology Reform: Agencies Need to Improve Certification of Incremental Development. GAO-18-148. Washington, D.C.: November 7, 2017. Data Center Optimization: Agencies Need to Address Challenges and Improve Progress to Achieve Cost Savings Goal. GAO-17-448. Washington, D.C.: August 15, 2017. Data Center Optimization: Agencies Need to Complete Plans to Address Inconsistencies in Reported Savings. GAO-17-388. Washington, D.C.: May 18, 2017. Information Technology: Opportunities for Improving Acquisitions and Operations. GAO-17-251SP. Washington, D.C.: April 11, 2017. 2020 Census: Additional Steps Needed to Finalize Readiness for Peak Field Operations, GAO-19-140. Washington, D.C.: December 10, 2018. 2020 Census: Continued Management Attention Needed to Address Challenges and Risks with Developing, Testing, and Securing IT Systems, GAO-18-655. Washington, D.C.: August 30, 2018. 2020 Census: Census Bureau Improved the Quality of Its Cost Estimation but Additional Steps Are Needed to Ensure Reliability, GAO-18-635. Washington, D.C.: August 17, 2018. 2020 Census: Bureau Has Made Progress with Its Scheduling, but Further Improvement Will Help Inform Management Decisions, GAO-18-589. Washington, D.C.: July 26, 2018. 2020 Census: Actions Needed to Address Challenges to Enumerating Hard-to-Count Groups, GAO-18-599. Washington, D.C.: July 26, 2018. 2020 Census: Actions Needed to Improve In-Field Address Canvassing Operation, GAO-18-414. Washington, D.C.: June 14, 2018. 2020 Census: Actions Needed to Mitigate Key Risks Jeopardizing a Cost- Effective and Secure Enumeration, GAO-18-543T. Washington, D.C.: May 8, 2018. 2020 Census: Continued Management Attention Needed to Mitigate Key Risks Jeopardizing a Cost-Effective and Secure Enumeration, GAO-18-416T. Washington, D.C.: April 18, 2018. 2020 Census: Actions Needed to Mitigate Key Risks Jeopardizing a Cost- Effective Enumeration, GAO-18-215T. Washington, D.C.: October 31, 2017. 2020 Census: Continued Management Attention Needed to Oversee Innovations, Develop and Secure IT Systems, and Improve Cost Estimation, GAO-18-141T. Washington, D.C.: October 12, 2017. 2020 Census: Bureau Is Taking Steps to Address Limitations of Administrative Records, GAO-17-664. Washington, D.C.: July 26, 2017. Personnel Security Clearances: Additional Actions Needed to Implement Key Reforms and Improve Timely Processing of Investigations. GAO-18- 431T. Washington, D.C.: March 7, 2018. Personnel Security Clearances: Additional Actions Needed to Ensure Quality, Address Timeliness, and Reduce Investigation Backlog. GAO-18- 29. Washington, D.C.: December 12, 2017. Personnel Security Clearances: Plans Needed to Fully Implement and Oversee Continuous Evaluation of Clearance Holders. GAO-18-117. Washington, D.C.: November 21, 2017. Information Security: OPM Has Improved Controls, but Further Efforts Are Needed. GAO-17-614. Washington, D.C: August 3, 2017. Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems. GAO-16-501. Washington, D.C.: May 18, 2016. Personnel Security Clearances: Funding Estimates and Government-wide Metrics Are Needed to Implement Long-Standing Reform Efforts. GAO- 15-179SU. Washington, D.C.: April 23, 2015. Information Security: OPM Has Implemented Many of GAO’s 80 Recommendations, but Over One-Third Remain Open. GAO-19-143R. Washington, D.C.: November 13, 2018. Cybersecurity: Office of Federal Student Aid Should Take Additional Steps to Oversee Non-School Partners’ Protection of Borrower Information. GAO-18-518. Washington, D.C.: September 17, 2018. High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation. GAO-18-622. Washington, D.C.: September 6, 2018. Information Security: IRS Needs to Rectify Control Deficiencies That Limit Its Effectiveness in Protecting Sensitive Financial and Taxpayer Data. GAO-18-391. Washington, D.C.: July 31, 2018. Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach. GAO-18-559. Washington, D.C.: August 30, 2018. High-Risk Series: Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation. GAO-18-645T. Washington, D.C.: July 25, 2018. Information Security: Supply Chain Risks Affecting Federal Agencies. GAO-18-667T. Washington, D.C.: July 12, 2018. Electronic Health Information: CMS Oversight of Medicare Beneficiary Data Security Needs Improvement. GAO-18-210. Washington, D.C.: March 6, 2018. Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption. GAO-18-211. Washington, D.C.: February 15, 2018. Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements. GAO-18-175. Washington, D.C.: February 6, 2018. DHS Acquisitions: Additional Practices Could Help Components Better Develop Operational Requirements. GAO-18-550 Washington, D.C.: August 8, 2018. Homeland Security Acquisitions: Leveraging Programs’ Results Could Further DHS’s Progress to Improve Portfolio Management. GAO-18-339SP Washington, D.C.: May 17, 2018. Cybersecurity Workforce: Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements. GAO-18-175, Washington, D.C.: February 6, 2018. DHS Financial Management: Better Use of Best Practices Could Help Manage System Modernization Project Risks. GAO-17-799 Washington, D.C.: September 26, 2017. Homeland Security: Progress Made to Implement IT Reform, but Additional Chief Information Officer Involvement Needed. GAO-17-284 Washington, D.C.: May 18, 2017. Homeland Security Acquisitions: Identifying All Non-Major Acquisitions Would Advance Ongoing Efforts to Improve Management. GAO-17-396 Washington, D.C.: April 13, 2017. Homeland Security Acquisitions: Earlier Requirements Definition and Clear Documentation of Key Decisions Could Facilitate Ongoing Progress. GAO-17-346SP Washington, D.C.: April 6, 2017. Error! No text of specified style in document. The following pages provide overviews of the two areas removed from the High-Risk List. Each overview discusses (1) why the area was high risk, and (2) why the area is being removed from the list. Each of these high- risk areas is also described on our High-Risk List website, http://www.gao.gov/highrisk/overview. Since our 2017 High-Risk Report, DOD has continued to meet the criteria of leadership commitment, capacity, and action plan for asset visibility. Further, DOD has fully addressed the three remaining actions and outcomes we outlined in 2017 in order to mitigate or resolve long-standing weaknesses in asset visibility. Consequently, DOD has met the monitoring and demonstrated progress criteria for asset visibility to remove this area from our High-Risk List. Leadership commitment: met. Senior leaders have continued to demonstrate commitment through their involvement in groups such as the Supply Chain Executive Steering Committee—senior-level officials responsible for overseeing asset visibility improvement efforts—and through the Asset Visibility Working Group, which identifies opportunities for improvement and monitors the implementation of initiatives by issuing its Strategy for Improving DOD Asset Visibility (Strategy) in 2014, 2015, and 2017. Capacity: met. DOD continues to demonstrate that it has the capacity— personnel and resources—to improve asset visibility. For example, DOD’s 2015 and 2017 Strategies advise the components to consider items such as staffing, materiel, and sustainment costs when documenting cost estimates for the initiatives in the Strategy, as we recommended in January 2015. Action plan: met. A provision in the National Defense Authorization Act for Fiscal Year 2014 required DOD to submit to Congress a comprehensive strategy and implementation plans for improving asset tracking and in-transit visibility. In January 2014, DOD issued the Strategy and accompanying implementation plans, which outlined initiatives intended to improve asset visibility. DOD updated its 2014 Strategy in October 2015 and in August 2017. Importantly, since 2017 DOD addressed the three remaining actions and outcomes related to the monitoring and demonstrated progress criteria through updates to and implementation of the Strategies (see table 7). Monitoring: met. DOD provided guidance in its 2017 update to the Strategy for the military components to consider key attributes of successful performance measures during metric development for their improvement initiatives. As appropriate, the military components have followed the guidance and provided high-level summary metrics updates to the Asset Visibility Working Group. In addition, DOD has taken steps to monitor asset visibility by incorporating into after-action reports, as appropriate, information relating to performance measures. These after- action reports serve as closure documents and permanent records of each initiative’s accomplishments. Demonstrated progress: met. DOD has demonstrated sustained progress by completing 34 of the 39 initiatives to improve asset visibility and continues to monitor the remaining 5 initiatives. These initiatives have supported DOD’s goals and objectives, which include: (1) improving visibility efficiencies of physical inventories, receipt processing, cargo tracking, and unit moves; (2) ensuring asset visibility data are discoverable, accessible, and understandable to support informed decision-making across the enterprise; and (3) increasing efficiencies for delivery accuracy and cycle times. Also, the Asset Visibility Working Group meets regularly to identify opportunities to further improve asset visibility within DOD. DOD has taken the following actions to demonstrate sustained progress: (1) created an integrated single portal system providing 7,500 users access to near-real-time, in-transit visibility of eight million lines of items of supply and transportation data; and (2) increased its visibility of assets through radio-frequency identification (RFID), an automated data-capture technology that can be used to electronically identify, track, and store information contained on a tag. There are two main types of RFID tags, passive and active, which show whether assets are in-storage, in-transit, in-process, or in-use. Passive tags, such as mass transit passes, do not contain their own power source and cannot initiate communication with a reader; while active tags, such as an “E-Z pass,” contain a power source and a transmitter, and send a continuous signal over longer distances. DOD closed nine initiatives from its Strategies by implementing RFID technology. For example, the Marine Corps implemented long-range passive RFID for visibility and accountability of items, resulting in improvements that include an increased range for “reading” an item— from 30 feet to 240 feet—and reduced inventory cycle times from 12 days to 10 hours. Also, the Navy reported that the use of passive RFID technology to support the overhaul of its nuclear-powered attack submarines enabled the Navy to better track parts, resulting in 98 percent fewer missing components and an average cost avoidance of $1.3 million per boat. Additionally, according to DOD, the use of RFID tags to provide visibility of sustainment cargo at the tactical leg resulted in $1.4 million annual cost savings. Further, DOD reported that the migration of the active RFID enterprise from a proprietary communication standard to a competitive multivendor environment reduced the cost of active RFID tags by half, resulting in an estimated $5.7 million annual reduction in costs. Since our 2017 High-Risk Report, DOD has continued to meet the criteria of leadership commitment, capacity, and action plan for materiel distribution. Further, DOD has fully addressed the four remaining actions and outcomes we outlined in 2017 in order to mitigate or resolve long-standing weaknesses in materiel distribution. Consequently, DOD has met the monitoring and demonstrated progress criteria for materiel distribution to remove this area from our High-Risk List. Leadership commitment: met. Senior leaders continue to demonstrate commitment through their involvement in groups such as the Supply Chain Executive Steering Committee—senior-level officials responsible for overseeing materiel distribution corrective actions—and through the Distribution Working Group, which helped develop the Materiel Distribution Improvement Plan (Improvement Plan) in 2016. Capacity: met. DOD has continued to demonstrate that it has the personnel and resources, such as key organizations and the associated governance structure, to improve materiel distribution. The Improvement Plan recognizes that additional resources will be required to accomplish its corrective actions and close any identified performance gaps within the time frame specified. Action plan: met. In 2016, DOD developed its corrective action plan to address the department’s materiel distribution challenges. The Improvement Plan details specific goals and actions to better measure the end-to-end distribution process, ensure the accuracy of underlying data, and strengthen and integrate distribution policies and the governance structure. Importantly, since 2017, DOD has fully addressed the four remaining actions and outcomes related to monitoring and demonstrated progress to mitigate or resolve long-standing weaknesses in materiel distribution (see table 8). Monitoring: met. DOD has monitored materiel distribution by making progress in developing its suite of distribution performance metrics, improving the quality of their underlying data, and sharing metrics information with stakeholders. For example, in January 2017, DOD developed a suite of performance metrics that provides a comprehensive picture of the distribution process, including whether supplies are delivered on time and at sufficient quantity and quality. Also, DOD implemented checklists to assess the quality of data underlying each performance metric based on relevance, accuracy, comparability, and interpretability. The checklists and their standards assist in identifying root causes and addressing areas where performance data quality may be lacking. DOD has also incorporated internal control requirements in its supply chain management guidance to increase confidence in the performance data. Additionally, DOD has revised its policy documents to require stakeholders to routinely capture and share distribution performance metrics, including cost data, and the department maintains websites to provide current performance information to distribution stakeholders. DOD has also incorporated distribution metrics, as appropriate, on the performance of all legs of the distribution system, including the tactical leg (i.e., the last segment of the distribution system). We previously reported on DOD’s deficiencies to accurately assess its distribution performance at the tactical leg, such as missing delivery dates for shipments in Afghanistan. Since that time, the geographic combatant commands have been tracking metrics at the tactical leg, including required delivery dates, to determine the movement and causes of delays for shipments, and have been sharing distribution performance information with the U.S. Transportation Command (TRANSCOM) through their deployment and distribution operations centers. DOD is implementing a cost framework to incorporate transportation costs for all legs of the distribution system, which will provide an additional metric for distribution stakeholders to assess the efficiency of the system. The first phase of the cost framework began operating in August 2018 and is expected to be fully implemented in 2019. DOD is making progress in refining its Improvement Plan and is incorporating additional actions based on interim progress and results. Since DOD issued the Improvement Plan in September 2016, the agency has (1) documented the results and monitored the status of each corrective action, (2) revised completion dates as needed, and (3) periodically provided decision makers with summary action charts, plans, and milestones. DOD is also updating its instruction on management and oversight of the distribution enterprise to clarify the roles and responsibilities of all distribution stakeholders. DOD officials have not determined a date for when this instruction will be issued. Demonstrated progress: met. DOD has demonstrated sustained progress in improving its capability to comprehensively measure distribution performance, identify distribution problems and root causes, and implement solutions. DOD has implemented 10 of 18 corrective actions in its Improvement Plan and is on track to implement the remaining 8 by September 2019. Because of this progress, DOD’s monthly shipment reports have assessed performance against enhanced metrics across the distribution system. For example, in December 2017, TRANSCOM investigated performance standards for truck deliveries from its Defense Logistics Agency warehouses in Bahrain to customers in Kuwait due to frequent delays in shipments. TRANSCOM determined that inadequate time for clearing customs in Kuwait resulted in an unrealistic delivery standard. TRANSCOM, in coordination with distribution stakeholders, adjusted the delivery standard to adequately account for the in-theater customs process. In addition, TRANSCOM, in partnership with the Defense Logistics Agency and the General Services Administration, developed and implemented initiatives focused on distribution process and operational improvements to reduce costs and improve distribution services to the warfighter. According to DOD, these efforts have resulted in at least $1.56 billion in distribution cost avoidances to date. DOD has demonstrated commendable, sustained progress improving its supply chain management. This does not mean DOD has addressed all risk within this area. It remains imperative that senior leaders continue their efforts to implement initiatives and corrective actions to maintain visibility of supplies, track cargo movements, meet delivery standards, and maintain delivery data for shipments. Continued oversight and attention are also warranted given the recent reorganization of the Office of the Under Secretary of Defense for Acquisition and Sustainment and the resulting change in the oversight structure of Supply Chain Management. We will therefore continue to conduct oversight of supply chain management at DOD. Defense Logistics: Improved Performance Measures and Information Needed for Assessing Asset Visibility Initiatives. GAO-17-183. Washington, D.C.: Mar. 16, 2017. Defense Logistics: DOD Has Addressed Most Reporting Requirements and Continues to Refine its Asset Visibility Strategy. GAO-16-88. Washington, D.C.: Dec. 22, 2015. Defense Logistics: Improvements Needed to Accurately Assess the Performance of DOD’s Materiel Distribution Pipeline. GAO-15-226. Washington, D.C.: Feb. 26, 2015. Since our last high-risk update in 2017, NOAA continues to meet the criteria of leadership commitment, capacity, and monitoring and now also meets the criteria of action plan and demonstrated progress. Leadership commitment: met. NOAA program officials met the leadership commitment criteria in 2015 and have continued to sustain their strong leadership commitment to mitigating potential satellite data gaps since that time. For example, NOAA issued and frequently updated its polar satellite gap mitigation plan, which identifies the specific technical, programmatic, and management steps the agency is taking to ensure that satellite mitigation options are viable. In addition, NOAA executives continue to oversee the acquisition of polar-orbiting satellites through monthly briefings on the cost, schedule, and risks affecting the satellites’ development. Capacity: met. NOAA continues to meet the criterion of improving its capacity to address the risk of a satellite data gap. In December 2014, we recommended that NOAA investigate ways to prioritize the gap mitigation projects with the greatest potential benefit to weather forecasting, such as by improving its high-performance computing capacity. NOAA agreed with this recommendation and implemented it. For example, NOAA upgraded its high-performance computers, which allowed the agency to move forward on multiple other mitigation activities, including experimenting with other data sources and assimilating these data into its weather models. and impacts, and (4) establishing a schedule with meaningful timelines and linkages among mitigation activities. The agency agreed with the recommendation and subsequently addressed it. Specifically, NOAA issued three updates to its gap mitigation plan between January 2016 and February 2017. With the last of the updates, the agency addressed the shortfalls we had identified. Monitoring: met. NOAA met this criterion in 2017, and continues to meet it now, by implementing our recommendations to more consistently and comprehensively monitor its progress on gap mitigation activities. For example, all three NOAA organizations responsible for gap mitigation projects regularly brief senior management on their progress. Demonstrated progress: met. NOAA now meets the criterion for demonstrated progress, which is an increase over its prior rating. In our 2017 High-Risk Report, we noted that NOAA had identified 35 different gap mitigation projects and was making progress in implementing them. These projects fell into three general categories: (1) understanding the likelihood and impact of a gap, (2) reducing the likelihood of a gap, and (3) reducing the impact of a gap. Nevertheless, one of the most important steps in reducing the likelihood of a gap—keeping the launch of the next polar satellite on schedule—had encountered problems. Specifically, agency officials decided to delay the launch due to challenges in developing the ground system and a critical instrument on the spacecraft. This delay exacerbated the probability of a satellite data gap. More recently, however, NOAA was able to demonstrate progress by successfully launching the satellite in November 2017. That satellite, now called NOAA-20, is currently operational and is being used to provide advanced weather data and forecasts. Moreover, the agency is also working to build and launch the next satellites in the polar satellite program. Since our last high-risk update in 2017, DOD now meets all five high-risk criteria. Fiscal Year 2015 (NDAA for FY 2015), the National Defense Authorization Act for Fiscal Year 2016 (NDAA for FY 2016), and the Consolidated Appropriations Act, 2016, DOD leadership committed to developing and implementing plans to address its weather satellite requirements. For example, in late 2017, the department awarded a contract for its Weather System Follow-on—Microwave satellite to fulfill core weather requirements. Capacity: met. With strong congressional oversight, DOD now meets the capacity criterion. Specifically, the NDAA for FY 2015 restricted the availability of 50 percent of the FY 2015 funds authorized for the Weather Satellite Follow-on System (now called the Weather System Follow-on— Microwave satellite program) until DOD submitted to the congressional defense committees a plan to meet weather monitoring data collection requirements. In addition, the explanatory statement that accompanied the Consolidated Appropriations Act, 2016, recommended that the Air Force focus on ensuring that the next generation of weather satellites meet the full spectrum of requirements and work with civil stakeholders to leverage appropriate civil or international weather assets. As called for in the law and the explanatory statement, DOD established plans to meet weather monitoring data collection needs, including by acquiring satellites as part of a family of systems to replace its aging legacy weather satellites. Additionally, DOD formally coordinated with NOAA on weather monitoring data collection efforts. In January 2017, the Air Force and NOAA signed a memorandum of agreement, and in November 2017, signed an annex to that agreement, to allow for the exchange of information and collaboration on a plan for collecting weather monitoring data. The Air Force and NOAA are now developing plans to relocate a residual NOAA satellite over the Indian Ocean, an area of concern for cloud characterization and area-specific weather imagery coverage. requirements. Under this program, the department may launch a demonstration satellite in 2021 and plans to launch an operational satellite in 2022. DOD also developed plans for providing its two highest-priority capabilities—cloud characterization and area-specific weather imagery data collection—that will not be covered by the Weather System Follow- on–Microwave satellite program. The department is planning a longer- term solution, called the Electro-Optical/Infrared Weather Systems program, to meet these needs, with a planned satellite launch in 2024. Meanwhile, DOD is in the process of acquiring a small prototype satellite, called the Operationally Responsive Space-8 satellite, to provide interim capabilities. DOD plans to launch Operationally Responsive Space-8 as early as 2022. Monitoring: met. DOD now meets the monitoring criterion as evidenced by its actions to initiate a major acquisition program, the Weather System Follow-on–Microwave, and award a contract for the first satellite. In addition, program officials stated that they plan to monitor the program’s progress toward addressing critical needs and assess its operations and sustainment costs. Demonstrated progress: met. DOD now meets the demonstrated progress criterion because it has developed plans and taken actions to address gaps in weather data through its plans to launch the Weather System Follow-on–Microwave satellite in 2022. The department also plans to launch the Electro-Optical/Infrared Weather Systems satellite in 2024 and provide interim capabilities beginning as early as 2022. By developing these plans, DOD has reduced the risk of a gap in weather satellite data and addressed the concerns about a lack of planning that we identified in our 2017 High-Risk Report. DOD’s effective implementation of its plans will be key to further reducing the risks of gaps in weather satellite data in the future. Moving forward, we will continue to monitor both NOAA and DOD efforts to develop and launch the next satellites in their respective weather satellite programs. NOAA plans to launch its next geostationary weather satellite in 2021 and to launch its next polar weather satellite in 2022. DOD plans satellite launches in 2021 (potentially), 2022, and 2024. In addition, we will continue to monitor DOD’s efforts to develop long-term plans to meet its weather satellite requirements. Weapon Systems Annual Assessment: Knowledge Gaps Pose Risks to Sustaining Recent Positive Trends. GAO-18-360SP. Washington, D.C.: Apr. 25, 2018. Satellite Acquisitions: Agencies May Recover a Limited Portion of Contract Value When Satellites Fail. GAO-17-490. Washington, D.C.: June 9, 2017. Defense Acquisitions: Assessments of Selected Weapon Programs. GAO-17-333SP. Washington, D.C.: Mar. 30, 2017. Defense Weather Satellites: DOD Faces Acquisition Challenges for Addressing Capability Needs. GAO-16-769T. Washington, D.C.: July 7, 2016. Polar Satellites: NOAA Faces Challenges and Uncertainties that Could Affect the Availability of Critical Weather Data. GAO-16-773T. Washington, D.C.: July 7, 2016. Polar Weather Satellites: NOAA Is Working to Ensure Continuity but Needs to Quickly Address Information Security Weaknesses and Future Program Uncertainties. GAO-16-359. Washington, D.C.: May 17, 2016. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The federal government is one of the world's largest and most complex entities; about $4.1 trillion in outlays in fiscal year 2018 funded a broad array of programs and operations. GAO's high-risk program identifies government operations with vulnerabilities to fraud, waste, abuse, and mismanagement, or in need of transformation to address economy, efficiency, or effectiveness challenges. This biennial update describes the status of high-risk areas, outlines actions that are still needed to assure further progress, and identifies two new high-risk areas needing attention by the executive branch and Congress. Solutions to high-risk problems save billions of dollars, improve service to the public, and would strengthen government performance and accountability. GAO uses five criteria to assess progress in addressing high-risk areas: (1) leadership commitment, (2) agency capacity, (3) an action plan, (4) monitoring efforts, and (5) demonstrated progress. The ratings for more than half of the 35 areas on the 2019 High-Risk List remain largely unchanged. Since GAO's last update in 2017, seven areas improved, three regressed, and two showed mixed progress by improving in some criteria but declining in others. Where there has been improvement in high-risk areas, congressional actions have been critical in spurring progress in addition to actions by executive agencies. GAO is removing two of the seven areas with improved ratings from the High-Risk List because they met all of GAO's five criteria for removal. The first area, Department of Defense (DOD) Supply Chain Management, made progress on seven actions and outcomes related to monitoring and demonstrated progress that GAO recommended for improving supply chain management. For example, DOD improved the visibility of physical inventories, receipt processing, cargo tracking, and unit moves. Improvements in asset visibility have saved millions of dollars and allow DOD to better meet mission needs by providing assets where and when needed. The second area, Mitigating Gaps in Weather Satellite Data, made significant progress in establishing and implementing plans to mitigate potential gaps. For example, the National Oceanic and Atmospheric Administration successfully launched a satellite, now called NOAA-20, in November 2017. NOAA-20 is operational and provides advanced weather data and forecasts. DOD developed plans and has taken actions to address gaps in weather data through its plans to launch the Weather System Follow-on–Microwave satellite in 2022. There are two new areas on the High-Risk List since 2017. Added in 2018 outside of GAO's biennial high-risk update cycle, the Government-Wide Personnel Security Clearance Process faces significant challenges related to processing clearances in a timely fashion, measuring investigation quality, and ensuring information technology security. The second area, added in 2019, is Department of Veterans Affairs (VA) Acquisition Management. VA has one of the most significant acquisition functions in the federal government, both in obligations and number of contract actions. GAO identified seven contracting challenges for VA, such as outdated acquisition regulations and policies, lack of an effective medical supplies procurement strategy, and inadequate acquisition training. Overall, 24 high-risk areas have either met or partially met all five criteria for removal from the list; 20 of these areas fully met at least one criterion. Ten high-risk areas have neither met nor partially met one or more criteria. While progress is needed across all high-risk areas, GAO has identified nine that need especially focused executive and congressional attention, including Ensuring the Cybersecurity of the Nation, Resolving the Federal Role in Housing Finance, addressing Pension Benefit Guaranty Corporation Insurance Programs, Managing Risks and Improving VA Health Care, and ensuring an effective 2020 Decennial Census. Beyond these specific areas, focused attention is needed to address mission-critical skills gaps in 16 high-risk areas, confront three high-risk areas concerning health care and tax law enforcement that include billions of dollars in improper payments each year, and focus on a yawning tax gap. This statement describes GAO's views on progress made and what remains to be done to bring about lasting solutions for each high-risk area. Substantial efforts are needed by the executive branch to achieve progress on high-risk areas. Addressing GAO's hundreds of open recommendations across the high-risk areas and continued congressional oversight and action are essential to achieving greater progress.