Under the Communications Act, as amended, FCC regulates interstate and international communications by radio, television, wire, satellite, and cable. FCC regulates these industries by carrying out various activities, including issuing licenses for radio and television broadcast stations; overseeing the licensing, enforcement, and regulatory functions of cellular telephones and other personal communication services; regulating the use of the radio spectrum and conducting auctions of licenses for use of the spectrum; investigating consumer complaints and taking enforcement actions for violations of communications laws and commission rules; addressing public safety, homeland security, emergency management, and preparedness; educating and informing consumers about telecommunications goods and services; and reviewing mergers of companies holding FCC-issued licenses. FCC carries out these responsibilities using its 7 bureaus and 10 offices. Table 2 provides descriptions of each bureau’s responsibilities. To fulfill its responsibilities, FCC requires regulated entities, such as companies and licensees, in the communications industry that it regulates to maintain records, submit information, or disclose information to others. For example, television stations are required to provide FCC with information relating to construction permits, license renewals, and ownership. When collecting and managing information, FCC must adhere to various laws and regulations and coordinate with various entities. Paperwork Reduction Act. The PRA requires agencies, such as FCC, to obtain approval for each information collection instrument that meets the requirements of the PRA from OMB. Before approving a collection instrument, OMB is required to determine that the agency’s collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility. Consistent with the PRA’s requirements, OMB has established a process to review all proposals by agencies to collect information from 10 or more persons, whether the collections are voluntary or mandatory. OMB’s approval of each information collection instrument usually expires within 3 years, and agencies must periodically ask for an extension until the collection is no longer needed. Records management by federal agencies. As required by statute, the head of each federal agency must establish and maintain an active, continuing program for the economical and efficient management of the agency’s records. The agency must provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. Further, the agency must cooperate with the Administrator of General Services and the Archivist in applying standards, procedures, and techniques designed to improve the management of records; promote the maintenance and security of records deemed appropriate for preservation; and facilitate the segregation and disposal of records of temporary value. Federal Information Security Management Act of 2002 (FISMA). FISMA requires the head of each agency to provide information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency. Additional requirements. In addition to the requirements established by the various laws, federal agencies must follow regulations promulgated by agencies such as OMB and the National Archives and Records Administration (NARA). For example, OMB established policy for managing information through its A-130 Circular. NARA provides federal agencies with guidance on the management of records and other types of documentary materials and assists agencies in creating and maintaining accurate and complete records of an agency’s functions and activities and in ensuring the authorized, timely, and appropriate disposition of documentary materials. To develop new rules or modify existing rules, including rules pertaining to information collection instruments, FCC initiates a rulemaking process. When implementing a rulemaking process, FCC must follow the procedures set forth in the Administrative Procedure Act (APA). The APA generally requires a “notice and comment” or “notice and comment rulemaking” process to ensure that stakeholders and the public have adequate opportunity to participate in agencies’ rulemaking processes. In particular, the APA requires agencies, in most cases, to publish a notice of proposed rulemaking in the Federal Register and give interested parties an opportunity to comment on the proposed rule or rule change by providing “written data, views, or arguments.” FCC generally collects information through the following methods. Notice of Inquiry (NOI). FCC releases a NOI to gather information about a broad subject or as a means of generating ideas on a specific issue. Notice of Proposed Rulemaking (NPRM). FCC issues a NPRM to propose new rules or changes to its existing rules. The NPRM must include either the terms or substance of the proposed rule or a description of the subjects and issues involved and seek public comment on the proposal. Further Notice of Proposed Rulemaking (FNPRM). After reviewing comments in the NPRM, FCC can issue a FNPRM regarding specific issues raised in the process. The FNPRM provides an opportunity for the public to comment further on a related or specific proposal. As of April 2009, FCC used 413 OMB-approved information collection instruments to gather information, maintain records, or disclose information; however, the amount of information collected and managed varied by bureau or office. Responsibility for these collections is spread across 10 FCC bureaus and offices (see table 3). The Media, Wireline Competition, and Wireless Telecommunications bureaus are responsible for almost three- quarters of the collections, with 139, 85, and 74 collections, respectively. The estimated number of responses also varies significantly by bureau or office. For example, both the Wireline Competition and Consumer and Governmental Affairs bureaus anticipate over 140 million individual responses annually to their collection instruments, whereas the Enforcement Bureau anticipates fewer than 10,000. The burden associated with submitting the information also varies by bureau or office; according to the PRA, the term “burden” means the time, effort, or financial resources expended by persons to generate, maintain, or provide information to a federal agency. The Consumer and Governmental Affairs Bureau estimates over 39 million hours for its collection instruments, more than the other bureaus and offices combined; other bureaus with over 1 million estimated annual burden hours include the Media, Wireline Competition, and Wireless Telecommunications bureaus. FCC collects a wide variety of information through its 413 OMB-approved information collection instruments. In response to our request, FCC placed each of its 413 collection instruments in a category based on the industry and/or purpose. FCC identified 21 categories, and we further organized these 21 categories into five groups (see table 4). As shown in the table, there is significant variation in the number of collection instruments and estimated number of responses and annual burden hours across the 21 categories. We provide a description of the types of information collection instruments below. Requirements. FCC-defined information collection instruments for requirements span a wide variety of industries, including wireless and wireline telephone, broadcasting, cable, equipment, and public safety. FCC regulations require companies to provide a variety of information. For example, the Wireline Competition Bureau has 58 collection instruments of this type, including employment reports and local number portability for wireline telephone companies. The Wireless Telecommunications Bureau has 59 collection instruments of this type, such as reports on interference. Applications. Regulated entities, such as companies and individuals, seeking to provide certain services must apply for and receive a license from FCC. For example, the Media Bureau gathers license application information from companies seeking to provide radio and television broadcast service. The Office of Engineering and Technology gathers license application and equipment authorization information from companies seeking to market new wireless equipment, such as wireless telephones. Complaints. FCC collects consumer complaints on a variety of problems through OMB-approved information collection instruments. These complaints include a wide variety of problems such as deceptive or unlawful advertising or marketing; obscene, profane, and/or indecent material on broadcast radio or television; slamming, the illegal practice of changing a consumer’s telephone service without permission; and accessibility of communications services to persons with disabilities. Financial and accounting. The Wireline Competition Bureau collects information pertaining to both wireline carrier accounting and the universal service fund. The wireline carrier accounting collections include a variety of company submissions, such as information on rates, costs, investment, and customer satisfaction. The universal service fund collections include submissions necessary to pay into or receive payment from the universal service fund. We also include collection instruments for FCC’s financial operations in this group; these collections include, for example, documents for FCC’s regulatory fees. Other. These information collection instruments pertain to a variety of topics. For example, the Media, Wireline Competition, and Wireless Telecommunications bureaus conduct surveys of cable television operators, companies providing broadband service, and participants in FCC’s spectrum auctions, respectively. The Consumer and Governmental Affairs Bureau collects information pertaining to telecommunications relay service, which allows persons with hearing or speech disabilities to place and receive telephone calls. The Wireless Telecommunications Bureau uses collection instruments to receive applications for participants in spectrum auctions and auction participants seeking bidding credits. FCC has established commissionwide programs, policies, and procedures for the collection and management of information; FCC articulates these policies and procedures in its records management program, forms management program, security policies and procedures, and information system protection. However, since bureaus and offices are the primary users of information, implementing decisions generally occur at the bureau or office level. On the basis of responses to our questionnaires about 30 OMB-approved information collection instruments, FCC’s bureaus and offices collect and manage information in a variety of different ways. FCC has four primary directives that establish procedures for commission staff to follow for collecting and managing information. These directives help ensure FCC’s compliance with governmentwide laws and regulations pertaining to information collection and management, such as the PRA and FISMA. Records management program. By statute, the head of each federal agency must establish and maintain an active, continuing program for the economical and efficient management of all records of the agency. To meet this requirement, FCC established a records management program that sets out the policies, procedures, and activities needed to manage the commission’s recorded information. The objectives of FCC’s records management procedures are to accurately and completely document the policies and transactions of the control the quantity and quality of records produced by the commission; establish and maintain mechanisms of control to promote effective and economical operations of the commission; simplify the activities, systems, and processes of creating, maintaining, and using records; and judiciously preserve and dispose of records. Within the Office of Managing Director, FCC’s Performance Evaluation and Records Management (PERM) staff carry out procedures to establish and oversee the records management program. The procedures require PERM staff to review and evaluate the program by conducting (1) on-site inspections, (2) annual reviews of all bureau and office records control schedules, and (3) reviews of bureau and office submissions of record holdings. Forms management program. FCC has a forms management program to comply with statutory, regulatory, and policy requirements for federal forms. The objectives of the forms management program are to ensure (1) forms are directly linked to accomplishing specific missions of the commission; (2) forms are properly designed with clear instructions to make it easy as possible for respondents to provide information requested in the least amount of time; and (3) forms make effective and efficient use of electronic technologies for creating, collecting, distributing, and using these forms to record, store, and disseminate information. The procedures state that each bureau and office chief is responsible for, among other things, ensuring that forms are created, maintained, and disposed of in conformance with the commission’s records management program. Security policies and procedures. FCC has security policies and procedures for the management and safeguarding of all nonpublic information. FCC has two categories of nonpublic information: 1. “Highly sensitive/restricted” information is defined as information that is highly market sensitive (i.e., disclosure of which is likely to substantially affect the value of securities traded publicly or a company’s market valuation) or other commercial or financial information the commission considers confidential and highly sensitive. For example, according to FCC officials, information that is submitted to FCC’s Disaster Information Reporting System may contain commercial information that could affect competition among wireless, wireline, broadcast, and cable providers and is treated as confidential by FCC. 2. “Internal use only” information is defined as all other nonpublic information not routinely available for inspection. For example, FCC maintains information for internal use only that allows its crisis incident managers to coordinate activities in the telecommunications industry and FCC in the event of a crisis. This internal document has contact information for FCC employees, other federal government agencies, state and local governments, and the communications industry. According to these procedures, the bureau or office creating or using nonpublic information is responsible for determining in which category the information should be placed. FCC’s procedures are designed to safeguard the nonpublic information in all formats including, but not limited to, paper, computer files, e-mails, diskettes, CDs, audio and video recordings, and oral communications. Among other things, the policies and procedures require that nonpublic information must be disposed of in a locked document disposal bin; such bins are located throughout FCC headquarters. Information systems protection. FCC has established policy to help ensure that adequate levels of protection exist for all FCC information systems, including the FCC network, applications and databases, and information created, stored, or processed. FCC’s Chief Information Officer (CIO) has primary responsibility for managing the commission’s policy. The policy states that the CIO’s responsibilities include (1) evaluating and approving the resolution of issues relating to information security, (2) developing and maintaining an agencywide information security program, and (3) training and overseeing personnel with significant responsibilities for information security. FCC also has a Chief Information Security Officer responsible for (1) developing plans for providing adequate information security for networks, facilities, and systems or groups of information systems; (2) conducting periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency; and (3) developing plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. FCC’s policies and procedures for managing information are primarily carried out at the bureau or office level. As the primary users of information, FCC’s bureaus and offices manage most of the commission’s information collected through OMB-approved collection instruments. The previously mentioned records management guidance, which was established by PERM, gives bureau and office chiefs authority to establish their own procedures for managing records and ensuring staff observe guidelines. According to FCC officials, bureaus and offices are allowed to establish their own procedures. However, officials also said that they are not aware of any bureaus and offices that have officially done so. Similarly, officials with the bureaus and offices with whom we spoke said that they use the commissionwide guidance to manage their information and have no additional internal information procedures. According to responses to our questionnaires about 30 OMB-approved information collection instruments, FCC’s bureaus and offices collect and manage information in various ways based on the type of information. As mentioned previously, a reporting entity or third-party entity maintains the information associated with some FCC collection instruments. In those instances, certain questions pertaining to information collection, management, dissemination, and retention and disposal are not applicable. Therefore, we used two questionnaires, one for collection instruments where FCC maintains the information and one for collection instruments where the reporting entity or a third-party entity maintains the information. Of the 30 responses we received, FCC maintains the information for 21 collection instruments; for the remaining 9 collection instruments, the reporting entity or third party maintains the information. Most of the following analysis pertains to the 21 collection instruments where FCC maintains the information. Information collection. Respondents to our questionnaire reported that they collect information in different formats, including electronic, paper, and compact disc (CD). For the 21 collection instruments where FCC maintains the information, 14 respondents reported that the reporting entity submits information to the bureau or office in an electronic format. For example, one respondent reported that cost and revenue information from telephone companies, such as AT&T and Verizon, is submitted electronically to FCC. In three instances, the respondent reported that the bureau or office receives the information in a paper format. For example, 1 respondent reported that entities using certain radio frequency identification devices are required to submit their information on paper to register the location of these devices. Additionally, 3 respondents reported receiving electronic and paper submissions, and 1 respondent reporting receiving both paper and CD submissions. The frequency of the collection also varied among the information collection instruments. Nine information collections are annual. For example, one respondent reported that FCC collects information annually from a sample of cable operators on average rates charged for the basic cable service, cable programming service tiers, and cable equipment. The frequency of the collection for the remaining collection instruments varied, from onetime submissions when filing an application to triennial filings. Information management. After collecting the information, bureaus and offices manage it in various ways. For all 30 collection instruments, 15 respondents reported that the bureau or office stores the information in a database. As we discussed previously, in nine instances the reporting entity or a third party maintains the information. The remaining respondents to our questionnaire reported that the bureau or office stores information in an internal network system or a file cabinet. Respondents to our questionnaire reported that bureaus and offices use several quality control procedures to ensure the accuracy of information. For example, three respondents reported that information systems run validity checks that ensure (1) certain data do not fall outside a reasonable range for that data and (2) all data have been submitted as required. A respondent reported that drop-down menus for individuals submitting data electronically provide checks on the quality of the data, as do pop-up warnings for data entries outside of the expected reasonable range. Other respondents reported that staff review the information for completeness and accuracy. For the 9 collection instruments wherein the reporting entity or a third party maintains the information, 4 respondents reported that the bureau or office may randomly select items for review, request the records be provided to the commission, and review the records for compliance with the commission rules; 3 respondents reported that the bureau or office does not verify the information. In terms of correcting errors, some respondents reported that the bureau or office contacts the individual or organization that submitted the information and asks that entity to make corrections. Other respondents reported that the bureau or office will contact the individual or organization and ask for clarification and update the information internally. Respondents to our questionnaire also identified several approaches the bureaus and offices employ to safeguard information. For the 21 collection instruments where FCC maintains the information, 12 respondents reported that their bureau’s or office’s information collections contain business sensitive or confidential information. Nine respondents reported that the information collections are less sensitive: 6 reported that the information is generally public data, 1 reported that the information is not typically business sensitive or confidential, and 2 reported that the information is not business sensitive or confidential. To ensure the safeguarding of information, 17 respondents reported that the bureau or office limits access to information. For example, 1 respondent who reported that much of the information is business sensitive also reported that access to the information is limited to bureau staff. In addition, staff members are instructed to keep the information and any related notes and worksheets confidential and to keep any paper copies of the information in locked cabinets. Fourteen respondents also reported that the information is safeguarded with data backup and storage, and 2 respondents reported that information is protected by encryption. Two respondents reported that confidential submissions are kept in a locked file cabinet. Information dissemination. FCC disseminates the information gathered through some of the collection instruments we reviewed to the public. Specifically, 15 respondents to our questionnaire reported that the information collected is disseminated through internal or external reports. Of the 15 respondents, 11 reported that some of the information collected is disseminated to the public on FCC’s Web site. For example, 1 respondent reported that information on applications and licenses for experimental use of radio frequencies is publicly accessible. Other respondents reported the public can request the information or view the information at FCC. For example, 1 respondent reported that in order to protect the identity of the entity submitting information, FCC releases redacted information in response to a request for information. Additionally, several respondents reported that internal reports are generated from the information collected. For example, 1 respondent reported that the bureau or office generates internal workload, trend, and management reports from the information. Information retention and disposal. Bureaus and offices collecting information via the collection instruments we reviewed retain the information for a period of 1 year to indefinitely. Specifically, 7 respondents to our questionnaire reported that the bureau or office retains the information indefinitely. For example, 1 respondent reported that although the actual survey forms are kept for 5 years, spreadsheets of information on surveys of license and spectrum auctions are kept indefinitely. Another respondent reported that the information is retained indefinitely because the disposal procedures are not yet in place. We also asked about the procedures for disposing of information. Six respondents reported that information is transferred to the NARA after being retained by FCC for 5 years. Two respondents reported that paper documents are shredded and electronic records are physically destroyed or erased electronically. According to our review of 30 OMB-approved information collections, FCC’s bureaus and offices appear to follow commission- and governmentwide policies and procedures for the collection and management of information. For example, the bureaus and offices conduct quality control procedures for these information collections. However, in prior reports, we have identified weaknesses in FCC’s information collection and management practices, and some stakeholders with whom we spoke noted the same or similar weaknesses. In particular, these reported weaknesses concern FCC’s information collection processes and the estimated burden hours associated with FCC’s information collections. For the 30 information collections that we reviewed, FCC’s bureaus and offices appeared to follow commission- and governmentwide policies and procedures for the collection and management of information. In particular, we compared the 30 responses from our questionnaires with the commission’s internal policies and procedures and federal guidance on information collection and management practices. We found that the bureaus and offices followed the relevant policies and procedures for these 30 information collections. For example, respondents to our questionnaire reported carrying out a variety of commissionwide information management procedures, including the following: Quality control. FCC bureaus and offices responsible for the collections reported using a variety of quality control procedures for managing the collections to ensure the accuracy and integrity of the information in the collections. These quality control procedures include general processes to verify information, such as edit checks; Web-based filing systems, which incorporate presubmission checks for internal consistency; and notification of the filers of erroneous information and the legal obligation to correct the information and resubmit the document. Safeguarding sensitive and confidential information. The bureaus and offices collecting confidential information reported implementing a variety of safeguards. These safeguards include system limitations that restrict access to the information and encryption of the data in information collections. As mentioned previously, in several reports, we have found weaknesses in certain information collection, management, and reporting processes at FCC. In several instances, FCC has not implemented our recommendations. For example, we recommended that FCC consider collecting additional data and developing additional measures to monitor competition for dedicated access service on an ongoing basis; FCC disagreed that it needed to better define competition and collect additional data, although on November 5, 2009, it released a Public Notice inviting comment on an appropriate analytical framework for examining dedicated access. Some stakeholders with whom we spoke also identified certain weaknesses in FCC’s processes. Information collection. We recently reported that when issuing a NPRM to gather public input before adopting, modifying, or deleting a rule, including those rulemakings involving information collection instruments, FCC rarely includes the text of the proposed rule in the notice, an omission that may limit the effectiveness of the public comment process. We recommended that FCC, where appropriate, include the actual text of proposed rules or rule changes in either a NPRM or a FNPRM before the commission votes on new or modified rules to improve the transparency and effectiveness of the decision-making process. Six stakeholders with whom we spoke also expressed concern about FCC’s lack of specificity when proposing the collection of information through the notice and comment process. For example, four stakeholders said that FCC does not initially specify the information that it wants to gather through a proposed collection instrument in the NPRM. Additionally, an official representing a major telecommunications company said that FCC issues NPRMs that do not contain the proposed rule for stakeholders to review and comment on. This official added that NPRMs usually contain a general description of what the rule will be and the companies can submit comments. The lack of specificity in the NPRM makes it harder for stakeholders and the public to provide meaningful input on the proposed information collection instrument. Burden hour estimates. OMB recently released a request for comments on improving implementation of the PRA. In its request, OMB noted that agencies’ estimation methodologies can sometimes produce imprecise and inconsistent estimates of the burdens associated with information collection instruments. In particular, OMB noted that some estimates are not based on sufficiently rigorous or internally consistent methodologies. Additionally, OMB noted that some information collections may impose significant burdens on small businesses. Therefore, OMB sought comment on a variety of topics, including the following: examples of substantially inaccurate burden estimates for information new or improved practices for estimating burden, examples of information collections that inaccurately estimate the impact of burden upon small entities, and whether or not a separate burden estimate should be created for small entities. Seven stakeholders with whom we spoke expressed concern about FCC’s burden hour estimates and the overall burden associated with the commission’s information collections, particularly the burden on small companies. Three stakeholders mentioned that FCC’s burden hour estimates are not accurate. For example, an official with a telecommunications company said that the burden estimates for some of the information collections the company submits are underestimated. In particular, this official said that aggregating and submitting information to FCC on broadband service (FCC Form 477) takes longer than FCC’s estimate; FCC’s estimated average burden hours per response for the Form 477 is 72 hours, yet this official said the time to prepare and submit the Form 477 is off by a factor of 10. Six stakeholders mentioned the burdensome nature of some FCC collections, particularly for small companies. For example, one association said that providing data is a burden for some of the smaller companies, which might have as few as 500 customers. Another official noted that inaccurate estimates can adversely affect small companies, since the additional burden could negatively affect their operations. In general, these stakeholders did not provide concrete examples to substantiate their concerns about the estimated burden. On July 22, 2009, the FCC Chairman directed the Office of Strategic Planning and Policy Analysis (OSPPA) to conduct a top-to-bottom review of the commission’s systems and processes for information collection, processing, analysis, and dissemination. According to the Chairman, he initiated the review to uncover opportunities to improve the commission’s information capabilities. In particular, the Chairman sought information on whether any (1) new information should be collected to support the commission’s mission, (2) existing information reporting requirements could be streamlined or eliminated because they are unduly burdensome or no longer relevant, and (3) existing technological platforms and management processes could be modernized in order to make the commission’s use of information more efficient and effective. The Chairman asked OSPPA to answer 20 questions, including the following: For each bureau and office, what significant information is collected and which information is used most heavily internally or externally? Is there overlap among bureaus or offices with regard to information collection? What formal operational processes exist to manage the full information “life cycle” and are there any bottlenecks? Does FCC make regular efforts to gather best practices from other information collections agencies? What reports does FCC regularly generate to make information available to the public, what are the most important information systems, and what metrics does FCC have to track public consumption of information? According to FCC officials, OSPPA has taken several steps to carry out the Chairman’s request. In particular, OSPPA (1) sought information on the current information collection efforts and future information needs in FCC’s bureaus and offices and (2) identified potential gaps between the current collections and future needs. OSPPA officials said that the current effort will likely identify areas for greater investigation for the bureaus and offices, and that the current effort is the beginning of a multiyear review and transition process. Additionally, the Chairman initiated an assessment of FCC’s database and communications infrastructure. According to the Chairman, an initial review strongly suggested that a significant upgrade will be warranted to bring the commission into the 21st century. The Chairman also stated that an upgrade will permit the commission and its staff to function much more efficiently and facilitate public use of its Web site. FCC also launched an internal online forum where employees can submit ideas for improvement and reform, and FCC plans to launch a section on its Web site allowing the public to offer ideas for reform as well. We provided FCC with a draft of this report for its review and comment. FCC provided written comments, which appear in appendix II. In its written comments, FCC discussed the various efforts under way at the commission to improve its data management processes. FCC also provided technical comments that we incorporated where appropriate. As agreed with your office, unless you publicly announce the contents of the report earlier, we plan no further distribution of it until 30 days from the date of this report. At that time we will send a copy of this report to the Chairman of the Federal Communications Commission. The report also is available at no charge on the GAO Web site at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512- 2834 or wised@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. This report examines (1) the information the Federal Communication Commission (FCC) collects; (2) how FCC collects and manages information; (3) the strengths and weaknesses, if any, in FCC’s information collection and management practices; and (4) the status of FCC’s internal review of its information collection and management practices. To describe the information FCC collects, we obtained and reviewed FCC’s list of information collection instruments approved under the Paperwork Reduction Act (PRA); we reviewed collection instruments that were approved as of April 22, 2009. The list included FCC’s description of the information collection, the PRA number, the name of the bureau or office responsible for managing the collection, and the estimated annual burden hours associated with the collection. We also interviewed FCC officials from seven bureaus and offices, including the Chief Information Officer. We discussed the availability, formats, and special characteristics of FCC’s information collections. To describe how FCC collects and manages information, we reviewed commissionwide directives on FCC’s (1) records management program, (2) forms management program, (3) management of nonpublic information, and (4) information security program. We reviewed the National Institute of Standards and Technology’s guidance on security procedures for information, the Office of Management and Budget’s (OMB) Office of Information and Regulatory Affairs directives on managing and securing information, and the National Archives and Records Administration’s (NARA) guidance for retaining and disposing of information. We also interviewed FCC officials. Additionally, to obtain information on how various FCC bureaus and offices collect and manage information, we developed two questionnaires that covered various aspects of the information life cycle—collection, management, dissemination, and retention and disposal. We developed one questionnaire for collection instruments where FCC retains the information and a second questionnaire for collection instruments where the filing entity or a third party maintains the information. We pretested the questions to determine appropriateness and made revisions based on the results of the pretest. To select the information collection instruments from which we would obtain information via the questionnaires, we initially asked FCC for the repository (e.g., the database where the information resides) associated with each of its information collections; FCC officials said the commission could not readily provide that information because it does not maintain its records in such a manner. In response, we adopted an alternative, multistep approach. We asked FCC to classify the 413 OMB-approved information collection instruments into categories based on activity or use (e.g., licenses and surveys); FCC divided its 413 collection instruments into 21 categories. We determined the average burden hours for each of the 21 categories, based on the estimated annual burden hours for the collection instruments in each category. We established three strata based on the average burden hours (greater than 46,803 hours, 46,803 hours to 17,904 hours, and less than 17,904 hours). We selected one category from each of the first two stratum and two categories from the third strata in order to obtain a mix of collection types and to eliminate collections that received extremely limited submissions. Finally, we judgmentally selected collection instruments from each of these four categories; this process resulted in the selection of 30 information collection instruments. Because of the nature of our selection process, our results can not be used to evaluate FCC’s collection processes overall. Of the 30 collection instruments, FCC maintains the information for 21 collection instruments and the filing entity or a third party maintains the information for the remaining 9 collection instruments. We received responses for all 30 collections. After receiving the 30 responses, we reviewed and analyzed the answers and followed up on selected answers and documentation provided in the questionnaire by interviewing the responsible officials. To describe the strengths and weaknesses in FCC’s information collection and management practices, we compared the 30 responses from the questionnaires with the commission’s internal policies and procedures and federal guidance on information collection and management practices. We also interviewed 19 stakeholders, including representatives from communication companies, industry trade associations, consumer and public interest groups, state regulators, and academic and industry experts. We selected these stakeholders to include a cross section of industries regulated by FCC, including radio and television broadcasters, cable television operators, satellite operators, and wireline and wireless telephone companies, as well as parties representing consumers and regulators that are affected by the commission’s policies and rulemaking. We reviewed prior GAO reports and performed a literature review of best practices for the collection and management of information. To describe the steps FCC is taking to address information management weaknesses, we reviewed a memoranda dated July 22, 2009, from the FCC Chairman initiating a review of the commission’s information management collections and processes. We also reviewed a congressional hearing statement made by the Chairman in which he discussed FCC’s initiatives to improve information management. We met with the Chief of the Office of Strategic Planning and Policy Analysis to discuss progress on the commissionwide information management review the Chairman requested in July of 2009. In addition to the contact listed above, Michael Clements (Assistant Director), Andy Clinton, Mya Dinh, Amy Rosewarne, Don Watson, Mindi Weisenbloom, and Elizabeth Wood made major contributions to this report.

Summary: The Federal Communications Commission (FCC) regulates industries that affect the lives of virtually all Americans. FCC-regulated industries provide Americans with daily access to communications services, including wireline and wireless telephone, radio, and television. To ensure FCC is carrying out its mission, the commission requires a significant amount of information, such as ownership and operating information from radio and television stations. In prior reports, GAO has found weaknesses with FCC's information collection, management, and reporting processes. While FCC has taken action, the commission has not implemented all the recommendations associated with information collection, management, and reporting. As requested, this report provides information on (1) the information FCC collects; (2) how FCC collects and manages information; (3) the strengths and weaknesses, if any, in FCC's information collection and management practices; and (4) the status of FCC's internal review of its information collection and management practices. To complete this work, GAO gathered information on FCC's information collection efforts, reviewed information collection and management practices for 30 collection instruments, interviewed agency officials and industry stakeholders, and reviewed relevant laws and guidance. FCC provided comments which discuss its efforts to improve data management. FCC gathers a wide variety of information though information collection instruments. FCC gathers information through 413 collection instruments approved by the Office of Management and Budget (OMB). Through these OMB-approved collection instruments, FCC gathers information pertaining to (1) required company filings, such as the ownership of television stations; (2) applications for FCC licenses; (3) consumer complaints; (4) company financial and accounting performance; and (5) a variety of other issues, such as an annual survey of cable operators. FCC estimates that it receives nearly 385 million responses with an estimated 57 million burden hours associated with the 413 collection instruments. FCC's bureaus and offices collect and manage most commission information following commissionwide programs, policies, and procedures. FCC articulates its commissionwide programs, policies, and procedures in several directives, including its records management program. These directives help ensure FCC's compliance with governmentwide laws and regulations. Since FCC's bureaus and offices are the primary users of information, implementing decisions generally occur at that level. According to GAO's review of 30 information collections, FCC's bureaus and offices collect and manage information in a variety of ways. For example, FCC collects and manages 14 of the 30 information collections electronically, while it collects and manages some information in paper format. FCC disseminates information from 11 of the 30 information collections on its Web site, while it disseminates some information upon request, but in a redacted format. According to GAO's review of 30 information collections, FCC's bureaus and offices appear to follow commission- and governmentwide guidance, such as quality control procedures and safeguards for sensitive information. However, prior GAO reports and some stakeholders identified certain weaknesses with FCC's information collection and management practices. These weaknesses concern FCC's information collection processes and the accuracy of the estimated burden hours associated with FCC's information collections. For example, GAO recently reported that FCC rarely includes the text of a proposed rule in its Notice of Proposed Rulemaking, and stakeholders similarly noted that FCC does not initially specify the information that it wants to gather in the notice; the lack of specificity makes it harder for stakeholders and the public to provide meaningful input on the proposed information collection instrument. Recognizing the need to improve the commission's information practices, in July 2009, FCC's Chairman initiated a review of the commission's systems and processes. The Chairman sought to address whether (1) new information should be collected, (2) existing information reporting requirements could be streamlined or eliminated, and (3) existing technology and management processes could be modernized in order to make the commission's use of information more efficient and effective. FCC staff have taken several steps to implement the review and the effort continues.