According to ATF and USMS policy, the Directors of ATF and USMS have the authority to develop various policies, procedures, and guidance that specify the steps the components must or should take while investigating and adjudicating employee misconduct. ATF and USMS can receive allegations of employee misconduct from a variety of sources, including agency staff, the general public, and the DOJ OIG. Allegations of employee misconduct can include, for example, not following procedures associated with managing government-issued property or not reporting time and attendance accurately. Employee misconduct can occur outside of the workplace as well, such as local arrests of employees for domestic violence or driving under the influence of alcohol. ATF and USMS each have an intake or hotline function that is to initially assess the reported information and seriousness of each allegation to determine the appropriate next step in terms of which group or office within their respective component will conduct an investigation, if warranted. The investigation process involves engaging in fact-finding to the extent necessary to make an informed decision on the merit of an allegation. In accordance with ATF and USMS policy, for each misconduct allegation received, the components’ investigative office (Internal Affairs) must provide the DOJ OIG with “right of first refusal.” This review allows the DOJ OIG to either open an investigation or send the allegation back to the component for action. If the DOJ OIG declines the opportunity to investigate, the components assign the case to Internal Affairs. Specifically: For ATF, cases that involve matters related to integrity are investigated by ATF Internal Affairs, while other cases are generally referred to ATF divisions to conduct inquiries (known as management referrals). USMS typically assigns higher-level (i.e., more egregious) misconduct cases to Internal Affairs. For cases typically considered to involve lower-level offenses, USMS managers in divisions or districts conduct inquiries or fact finding locally. Each component has policies, procedures, and guidance for its Internal Affairs and local management for investigating cases of employee misconduct. Based on the investigative findings, the responsible office for each component can make a preliminary determination of whether there is sufficient evidence to support an allegation. After investigations are completed, each component has an adjudication process whereby delegated officials propose discipline. For ATF, a headquarters entity—referred to as the Professional Review Board— proposes discipline for all cases investigated by ATF Internal Affairs. For cases involving misconduct by ATF employees outside of Internal Affairs jurisdiction, division management proposes and decides discipline. USMS utilizes various, delegated agency officials to propose and decide discipline depending on the type of investigation. Discipline for both ATF and USMS employees can range in severity, depending on the unique findings and circumstances of each investigation. For misconduct within USMS warranting a suspension of 14 days or less, local management proposes and decides discipline. For both ATF and USMS, during adjudication, proposing and deciding officials determine whether an allegation is substantiated or unsubstantiated when considering if an action is warranted. For substantiated cases that are determined to warrant action, components use their respective Table of Offenses and Penalties as a guide for disciplinary actions, which provides guidance for determining appropriate penalties. Each component is to provide employees with a letter of proposed discipline and an opportunity to respond before it makes a final decision on the discipline. After discipline is proposed and the employee’s response is considered, final discipline is determined by a delegated official (deciding official), distinct from the proposing official. In addition, delegated officials are to consider particular mitigating and aggravating factors on a case-by-case basis when determining the appropriate penalty for an act of employee misconduct. The relevant factors that are considered, as appropriate, in determining the severity of the discipline include, but are not limited to, the nature and seriousness of the offense and its relation to the employee’s duties, position, and responsibilities. This includes considering whether the offense was intentional or inadvertent, or was committed maliciously or for gain; the employee’s past disciplinary record; and whether the offense was frequently repeated. For both ATF and USMS, there are three categories of employee misconduct outcomes: Corrective/Non-disciplinary action. This is an administrative or non- disciplinary action, such as a letter of counseling or a letter of guidance and direction, that informs an employee about unacceptable performance or conduct that should be corrected or improved. Disciplinary action. This includes actions resulting in a letter of reprimand up to a suspension of 14 days or less. A letter of reprimand describes the unacceptable conduct that is the basis for a disciplinary action, and represents the least severe form of disciplinary action. Suspensions in this category involve the placement of an employee in a nonduty, non-pay status for up to and including 14 days. Adverse action. This involves a suspension of more than 14 days (including an indefinite suspension), demotion to a lower pay band or rate of pay, or removal (an involuntary separation from employment). According to the U.S. Merit Systems Protection Board, an indefinite suspension is appropriate when evidence exists to demonstrate misconduct of a serious nature, such as an employee has committed a crime for which a sentence of imprisonment can be imposed, when the agency has concerns that an employee’s medical condition makes the person’s presence in the workplace dangerous or inappropriate, or when an employee’s access to classified information has been suspended. Also, according to the board, a demotion is a reduction in grade or a reduction in pay, while a removal terminates the employment of an individual. Figure 1 provides an overview of ATF and USMS employee misconduct processes. ATF and USMS have case management systems that are designed to maintain employee misconduct data––such as the date of the alleged incident, source of the allegation, description of the alleged misconduct, and the status of the investigation. ATF’s Professional Review Board uses another system to manage outcome data associated with Internal Affairs investigations. After adjudication of ATF Internal Affairs investigations, the board is to provide this outcome data to ATF Internal Affairs for inclusion in its system. Similarly, after the adjudication of management referrals for action, ATF managers are to provide outcome data to ATF Internal Affairs to include in its system. In addition to the system USMS uses to manage Internal Affairs investigations, the agency has a separate system to record outcome data. Our analysis of ATF employee misconduct data found that ATF opened 1,581 employee misconduct investigations during fiscal years 2014 through 2018. As shown in table 1, the majority of ATF misconduct cases during this period were management referrals to divisions for informational purposes or for action. Table 2 shows that the most common allegation category of misconduct that ATF received from fiscal year 2014 through 2018 was job performance failure, representing 8 percent of all allegations, which includes not attending meetings, submitting reports of inspection late, or becoming agitated during performance feedback, among other things. After investigations are completed, results are forwarded to the Professional Review Board for adjudication, and adjudication results are to be entered into ATF’s Human Resources system. For investigations that were adjudicated during the period we reviewed, six types of offense categories made up about 60 percent of those substantiated and captured in the ATF Human Resources system, as shown in figure 2. The exercise of poor judgment (14 percent) and the failure to adequately secure government property (13 percent) were the most common offenses. The employee misconduct outcomes for offenses ranged from corrective actions (e.g., letters of counseling or caution) to adverse actions such as suspensions and removals. Specifically, of the 503 investigations that had final actions reported in ATF case management system, disciplinary action—suspensions of 15 days or less and letters of reprimand— accounted for 176 (about 35 percent) of the final outcomes. Also, 135 (about 27 percent) of investigations adjudicated resulted in corrective actions (cautions such as a verbal or written warning). Further, 87 (about 17 percent) of these 503 investigations and management referrals were closed for various reasons, such as insufficient evidence of an employee’s inappropriate behavior or clearance of the charges after investigation, while adverse actions represented 47 (about 9 percent) of these outcomes, as shown in figure 3. Our analysis of USMS employee misconduct data show that USMS opened 2,347 employee misconduct investigations during fiscal years 2014 through 2018 that were also closed at the time USMS responded to our request for information. As shown in table 3, USMS Internal Affairs investigated the majority of the component’s employee misconduct cases. As shown in table 4, the most common misconduct allegations for USMS were violations of the code of professional responsibility (21 percent), conduct unbecoming or discourteous behavior (13 percent), and failure to follow procedures (12 percent). As shown in figure 4, general misconduct while on duty and failure of staff to follow instructions were the most frequent offenses from fiscal years 2014 through 2018, representing 383 (about 25 percent) and 266 (about 18 percent) of offenses respectively. Additionally, according to USMS adjudication data, of the 2,347 investigations that were opened in fiscal years 2014 through 2018, USMS had adjudicated 1,729 misconduct cases at the time USMS responded to our request for information (March 2019 for investigations opened in fiscal years 2014 through 2017 and April 2019 for investigations opened in fiscal year 2018). As shown in figure 5, the most common disciplinary outcomes for USMS were non-adverse actions (corrective and disciplinary actions), which accounted for 988 (about 58 percent) of final outcomes. USMS did not take disciplinary action on 533 (about 31 percent) of completed investigations forwarded for adjudication. The deciding official will not determine an action against an employee if he or she does not believe the allegations warrant action. Adverse actions were less common, with removals, suspensions of 15 days or more, and demotions accounting for 83 (about 5 percent) of all employee actions. The remaining 120 (about 7 percent) of completed investigations forwarded for adjudication resulted in retirements, resignations, transfers and other outcomes such as settlement agreements. According to the U.S. Merit Systems Protection Board, to prove a claim of management retaliation, the investigation must show that the employee engaged in a protected activity (e.g., filing an EEO claim); the agency official with knowledge of the employee’s protected activity took, failed to take, or threatened to take a personnel action against the employee; and there is a causal connection between the protected activity and the personnel action. From fiscal years 2014 through 2018, ATF and USMS employees submitted 70 claims of management retaliation directly to their Internal Affairs division or the DOJ OIG, and about 240 to their EEO Office. OSC does not record data in its case management system related to DOJ employee disclosures (claims) by component. From fiscal years 2014 through 2018, ATF, USMS, and the DOJ OIG completed 70 investigations of employee misconduct that alleged management retaliation. ATF Internal Affairs retaliation investigations. According to ATF investigations data, from fiscal years 2014 through 2018, ATF Internal Affairs investigated 23 cases alleging management retaliation. Of these 23 cases, Internal Affairs referred 20 to division management for informational purposes. Of the three cases that were investigated by ATF, two cases were investigated by division management and resulted in the employees being counseled by their supervisors. The third case was investigated by Internal Affairs and resulted in one employee receiving a clearance letter and another receiving a letter of caution, with another two employees retiring. USMS Internal Affairs retaliation investigations. According to USMS investigations data, from fiscal years 2014 through 2018, USMS Internal Affairs investigated 26 cases alleging management retaliation. Of these 26 cases, 12 were closed after the investigation was completed due to insufficient evidence. Of the remaining 14 cases, four resulted in employees retiring during or after adjudication, four had no employee action, three closed due to ongoing related cases, and there was one oral admonishment, one letter of counseling, and one suspension of 14 days. DOJ OIG retaliation investigations. According to our analysis of DOJ OIG data, from fiscal years 2014 through 2018, the DOJ OIG investigated 21 ATF or USMS cases alleging management retaliation (four ATF cases and 17 USMS cases). The DOJ OIG filed all four ATF cases in its management system for informational purposes only (no action), and also sent one of the four cases to ATF for informational purposes. Of the 17 USMS cases, the DOJ OIG filed 12 cases in its management system for informational purposes (no action), found that three cases lacked sufficient evidence, closed one case due to one of the involved employees being reassigned and the other resigning, and in one case made a procedural recommendation to the Director of USMS. Figure 6 shows the number of ATF, USMS, and DOJ OIG management retaliation investigations from fiscal years 2014 through 2018. ATF and USMS employees may file claims of management retaliation through their agency’s EEO office. We analyzed ATF and USMS employee misconduct and EEO data to determine (1) the number of employees who had filed an EEO claim of management retaliation and (2) whether these employees were also subject to a misconduct investigation. ATF EEO management retaliation investigations. From fiscal years 2014 through 2018, the ATF EEO Office received 128 claims from 104 employees that included management retaliation as the basis, but none of these claims have been found to support a finding of retaliation. ATF EEO and employee misconduct data show that employees in 54 of the 128 EEO cases (36 total individuals) were also subject to misconduct investigations that were adjudicated during this time period. Of the 36 employees, 24 submitted their EEO claim subsequent to their misconduct investigation. The remaining 12 employees submitted their EEO claim prior to their first employee misconduct investigation. Figure 7 shows the number of ATF employees who filed EEO claims of management retaliation and were also the subject of an employee misconduct investigation. USMS EEO retaliation claims. From fiscal years 2014 through 2018, the USMS EEO Office received 110 claims from 69 individuals with management retaliation as the basis, of which one resulted in a final agency decision supporting the claim. USMS EEO and employee misconduct data show that individuals in 75 of the 110 EEO cases (49 total individuals) were also subject to a total of 134 employee misconduct investigations that were adjudicated from fiscal years 2014 through 2018. Of these 49 individuals, 32 submitted their EEO complaint subsequent to their misconduct investigation. The remaining 17 employees submitted their EEO claim prior to their first employee misconduct investigation, of which three claims resulted in a settlement agreement. Figure 8 shows the number of USMS employees who filed EEO claims of management retaliation and were also the subject of an employee misconduct investigation. From fiscal years 2014 through 2018, OSC did not report any instances of management retaliation for ATF or USMS. OSC reported one investigation related to one USMS employee who improperly secured personally identifiable information, for which USMS took corrective actions. According to data maintained in an ATF Office of Chief Counsel case management system, ATF recorded eight instances where ATF counsel rendered assistance to OSC on retaliation-related matters. USMS Office of General Counsel does not maintain OSC-related data in any USMS case management system. ATF and USMS have incorporated some key internal controls for processing employee misconduct allegations into their policies and procedures, but have not consistently documented the implementation of these controls. ATF and USMS have also established policy requirements related to timeliness in completing employee misconduct investigations, but have not established performance measures to monitor all of these requirements. Further, both ATF and USMS have established mechanisms to monitor various aspects of the components’ operations, but do not use these mechanisms to fully monitor key internal controls related to their employee misconduct investigation and adjudication processes. ATF and USMS documented the implementation of some key control activities that are important for ensuring the quality and independence in processing allegations of employee misconduct. However, they did not document other key control activities. Supervisory review of investigations. According to Federal Quality Standards for Investigations, supervisory or management review of misconduct investigations helps ensure that investigations are comprehensive and performed correctly. ATF and USMS both require this review in policy for misconduct investigations and have incorporated it in their respective procedures. Both ATF and USMS also have a policy or procedure for documenting this control activity in either their case management system or case file records. We found that ATF consistently documented supervisory review of its employee misconduct investigations. Overall, based on our case file reviews, we estimate that 98 percent of the population of ATF investigations or management referrals for action from fiscal year 2014 through fiscal year 2018 documented supervisory review. For our sample, we found documentation of supervisory review in all 36 Internal Affairs investigations and all 26 management referrals for action. We also found supervisory review for all 12 investigations or referrals in our sample with proposed adverse actions and all nine investigations or referrals in our sample that involved an individual who had filed an EEO claim of management retaliation. For USMS, we found that the agency consistently documented supervisory review of its Internal Affairs investigations, but did not consistently document this review for its district and division investigations. Overall, based on our case file reviews, we estimate that 60 percent of the population of USMS investigations (2,347) from fiscal year 2014 through fiscal year 2018 documented supervisory review. For our samples, we found documentation of supervisory review in 29 out of 30 of Internal Affairs investigations. However, for USMS district and division investigations, we found that 23 of 59 investigations had documentation of supervisory review through the required use of a field incident report. We also found that all 20 investigations in our sample with proposed adverse actions had documentation of supervisory review. Further, we found that six of the 12 USMS investigations in our sample that involved an individual who had filed an EEO claim of management retaliation had documentation of supervisory review. The remaining six cases without documentation of supervisory review were district or division investigations, which are typically considered to involve lower-level offenses. Although USMS policy on Field Operational Reports requires the use of a standard form to document supervisory review for district and division misconduct investigations, USMS officials stated that district and division management periodically document a completed investigation with an electronic email confirmation for various reasons, including that the investigation may involve non-adverse actions. However, according to USMS policy, a memorandum does not serve as a substitution for the required field report. Taking steps to ensure that supervisory review of division and district investigations is documented in accordance with USMS policy would provide greater management assurance that investigations are performed comprehensively and consistently, and that this control is operating as intended. Legal sufficiency review. ATF policy on Integrity and Other Investigations states that managers will review the investigative findings with the Office of Chief Counsel’s management division to propose and decide discipline or other actions. ATF also has procedures for documenting these activities in its case management systems. We found that ATF consistently documented legal sufficiency review during the adjudication phase for its Internal Affairs investigations. Specifically, we found that 32 of 36 cases investigated by Internal Affairs documented legal counsel review during the adjudication phase. One case of these 32 had review for the proposal, but was ultimately cleared. For the four cases without documentation of legal counsel review, this review was not applicable. Specifically, one case involved an employee who received a clearance letter; one case was still pending a final decision; one case involved an employee who was on military leave; and one case involved an employee who had retired. We also found that legal counsel review was documented in 11 of the 12 cases in our sample where adverse action was proposed—all of which were investigated by Internal Affairs—and the remaining case was still pending adjudication as of August 2019. Further, we found documentation of legal counsel review for six of the nine employee misconduct investigations that involved an EEO claim of management retaliation. Of the three investigations that did not have documentation, one was an Internal Affairs case where the final action was pending, and the other two cases were management referrals for action. Regarding ATF Internal Affairs investigations referred to division management for action, we found that legal counsel review was documented for nine of 26 cases during the adjudication phase for the proposed discipline, the final disciplinary action, or both. Documenting legal counsel review for cases referred to division management for action would provide ATF management greater assurance that all proposed discipline or other actions are legally sufficient. Although ATF policy requires managers to review investigative findings with the Office of Chief Counsel when handling management referrals, ATF officials stated that supervisors may handle the matters within the division without informing or consulting with legal counsel if there is no proposed discipline. According to ATF officials, the agency plans to revise its policy on Integrity and Other Investigations in August 2020, the next scheduled recertification of the order, to allow managers discretion in determining whether legal review is needed in instances where discipline is not imposed. USMS policy on Discipline Management Business Rules requires legal review for Internal Affairs investigations that involve a proposed adverse action, but does not require legal reviews for investigations that involve non-adverse actions. USMS also has procedures for documenting this activity in its case management system and physical case files. We found that USMS consistently documented the legal sufficiency internal control. Specifically, we found that all of the 20 proposed adverse actions in our sample documented legal counsel review. Of the 12 cases in our sample that involved an individual who had also filed an EEO claim, three had proposed adverse actions, all of which had documentation of USMS legal review. DOJ OIG right of first refusal. According to ATF and USMS policies on misconduct investigations and management referrals, for each misconduct allegation received, the components must provide the DOJ OIG the opportunity to review the case for right of first refusal. This review allows the DOJ OIG to either open an investigation or defer the case back to the component for investigation. This review is designed to maintain independence by determining which cases warrant investigation outside of ATF and USMS. We found that ATF and USMS consistently forwarded allegations of employee misconduct to the DOJ OIG for right of first refusal. Specifically, our analysis of ATF and DOJ OIG data found that the DOJ OIG did not have a record of receiving five out of 1,581 ATF investigations or management referrals for right of first refusal. There were also 41 instances for which ATF did not have a DOJ OIG case number, which prevented the DOJ OIG from checking its records for evidence that ATF had forwarded the case for right of first refusal. We found that 37 of the 41 cases occurred in fiscal years 2014 or 2015, with only four cases occurring in fiscal years 2016 through 2018. Our analysis of USMS and DOJ OIG data found that the DOJ OIG did not have a record of receiving 10 out of 2,347 investigations for right of first refusal. Verification of accuracy of case management system data. ATF and USMS do not have a policy requirement for the use of a method or tool to verify system data associated with both investigation and disciplinary processes. However, according to Standards for Internal Control in the Federal Government, management is to use quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks. The standards also state that data maintains value to management in controlling operations and making decisions, and management is to design control activities so that all records are complete and accurate. Regular reviews of case management data can identify outliers or abnormalities, such as missing information. ATF officials stated that agency managers verify that the initial information related to the allegation is accurate in the case management system. However, additional reviewers in the misconduct process do not verify investigation and adjudication information subsequent to the allegation in the case management system. The officials added that after Internal Affairs investigations and management referrals for action are completed, the record of investigation and supporting materials are reviewed by management to assess the quality of the investigation before uploading to the case management system. However, we found that information related to the investigation and adjudication of these allegations was sometimes not captured in automated data fields. Since uploaded documents cannot be analyzed easily, the Office of Professional Responsibility manually reviews these documents to compile an annual report on employee misconduct activities, such as the number of investigations and outcomes. According to ATF and USMS officials, employee misconduct procedures include supervisor review in several areas. For example, ATF and USMS officials stated that managers review reports of investigation and other documents to ensure certain information is recorded in case files or case management systems. ATF officials provided evidence that they verify certain data when a case is initiated, such as the identity of the subject and allegation. ATF officials also provided evidence that managers review the report of investigation for quality. USMS officials stated that they confirm that the employee under investigation is the correct employee in the system record and that the case was referred to the DOJ OIG for right of first refusal. ATF officials also stated that reviewers involved in employee misconduct processes compare case file documentation against case management system records. However, we found that hundreds of case management system records were missing key information, such as the final outcomes of employee misconduct investigations and DOJ OIG case numbers for ATF, and dates related to district or division investigations for USMS. We also found that ATF and USMS lack policy for verifying the accuracy and completeness of data recorded in their respective employee misconduct case management systems. This policy could be implemented, for example, through the use of a method or tool, such as a data entry checklist, that would guide agency officials when entering information into systems. Establishing policy could help ensure that case management system data are accurate and complete and would allow ATF and USMS to effectively monitor and report on their employee misconduct processes. ATF and USMS have established requirements in their policies regarding timeliness in completing employee misconduct investigations. However, ATF has not developed performance measures to monitor its timeliness requirements. USMS has developed a measure to monitor its Internal Affairs investigations, but not for its district and division investigations. Standards for Internal Control in the Federal Government state that management should define objectives in measurable terms so that responsible personnel and management are held accountable, and their performance toward achieving those objectives can be assessed. ATF policy on Integrity and Other Investigations requires completing Internal Affairs investigations generally within 120 days, and management referrals for action within 60 days. ATF officials acknowledged the importance of addressing employee misconduct allegations in a timely manner. For example, ATF may withhold a positive human resource action or personnel assignment pending completion of a misconduct investigation, such as a promotion or becoming a member of a task force. ATF employees under investigation for misconduct may also be placed on restricted duty, which depending on the case may prevent the employee from accessing information systems and require the employee to surrender his or her government-issued firearms, vehicle, other property, and credentials. ATF officials stated that ATF management tracks ongoing investigations—for both Internal Affairs investigations and management referrals for action—and the amount of time they are open. ATF Internal Affairs officials stated that managers track the duration of all investigations on a weekly basis, and will inquire about the status of investigations and reasons why any exceed the duration standards. However, ATF has not developed a performance measure to monitor performance against timeliness requirements—for example, whether a certain percent of Internal Affairs investigations during a definite time period were completed within the required 120 days. Based on our analysis of ATF data, Internal Affairs met its policy requirement of completing its investigations within 120 days about 36 percent of the time (86 of 240 investigations). ATF data also show that the agency met its policy requirement of 60 days for about 49 percent (205 of 419) of its management referrals for action (see fig. 9). According to ATF officials, ATF does not use measures to monitor performance related to the duration of Internal Affairs investigations and management referrals for action due to numerous factors, such as investigators handling multiple cases at the same time and the involvement of the DOJ OIG. We have previously reported that other federal agencies have established such performance measures, which have taken these challenges into account when developing their methodology for measuring timeliness. Establishing a performance measure to monitor the timeliness of Internal Affairs and management referrals for action could provide ATF management more complete information in overseeing investigations and help improve the efficiency of employee misconduct processes. USMS policy requires completing Internal Affairs investigations within 90 days, and within 30 days for investigations referred to its districts and divisions. USMS officials noted the importance of addressing employee misconduct allegations in a timely manner, with regards to effecting positive human resource actions such as promotions. USMS Internal Affairs has developed a performance measure to monitor whether it is completing its investigations within the required 90-day time frame. According to USMS officials, the agency plans to change the required time frame for completing Internal Affairs investigations from 90 days to 180 days, which according to the officials is a time standard used by most other law enforcement agencies. USMS does not have a performance measure to monitor the duration of investigations conducted by its districts and divisions. According to USMS officials, these investigations do not involve high-level offenses that would pose a significant risk to the agency. Based on our analysis of USMS data, Internal Affairs met its policy requirement of completing its investigations within 90 days 35 percent of the time (468 of 1,320 investigations for which data were recorded in USMS systems), as shown in figure 10. Our analysis also shows that USMS met its policy requirement of completing its district and division investigations within 30 days over 99 percent of the time (489 of 490 investigations for which data were recorded in USMS systems). Although we found that USMS met its timeliness requirement related to district and division investigations over 99 percent of the time, management responsible for oversight have not developed a performance measure to monitor whether the agency meets its policy requirement. Therefore, the agency will not be able to identify any potential future performance issues. Monitoring these investigations is also important since data on the duration for about 25 percent (165 of 655) of district and division investigations that were opened from fiscal years 2014 through 2018 were not recorded in USMS systems at the time the agency provided the data. Developing a measure for the duration of district and division investigations would provide USMS leadership with greater assurance that the agency is complying with policy requirements. ATF and USMS do not use their existing oversight mechanisms to fully monitor key internal controls related to employee misconduct processes. Standards for Internal Control in the Federal Government call for management to establish and implement activities to monitor the internal control system and evaluate the results, as well as remediate identified internal control deficiencies. ATF has two oversight mechanisms that it uses to monitor internal controls related to financial reporting, compliance activities, and operations—annual self-assessments and internal management reviews. However, according to ATF officials, the component does not use these mechanisms to monitor any internal controls related to its employee misconduct processes. Specifically, according to an ATF official, as part of ATF’s annual self- assessment program, all component divisions, including Internal Affairs, are to test financial processes, such as government credit card payments. The ATF Inspection Division also conducts internal management reviews to test compliance with the same activities that are covered by the self- assessment program. ATF officials stated that the scope of the self- assessment program does not include key internal control activities related to employee misconduct processes due to competing priorities. According to an Inspection Division official, the division also has not conducted an internal management review of the offices responsible for employee misconduct processes (e.g., the Internal Affairs division, the Professional Review Board, Bureau Deciding Official activities) in about 10 years due to competing priorities. ATF officials stated that the agency plans to review these divisions and offices in the future, but did not have any specific plans for how internal management reviews would be used for divisions and offices in the misconduct process or when these reviews would begin. While the scope of these reviews has not been determined, the officials stated that internal management reviews could include testing internal control activities related to allegations of employee misconduct, such as investigative review and approval, legal sufficiency review; and case management information system data reliability and completeness. Monitoring key internal controls related to employee misconduct processes through existing oversight mechanisms would help ATF management ensure that controls are being implemented as required by policy. USMS has two oversight mechanisms that it uses to monitor internal controls related to financial reporting, compliance activities, and operations. Specifically, USMS’s Compliance Review Office, within the Office of Professional Responsibility, conducts on-site management reviews at USMS districts and divisions. USMS also has an annual self- assessment program that requires divisions and districts to self-assess their compliance with certain requirements by testing for and remediating any internal control deficiencies. However, because of competing priorities, USMS does not use these mechanisms to fully monitor key internal controls over employee misconduct processes. According to Office of Professional Responsibility Compliance Review officials, the scope of on-site management reviews conducted at selected USMS districts and divisions during fiscal years 2014 through 2018 did not include employee misconduct processes. The officials also stated that on-site reviews during this period did not include the Internal Affairs and Discipline Management divisions. According to USMS officials, the agency plans to conduct an on-site management review at the Internal Affairs division in fiscal year 2021. The officials added that the compliance review cycle for each district and division currently occurs once every 9 years, but that this review cycle will increase to once every 4 years. Our analysis of USMS annual self-assessment guides showed that from fiscal years 2014 through 2018, the guides included testing for most key controls related to employee misconduct processes. For example, Internal Affairs and Discipline Management self-assessment guides included questions on whether Internal Affairs forwards cases to the DOJ OIG for right of first refusal, the Chief of Internal Affairs reviews investigative reports, investigations are completed within 90 days, and data on allegations is entered into the case management system. The self-assessment guide for USMS districts and divisions included questions to assess compliance with the timeliness of investigations (within 30 days); use of the Table of Offenses and Penalties, consideration of Douglas Factors (certain factors that USMS is to consider about an employee when deciding discipline, such as the employee’s need for training); Delegations of Authority for proposing and deciding officials, and other Human Resource policy areas, such as administrative leave and eligibility for promotion. However, although legal sufficiency review of proposed adverse actions is required by policy and a key internal control, USMS did not design its self- assessment guides for the Internal Affairs and Discipline Management divisions to include testing for such reviews. Revising the scope of on-site management reviews to include employee misconduct processes and revising self-assessment guides to include testing for legal sufficiency of proposed adverse actions would help USMS gain greater assurance that these controls are implemented as required by policy. ATF and USMS have established internal controls related to some employee misconduct investigation and disciplinary processes, but additional actions could strengthen their controls. Specifically, USMS does not ensure that supervisory review of division and district investigations is documented in accordance with agency policy. ATF and USMS also have not developed policy for verifying the accuracy and completeness of information in employee misconduct systems. Ensuring supervisory review is documented as required and establishing policy for verifying information in misconduct systems would provide greater consistency in processes, assurance that controls are operating as intended, and corrective actions are implemented as needed. ATF and USMS policy also have required timelines for completing investigations. However, ATF does not have a performance measure to monitor whether it is meeting its timeliness requirement, such as the percentage of Internal Affairs investigations completed within 120 days. USMS does not have a performance measure to monitor and assess its performance in meeting the required time to complete its district and division investigations within 30 days. Developing performance measures to monitor the timeliness of all investigations could provide more complete information for ATF and USMS management responsible for oversight and allow them to address any related performance issues in a timely manner. Further, ATF and USMS have established oversight mechanisms, such as internal management reviews, to monitor select aspects of the components’ operations, such as financial operations. However, ATF and USMS generally have not used these mechanisms to monitor internal controls related to employee misconduct processes, which would help ATF and USMS management ensure that controls are implemented as required by policy. We are making a total of seven recommendations, including three to ATF and four to USMS. Specifically: The Director of the U.S. Marshals Service should take steps to ensure that supervisory review of division and district investigations is documented in accordance with USMS policy. (Recommendation 1) The Director of ATF should develop policy for verifying the accuracy and completeness of information in ATF employee misconduct systems. (Recommendation 2) The Director of the U.S. Marshals Service should develop policy for verifying the accuracy and completeness of information in USMS employee misconduct systems. (Recommendation 3) The Director of ATF should develop a performance measure to monitor the timeliness of misconduct investigations, according to policy requirements. (Recommendation 4) The Director of the U.S. Marshals Service should develop a performance measure to monitor the timeliness of district and division misconduct investigations, according to policy requirements. (Recommendation 5) The Director of ATF should modify existing oversight mechanisms to include the monitoring of key internal controls related to employee misconduct investigations. (Recommendation 6) The Director of the U.S. Marshals Service should modify existing oversight mechanisms to fully monitor key internal controls related to employee misconduct investigations. (Recommendation 7) We provided a draft of this product to DOJ for review and comment. DOJ concurred with all of our recommendations and did not provide written comments. ATF and USMS provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Attorney General, the ATF Acting Director, the USMS Director, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8777 or McNeilT@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. To assess the extent to which the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and United States Marshals Service (USMS) components implemented key internal controls, we selected a stratified random sample of case files within the population of employee misconduct investigations that were opened by each component from fiscal years 2014 through 2018, and that were considered closed as by USMS as of March 13, 2019, for fiscal years 2014 through 2017 and April 26, 2019, for fiscal year 2018, with corresponding data on the outcomes of the investigations (resulting employee actions) as of March 27, 2019 for fiscal years 2014 through 2017 and May 3, 2019, for fiscal year 2018. ATF data are as of April 9, 2019, for internal investigations and as of August 2, 2019, for management referrals. We also stratified our samples based on whether the case files included adverse actions (a suspension of at least 15 days, demotion or removal) and whether an employee under a misconduct investigation had also filed an Equal Employment Opportunity (EEO) claim of management retaliation to assure that representation from both subgroups were included in our sample. We used fiscal year 2014 through 2018 data from the components’ information systems from which to randomly select a generalizable sample of 65 employee misconduct cases for ATF out of a population of 150 and 100 cases for USMS out of a population of 1,281. Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval. This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. The sample was designed to produce 95 percent confidence intervals for percentage estimates that are within no more than plus or minus 10 percentage points within component. The precision is not high enough to generalize to the strata level and results should only be generalized to the component level (i.e. ATF and USMS). As part of these samples, we included investigation that resulted in proposed adverse actions and that involved employees who also submitted an EEO claim of management retaliation. Specifically: For ATF, our sample included 12 cases with proposed adverse actions and nine cases that involved individuals who had also submitted an EEO claim of management retaliation. For USMS, our sample included 12 cases with proposed adverse actions and 12 cases that involved individuals who had also submitted an EEO claim of management retaliation. Because some items we assessed applied only to a subset of cases, resulting in a smaller sample size, we report some findings as the range from the lower to upper bound of the 95 percent confidence interval. In cases with particularly small sample sizes, we describe results for the sample only, rather than attempting to generalize to the population of cases within the component. Triana McNeil at (202) 512-8777 or McNeilT@gao.gov In addition to the contact named above Eric Erdman (Assistant Director), Willie (Billy) Commons III, Dominick Dale, Anthony DeFrank, Justin Fisher, Eric Hauswirth, Ying Long, Amanda Miller, and Mike Tropauer made key contributions to this report.

Summary: Within the Department of Justice, ATF and USMS employ more than 10,000 staff responsible for protecting communities from violent criminals, investigating the illegal use of firearms, and apprehending wanted persons, among other things. Our recent studies of employee misconduct processes have highlighted the importance of internal controls to help ensure the quality and independence of these processes. We have also reported on employee misconduct investigations being used to retaliate against individuals who report wrongdoing. GAO was asked to review ATF and USMS employee misconduct investigation and disciplinary processes. This report (1) summarizes data on the number, characteristics, and outcomes of ATF and USMS misconduct investigations that were opened from fiscal years 2014 through 2018 and were closed by the time of GAO's review, and (2) examines the extent to which ATF and USMS have developed, implemented, and monitored internal controls for their employee misconduct processes. For each component, GAO reviewed policies, guidance, and performance reports; analyzed case management system data; analyzed random samples of misconduct cases; and interviewed officials involved in investigation and discipline processes. From fiscal years 2014 through 2018, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and U.S. Marshals Service (USMS) collectively investigated about 3,900 allegations of employee misconduct, as shown in the table below. About one-half of these investigations were closed with no disciplinary action because the components found that the allegations were unsubstantiated. For allegations that were substantiated by an investigation, the most common ATF offenses were poor judgment and failure to adequately secure property, while the most common USMS offenses were general violations of policy or procedure and failure to follow instruction. The most common outcomes for both ATF and USMS substantiated investigations were discipline including suspensions of up to 14 days and lesser penalties such as verbal or written warnings. During this period, ATF and USMS investigated over 300 allegations of management retaliation, with few resulting in discipline. ATF and USMS have developed some internal controls for managing their employee misconduct investigation and disciplinary processes, but have not consistently documented or monitored key control activities. For example: USMS policy requires supervisory review of district and division investigations, but the agency has not consistently documented this control in accordance with policy. ATF and USMS also lack policy for verifing the accuracy and completeness of information in employee misconduct systems. Ensuring supervisory review is documented as required and developing policy for verifying information in misconduct systems would provide greater assurance that controls are operating as intended. ATF and USMS have established policies and goals related to timeliness in completing various types of employee misconduct investigations (e.g., within 120 days). However, ATF has not established performance measures to monitor progress toward meeting the goals. USMS has measures to monitor timeliness for some types of investigations, but not for others. Establishing measures to monitor timeliness of investigations would provide more complete information to ATF and USMS managers responsible for oversight. ATF and USMS have established oversight mechanisms, such as internal management reviews, to monitor certain aspects of the components' operations, such as financial operations. However, ATF and USMS have not fully used these mechanisms to monitor internal controls related to employee misconduct processes, which would help ATF and USMS management ensure that controls are implemented as required by policy. GAO is making seven recommendations, including that USMS ensure supervisory review is documented; and that ATF and USMS develop policy for verifying system information, establish measures to monitor the timeliness of investigations, and improve monitoring of employee misconduct processes. DOJ concurred with our recommendations.