Since FPS was created in 1971, as part of GSA, it has been responsible for providing law enforcement and related security services to all federal facilities held or leased by GSA. Specifically, FPS is responsible for, among other things, (1) hiring security guard contractors and overseeing contract guards deployed at federal facilities, (2) controlling access to federal facilities, (3) responding to incidents, (4) enforcing property rules and regulations, and (5) conducting criminal investigations and facility security assessments (FSA). To accomplish this facility protection mission and other responsibilities, as of October 2014, FPS has about 1,200 full-time employees located in its headquarters and 11 regional offices around the country. FPS also has about 13,500 contract security guards deployed at approximately 5,650 of the almost 9,000 federal facilities it protects. To fund its operations, FPS charges fees for its security services to federal tenant agencies in GSA-controlled facilities. For fiscal year 2014, FPS expected to receive $1.3 billion in fees. In the 1980s, some federal departments and agencies raised concerns that GSA was not providing quality building services, including the physical security provided by FPS, in a timely manner. In response, GSA’s Administrator decided to establish a delegation of authority program that would primarily decentralize building services such as security and lease management. A 1985 Executive Order also directed GSA to delegate its building operations authority to tenant agencies when it was feasible and economical. To make this determination, GSA required agencies to maintain program and financial data, which GSA reviewed to determine whether to grant a delegation. When FPS transferred from GSA to DHS in 2002, this delegation of authority program also transferred. Under the program, FPS is responsible for reviewing delegations for law enforcement and security services and determining ─based on cost and capabilities analysis─ if it is in the best interest of the government to authorize another department or agency to protect a federal facility instead of FPS. FPS also is responsible for ensuring that these delegated facilities are protected in a manner consistent with the Interagency Security Committee’s (ISC) standards. A law enforcement delegation of authority authorizes an agency to enforce federal laws and regulations aimed at protecting the agency’s federal facilities identified in the delegation and the employees and public who work in and visit those facilities; conduct investigations related to offenses against the property and persons on the property, and arrest and detain persons suspected of federal crimes. A delegation of authority for security services typically authorizes an agency to manage its own contract guard program at the specified federal facilities, including awarding and administering contracts, and ensuring that guards are properly trained and certified to protect those facilities. An agency may also receive a delegation of authority for both law enforcement and contract guard services. Delegations of authority are generally granted for about 2 to 5 years, but the expiration dates for some existing delegations are not specified or the delegation indicates that it will continue until terminated by FPS, according to FPS officials. In response to congressional direction, in November 2012, FPS issued its Interim Plan, which outlines its current process for reviewing delegations of authority. This process, which is managed primarily by FPS headquarters staff (one full-time employee and three part-time employees) in coordination with its 11 regional offices, includes four phases. During this phase, which began in 2010 and is still ongoing, FPS has focused on identifying delegations of authority that were primarily granted when FPS was part of GSA because FPS at that time did not have a centralized recordkeeping system. As part of this identification process, FPS contacted its 11 regions and GSA to determine if they had copies of delegations. In addition, in some instances, FPS obtained information about an existing delegation from agencies that were granted such authority. FPS uploaded the information it collected from these delegations into an electronic database. During this phase, the Interim Plan calls for FPS to conduct cost and capabilities analyses to determine whether to renew or rescind an existing delegation or grant a new one. To perform the cost analysis, FPS developed a cost estimation model, which establishes a standardized process for assessing the financial impact of each delegation of authority. As part of this cost analysis, FPS compares its and the delegated agency’s costs of providing law enforcement or security services. For example, to estimate the current resources expended by the delegated agency and to determine the cost that FPS would be expected to incur if the delegation were rescinded, FPS reviews data on the amount it would spend and the amount the agency currently spends on various cost elements, such as salaries and benefits; guards’ training and certification; law enforcement equipment (e.g., computers, uniforms, and mobile radios); and mega-center (dispatch center) services. In addition, information about the FSA; countermeasures (i.e., contract security guards, K-9 officers); training, services; and equipment (i.e., ammunition, cell phones, and office supplies) are also required to be entered into the cost estimation model. To conduct a capability analysis, FPS determines if services—such as acquisition of guard services, training, criminal investigations, guard oversight, and a mega center—are in place at the delegated facility; how those services are provided and resourced; and whether FPS can provide those services on a reimbursable basis and, if so, how much it would cost. According to the Interim Plan, after completing the cost and capabilities analyses, FPS recommends to DHS’s Under Secretary for the National Protection and Programs Directorate (NPPD) whether a delegation should be granted, renewed, or rescinded. The Under Secretary then makes the final decision and notifies the agency requesting a delegation of authority. For delegations that are rescinded, FPS’s Interim Plan requires an orderly transition of law enforcement or guard services so that there is no lapse in protection of the facility. For delegations that are granted or renewed, FPS has responsibility for overseeing the delegations and will conduct periodic inspections to ensure that the delegated facilities are protected in a manner consistent with its contract requirements and federal physical security standards. In September 2014, FPS drafted a directive that establishes its policy and procedures and assigns responsibilities for law enforcement and contract security guard delegations of authority. Among other things, the draft directive provides further detail on the roles and responsibilities of FPS headquarters and regional staff in reviewing delegations of authority and how FPS plans to verify that existing delegations are active, have not expired, or the facility is vacant. The draft directive also requires any agency requesting a delegation to complete a self-assessment of its security services and provide FPS with a copy of the most recent facility security assessment. As of January 2015, FPS had not set a timeframe for finalizing and implementing the draft directive. FPS’s delegations of authority program does not fully meet applicable federal standards we identified for effective program management. FPS lacks reliable data, as called for by federal Standards for Internal Control in the Federal Government, for accurately identifying the total delegations it is responsible for managing. In addition, FPS’s model for estimating the costs associated with a delegation does not fully align with the relevant leading practices outlined in GAO’s Cost Guide. Without fully meeting these standards and leading practices, FPS cannot ensure that its decisions to grant, renew, or rescind delegations of authority are based on sound data and that security resources are efficiently allocated and in a manner that leads to effective protection of federal facilities. FPS lacks reliable data for identifying the total number of delegations of authority it has granted. Specifically, FPS has not established a reliable baseline for the number of delegations of authority that have been granted since the 1980s and remain active and thus, does not know how many it needs to review and oversee to ensure that law enforcement and security services are provided at these federal facilities. The federal Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external-reporting purposes. As previously discussed, in its Interim Plan, FPS reported that it granted over 300 delegations to approximately 30 federal departments and agencies. During the course of our engagement, FPS began verifying these data in accordance with criteria it outlined in its September 2014 draft directive. According to the draft directive, FPS should exclude from the list of 300 delegations of authority identified in the Interim Plan, those delegations that had expired or where the delegated agency no longer occupies the facility. FPS officials also told us that rescinded delegations of authority should also be excluded. Based on its verification process, FPS officials stated that only 62 of the 300 delegations of authority identified in the Interim Plan were active delegations, as of October 2014. However, we reviewed the 62 delegations of authority FPS verified and─ based on FPS’s criteria for excluding delegations─ found that 12 were improperly included. Although FPS’s verification process was to exclude expired delegations, we found that 11 of the 62 delegations of authority it identified as active had expired, including 3 that had expired almost 20 years ago when the delegated agency was still responsible for protecting its own facilities. These 11 delegations of authority were granted to 6 departments and agencies (Departments of Commerce, Health and Human Services, Defense, State, and Treasury, and the Social Security Administration) to protect 81 facilities. Although rescinded delegations are to be excluded, we found that FPS’s validated data included a delegation that was granted to NRC but was rescinded in October 2013. That delegation also should have been excluded from FPS’s validated data because it related to four facilities that NRC officials explained they had not occupied in about 20 years. Our analysis demonstrates that while FPS continues to gather information on all existing delegations of authority, it has not established effective internal controls, such as procedures to ensure that the data on its delegations are reliable. FPS officials stated that FPS lacks reliable data on its delegations of authority, in part, due to poor recordkeeping with existing delegations. FPS officials also said that they have worked with GSA and FPS regional offices to identify documentation of existing delegations of authority, but acknowledged that this approach may not have resulted in an accurate accounting of existing delegations of authority. Without reliable data on existing delegations of authority, FPS will face challenges effectively managing its delegations of authority program. In addition, the lack of reliable delegation data makes it difficult for FPS to ensure that delegated facilities are protected in a manner consistent with federal physical security standards and to provide its stakeholders with accurate and timely information for decision-making and external-reporting purposes. FPS’s cost estimation model that it is using to analyze the costs of providing law enforcement or security services does not fully align with leading practice identified in GAO’s Cost Guide. These leading practices are the basis for developing high-quality reliable cost estimates and help ensure that the cost estimates are comprehensive, well-documented, accurate, and credible. For example, following these practices should result in cost estimates that can, among other things, be replicated and updated. According to the Cost Guide, these leading practices can guide government managers as they assess the credibility of a cost estimate for decision-making purposes for a range of programs. We have previously reported that while the Cost Guide focuses on developing cost estimates for government acquisition programs, the leading practices are generally applicable to cost estimation in a variety of circumstances, including assessing an agency’s cost estimating model. Accordingly, we applied the Cost Guide’s leading practices to FPS’s cost estimation model. Given that FPS’s Interim Plan discusses the cost estimates developed with its cost model as one of the major criteria FPS uses to determine whether a delegation of authority should be granted, renewed or rescinded, and the importance of that decision for providing efficient and effective law enforcement and security services at federal facilities, we believe that ensuring the reliability of the cost model’s estimate is paramount. We found that FPS’s cost estimation model partially aligned with practices for producing comprehensive estimates and minimally aligned with those for producing well- documented and accurate estimates. Furthermore, the model does not align with practices for producing credible cost estimates. Table 1 shows our overall assessment of FPS’s cost estimation model compared to the four characteristics. Appendix II provides greater detail on our comparison of FPS’s model with the leading practices identified in GAO’s Cost Guide. A model for developing cost estimates is considered comprehensive if, among other things, it accounts for all possible costs over an appropriate period of time and is based on documentation that defines the program and is technically reasonable, as shown in table 1. FPS’s model partially aligns with these leading practices for developing comprehensive cost estimates. For example, FPS’s model examined the costs associated with a delegation of authority over a 5-year period, which we found to be sufficient for the purposes of FPS making a decision on a delegation. In addition, an FPS official told us that the technical inputs for estimating security costs in the model are based on an FSA. However, FPS’s Interim Plan does not require that an FSA be conducted prior to or as part of the delegation review process. We found that FPS also did not conduct or require the agency to obtain an FSA for the six requests for new or renewed delegations we analyzed involving the Departments of Commerce, the Interior, and State; the FTC; and NRC before determining whether those departments and agencies should be authorized to protect their facilities. During the course of this engagement, FPS included such a requirement in its draft directive, but FPS officials did not know when the draft directive would be completed and finalized. As a result, FPS’s cost estimation model may not have a solid technical basis for estimating security costs, a limitation that can compromise the quality of the cost estimate and affect FPS’s ability to make sound decisions on whether to grant, renew, or rescind a delegation. Appendix II provides greater detail on our comparison of FPS’s model with the leading practices of a comprehensive cost estimate identified in GAO’s Cost Guide. A model produces a well-documented cost estimate when, among other things, it includes (1) documentation on the source data, (2) clearly details the model’s calculations and results so the results can be replicated, and (3) provides explanations for choosing a particular methodology, as shown in table 1. FPS’s model minimally aligns with these leading practices for producing well-documented cost estimates. For example, FPS provided documentation on some of the sources of data that are programmed into the model, such as the sources for cost data on K-9 services and vehicles. The model also provides some steps that allow an estimate to be replicated, such as including mathematically logical formulas for its calculations. However, FPS’s model did not include documentation on the sources of other cost data, such as those related to training programs or career development, how it assessed data reliability, or how the data were normalized.documentation did not describe the methodology it uses to develop a cost estimate, including a description of the methods or the costs used in its summary of the estimate. Without providing clear documentation of the data and methodology used by a model, it is difficult for a cost analyst to replicate the results and ensure that FPS’s model and process are producing reliable cost estimates based on quality data and methods. Appendix II provides greater detail on our comparison of FPS’s model with the leading practices of a well-documented cost estimate identified in GAO’s Cost Guide. A cost estimation model should, among other things, include an uncertainty analysis (a way to assess variability in an estimate to reflect unknown information that could affect cost), be updated regularly to reflect changes to the current status, and be based on a historical record of costs and actual cost data, as shown in table 1. FPS’s model minimally aligns with these leading practices for producing accurate cost estimates. For example, the model’s calculations were based on a formula—that allowed any changes—such as those related to the security requirements or the security costs of the agency requesting the delegation—to be quickly updated. However, FPS’s model and process do not include an uncertainty analysis to determine where a cost estimate falls within the range of possible costs. A model that does not assess the level of confidence associated with an estimate may not have adequate contingency funding available if the actual costs exceed the estimate. In addition, the model does not document any historical use of costs. Historical data can provide insight into actual costs, such as security costs associated with protecting similar facilities. Without including these elements of the leading practices for accuracy, the model may produce cost estimates with biased results, impeding management’s ability to make sound decisions when reviewing a delegation. Appendix II provides greater detail on our comparison of FPS’s model with the leading practices of an accurate cost estimate identified in GAO’s Cost Guide. A credible model, among other things, provides a process for cross- checking its results with independent cost estimates, quantifies the levels of risk and uncertainty, and includes a sensitivity analysis—that is, it examines the effect of changing one assumption related to each project activity while holding all other variables constant in order to identify which variable most affects the cost estimate, as shown in table 1. FPS’s model does not align with these leading practices for producing credible cost estimates. For example, the model does not include an analysis to quantify the potential risks and identify the uncertainty around key assumptions, which can undermine the credibility of an estimate. In addition, the model did not include a sensitivity analysis that identifies a range of possible costs based on varying major assumptions. FPS officials stated that the model identifies key cost drivers and examines the effect of changes to these key costs, but this analysis was not included in the model, and FPS did not provide any supporting documentation of the analysis being part of the process. Without conducting analyses on the sensitivity, risk, and uncertainty associated with an estimate and validating the methods for producing the cost estimate, FPS may not have an understanding of the limitations associated with the cost estimate, and could make a delegation of authority recommendation without understanding the credibility of the cost estimate. Appendix II provides greater detail on our comparison of FPS’s model with the leading practices of a credible cost estimate identified in GAO’s Cost Guide. An FPS official told us that the cost estimation model was not necessarily in line with GAO’s cost estimation leading practices because the agency did not think a more rigorous model was warranted given the size and scope of the delegation program. However, Office of Management and Budget officials told us that FPS faced difficulties when comparing its security costs to that of an agency requesting a delegation and in discussions with FPS officials pointed out that FPS needs to establish a transparent process, when working with an agency to estimate these costs. As such, a reliable cost model is instrumental to establishing sound cost information for making decisions on delegations of authority. As previously discussed, the leading practices in the Cost Guide are applicable to a range of programs, such as FPS’s assessment of delegations of authority, but the extent to which the leading practices apply may vary, depending on the scope and complexity of an individual delegation. For example, conducting a sensitivity analysis may involve varying the key security requirements, such as the recommended countermeasures like the number of contract guards protecting a facility, to determine how the changes affect the overall cost estimate. We recognize that the application of all of these cost estimating leading practices to FPS’s cost estimating model would take time and financial resources. However, applying these leading practices would enable FPS to better identify and address issues with developing cost estimates, and provide its management and that of the agency requesting a delegation with reliable cost information on the financial impact of granting, renewing, or rescinding a delegation of authority. We analyzed the six requests for new or renewed delegations of authority FPS reviewed from June 2012 through May 2014, and found that FPS did not fully follow its Interim Plan when it reviewed five of the requests. According to FPS’s Interim Plan, FPS should conduct cost and capabilities analyses before making a decision to grant, renew, or rescind a delegation of authority. However, as shown in table 2, FPS conducted these required analyses for only the delegation involving SSA and did not conduct them for the other five delegations involving NRC, Commerce’s NIST, Interior, State, and FTC. Without conducting these analyses, FPS does not have a sound basis to determine whether cost or security considerations support its delegation of authority recommendations. In addition, FPS faces limitations ensuring that its contract requirements and ISC’s physical security standards are being met at delegated facilities. FPS conducted cost and capabilities analyses in reviewing the SSA’s request to renew a delegation of authority for contract guard services at a level II and a level IV facility in Durham, North Carolina. According to FPS’s cost analysis, in fiscal year 2013, it would have cost SSA about $3.6 million and FPS about $4.7 million to provide the contract guard services at these facilities. According to FPS officials, FPS would need an additional $1.1 million to train its contract guards to operate SSA’s technically complex security systems. FPS also completed a capabilities analysis, which showed that FPS could provide more of the required security services than SSA. According to SSA officials, the agency did not agree with FPS’s capabilities assessment because SSA did not believe that FPS had sufficient resources to meet SSA’s security needs. In January 2014, the Acting Under Secretary for NPPD renewed this delegation for 3 years based on FPS’s analyses and recommendation. FPS did not fully follow its Interim Plan when it reviewed NRC’s 2012 request to have the delegation renewed. Specifically, FPS conducted the required cost analysis but did not conduct the required capabilities analysis. FPS’s cost analysis showed that in fiscal year 2013 it would have cost NRC $6.5 million and FPS about $8 million to provide the contract guard services at those facilities. According to FPS officials, it would need an additional $1.5 million more to hire, train, and certify contract guards. Conducting the required capabilities analysis could have provided information on FPS’s capabilities versus NRC’s in overseeing a security guard contract, according to FPS’s Interim Plan. Such an analysis is to include ensuring that guards have the required training and certifications, and conducting inspections of guards’ duty stations. During the review process, NRC officials raised questions about FPS’s ability to oversee its contract guards, in part, because of our previous reports on challenges FPS faces with overseeing contract security guards at other federal facilities. Nonetheless, in 2013, based on FPS’s recommendation the Secretary of DHS rescinded this delegation, stating it was in the best interest of the government, but provided no additional justification. Since then, among other things, FPS has been responsible for awarding the guard contract and overseeing the guards deployed at NRC facilities in Rockville and Bethesda, Maryland. In addition, FPS did not ensure that there was not a lapse in the protection of NRC’s facilities as required by its Interim Plan. FPS and NRC officials told us that, since the contract was awarded in 2013, the guard contractor has not fully been meeting the terms of the contract. For example, 41 of the approximately 100 guards (41 percent) deployed to NRC facilities do not have the required L (equivalent to secret) or Q (equivalent to top secret) security clearances, as of February 13, 2015, according to NRC officials. In addition, according to FPS and NRC officials, the guard contractor had over 3,000 hours of open (unfilled) posts in NRC’s facilities, in part, due to challenges the contractor faced with hiring and retaining guards. Based on these open posts, an NRC official estimated that the agency was due a refund of about $100,000. To address the open post issue, the guard contractor deployed guard supervisors to these posts. According to FPS officials, this type of deployment prevents the supervisors from completing their other responsibilities including conducting post inspections to ensure that guards are at their respective posts. Moreover, FPS officials told us that although the contractor deducted the costs associated with the open posts, NRC is not getting the level of security services for which it is paying and this has negatively affected NRC. For example, if there were a potential threat at any of the open posts, there would not have been a guard to counteract the threat. In January 2015, after completing the contractor’s performance assessment report, FPS’s Contracting Officer decided that although the contractor’s overall performance has been less than satisfactory, the problem with open posts has not yet risen to the level of allowing the contract to expire or terminating the contract. However, FPS’s Contracting Officer is not recommending the contractor for similar contract guard services in the future. The Acquisition Division Director of FPS concurred with this recommendation. Regarding the other 4 requests for new or renewed delegations of authority we reviewed, based on FPS’s recommendations, the Secretary of DHS and the Under Secretary of NPPD renewed the delegations of authority for the Department of Commerce’s NIST facilities for 5 years, the Department of the Interior’s Hoover Dam for 2 years, and the State Department’s Enterprise Service Operations Center facility for 2 years, and granted FTC a new contract guard delegation for 3 years; but FPS did not conduct cost or capabilities analyses prior to making these recommendations as required by the Interim Plan. FPS officials explained that FPS did not conduct these analyses, in part, because it was not able to obtain comparable cost data or limited staff prevented it from conducting the analyses before the delegations expired. FPS officials also told us that the program is evolving and that it has yet to establish management controls to ensure that the analyses are conducted. Officials from Commerce, the Interior, State, and FTC expressed some concerns to us about the quality of FPS’s security services, the amount of time it takes FPS to review a delegation of authority, and the lack of transparency associated with FPS’s review process. Nonetheless, they told us that they agreed with FPS’s decision to renew or grant their delegations because they believed FPS faces resource and capability challenges. However, FPS remains responsible for ensuring that these facilities are protected in a manner that is consistent with ISC’s physical security standards. FPS’s Interim Plan identifies its 11 regional offices as stakeholders in its delegation review process. However, in some instances, the FPS regional offices where the delegated facility is located were not involved in the agency’s delegation review process. For example, officials from three of the four regions we interviewed were not aware of FPS’s Interim Plan or its decisions to renew delegations to Interior and State; grant FTC a delegation, and to rescind NRC’s delegation. FPS officials stated that the delegations program was being managed from FPS headquarters. Moreover, officials in one FPS region said that omitting the regions from the delegations review process could result in the region’s not meeting the requirements specified in a delegation, for example, overseeing the delegation to ensure that the delegated agency is meeting ISC standards. FPS headquarters officials explained that this program is evolving and that ongoing efforts such as its draft delegation directive (which was developed subsequent to the six delegations we analyzed) clarifies FPS regions’ roles and responsibilities related to the delegation review process and oversight of delegations. However, as of January 2015, FPS officials did not provide a timeframe for finalizing the draft directive. Given that federal facilities remain targets of potential terrorist attacks or other acts of violence, it is important that FPS manages its delegations of authority program effectively. However, FPS has not effectively managed its delegations of authority program. For example, FPS does not have reliable data to identify the number of delegations of authority it is responsible for reviewing and overseeing. Developing and implementing procedures to improve the accuracy of its delegation of authority data would enable FPS to ensure that delegated facilities are protected in a manner consistent with federal physical security standards and would provide its stakeholders with accurate and timely information for decision- making. FPS has developed a process for reviewing delegations that includes a cost and capabilities analyses. However, FPS could enhance its ability to produce reliable cost estimates by aligning its cost estimation model with leading practices to ensure its estimates are comprehensive, well documented, accurate, and credible. Such an approach, would give FPS a solid technical basis for making its delegation of authority recommendations to DHS management. Cost and capability analyses play a major role in helping FPS determine whether to grant another agency the authority to protect federal facilities, but for five of the six delegations we examined, FPS did not consistently conduct these analyses before making a recommendation to DHS’s management. It is important that FPS ensure that these analyses are consistently done. Without these analyses, FPS and DHS management faces limitations in making informed decisions about how best to protect delegated federal facilities from potential terrorist attacks or other acts of violence, protection that is FPS’s responsibility. Finally, given that FPS is still in the process of finalizing its draft directive, it has an opportunity to ensure that its delegations of authority program fully aligns with federal standards for effective program management. To improve the management of FPS’s delegations of authority program, we recommend that the Secretary of Homeland Security direct the Director of FPS take the following three actions: develop and implement procedures to improve the accuracy of its delegation of authority data; update FPS’s cost estimation model to align with leading practices to ensure it produces comprehensive, well-documented, accurate, and credible cost estimates; and establish management controls to ensure that FPS’s headquarters and regional office staff conduct required cost and capability analyses before FPS grants, renews, or rescinds a delegation of authority to a federal agency. We provided a copy of a draft of this report to DHS for review and comment. DHS provided written comments, reprinted in appendix III, agreeing with the report’s recommendations. DHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Homeland Security, the Director of the Federal Protective Service, the Administrator the General Services Administration, the Director of the Office of Management and Budget, and other interested parties. The report will also be available on the GAO website at no charge at http://www.gao.gov If you or your staff have any questions about this report, please contact Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Our report examines (1) the extent to which FPS’s delegations of authority program meets select federal standards and leading practices for effective program management and (2) whether FPS has followed its 2012 Interim Plan in reviewing select delegations of authority. To determine the extent to which FPS’s delegations of authority program meets select federal standards for effective program management, we analyzed FPS’s 2012 Interim Plan and 2014 draft delegations of authority directive—which outline the processes FPS is currently using to identify delegations of authority granted when FPS was part of GSA and how FPS is supposed to review delegations of authority to determine if they should be granted, renewed or rescinded—against leading practices identified in applicable federal standards. We analyzed FPS’s efforts to ensure the reliability of its delegations of authority data against internal controls specified in federal Standards for Internal Control in the Federal Government that provide reasonable assurance that an agency is operating efficiently and effectively. We also reviewed FPS’s delegations of authority data as of October 30, 2014 to determine the federal departments and agencies with delegated authority, the type of delegation received (e.g., law enforcement or contract guard), the number of facilities specified in the delegation, and the status of FPS’s review. We assessed the reliability of FPS’s data by comparing it to source documents provided by FPS and interviewing FPS officials about the controls in place to ensure its reliability of FPS’s delegation data, and, found the data to not be reliable as discussed in this report. GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, GAO-09-3SP (Washington, D.C.: March 2009). documented, accurate, and credible. The extent to which the characteristics are met is determined by the extent to which the underlying leading practices for each characteristic are incorporated. The Cost Guide identifies 20 leading practices for developing a cost estimate that include underlying tasks associated with each of the four characteristics of reliable cost estimates. GAO developed the Cost Guide to assist government agencies as they develop, manage, and evaluate the costs of capital projects. Although FPS does not directly implement or oversee implementation of capital projects at federal facilities, the agency develops cost estimates as part of its delegation of authority review process (through its cost estimation model) and needs reliable cost estimates to inform DHS’s decisions about whether to grant, renew, or rescind a delegation. As a result, most of the leading practices are applicable to the assessment of FPS’s cost estimation model. However, we found that three leading practices and one of the underlying tasks associated with the leading practices were not applicable, in part, because we were assessing a cost model rather than a cost estimate for an acquisition. Specifically, since we did not evaluate a cost estimate, we did not assess (1) the consistency of the technical baseline with the data cost estimate, (2) any mistakes in the costs estimate, or (3) if the estimating technique was used appropriately in the cost estimate. In addition, we did not assess earned-value- management reporting as it was not applicable to FPS’s delegation assessment process. For one leading practice, including all lifecycle costs, we adjusted the time period to reflect a shorter period that was sufficient for FPS’s decision-making needs for a delegation of authority. We also interviewed officials from FPS and the Office of Management and Budget about FPS’s process for reviewing delegations of authority. To determine whether FPS followed its Interim Plan in reviewing select delegations, we conducted case studies of the six requests for new or renewed delegations FPS reviewed from June 2012 through May 2014. These delegations involved the Department of the Interior’s Hoover Dam, the Department of State’s Enterprise Service Operations Center, the Department of Commerce’s National Institute of Standards and Technology, the Federal Trade Commission, the Nuclear Regulatory Commission, and the Social Security Administration. For each of our six case studies, to the extent available, we reviewed the delegation of authority, cost and capabilities analyses, and interviewed officials from FPS’s headquarters and 4 of its 11 regions. We selected these regions because the delegated facilities are located in these regions. We also interviewed officials from the delegated departments and agencies to obtain information on FPS’s review of their delegations and how FPS’s recommendations may have affected the protection of their facilities. Our case studies are not generalizable but provide insights into FPS’s ability to follow its 2012 Interim Plan in delegations of authority. We conducted this performance audit from January 2014 to March 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We assessed FPS’s Cost Estimation Model using the GAO Cost Guide’s framework of the four characteristics—comprehensive, well-documented, accurate, and credible—associated with high-quality, reliable cost estimates. Specifically, we assessed FPS’s cost model based on most of Table 3 the leading practices associated with these four characteristics.provides greater detail on our comparison of the model with the leading practices that are aligned with the four cost estimating characteristics. In addition to the contact named above, Tammy Conquest, Assistant Director; Karen Richey, Assistant Director; Jennifer DuBord; Sharon Dyer; Geoff Hamilton; Delwen Jones; Abishek Krupanand; Steve Martinez; and Kelly Rubin made key contributions to this report.

Summary: FPS's primary mission is to protect the almost 9,000 federal facilities that are held or leased by the General Services Administration. FPS also manages the Department of Homeland Security's (DHS) delegations of authority (delegations) program, which involves, among other things, reviewing requests by agencies to protect their own facilities instead of FPS and making recommendations to DHS about whether to grant, renew, or rescind such delegations. In response to direction in the conference report accompanying the Consolidated Appropriations Act, 2012, FPS prepared its Interim Plan that outlines FPS's process for reviewing existing and newly requested delegations. GAO was asked to review FPS's management of this program. This report covers (1) the extent to which FPS's delegations program meets select federal standards and (2) whether FPS has followed its Interim Plan in reviewing delegations. GAO reviewed FPS's 2012 Interim Plan and data on delegations; compared FPS's Interim Plan to federal standards; and analyzed the six requests for new or renewed delegations FPS reviewed from June 2012 through March 2014. The Federal Protective Service's (FPS) delegations of authority program does not fully meet applicable federal standards GAO identified for effective program management. FPS lacks reliable data, as called for by federal Standards for Internal Control, to accurately identify all the delegations FPS is responsible for managing and overseeing to ensure the protection of federal facilities. Specifically, of the 62 delegations of authority that FPS officials said were verified as active, GAO found that 12 had either expired or been rescinded. Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external- reporting purposes. FPS officials stated that poor recordkeeping contributed to the data's unreliability, but FPS has not established procedures to ensure data reliability. Without reliable data on delegations of authority, FPS will face challenges effectively managing this program. FPS's model for estimating the costs associated with a delegation—set forth in its 2012 Interim Plan —does not fully align with the relevant leading practices outlined in GAO's Cost Estimating and Assessment Guide . These leading practices help ensure reliable cost estimates that are comprehensive, well documented, accurate, and credible. GAO found that FPS's cost estimation model partially aligned with practices for producing comprehensive estimates and minimally aligned with those for producing well-documented and accurate estimates. Furthermore, the model does not align with practices for producing credible cost estimates because, among other things, it does not include a sensitivity analysis, which identifies a range of possible costs based on varying assumptions. Without fully aligning the cost model with leading practices, FPS faces limitations developing reliable cost estimates that support its delegations of authority recommendations. For five of the six agency requests for new or renewed delegations of authority that GAO analyzed, FPS did not conduct the required cost and security- capabilities analyses before making its recommendation to grant, renew, or rescind the delegation. The Interim Plan calls for these analyses to form the basis of FPS's recommendations. Specifically, FPS conducted the required analyses for only the delegation involving the Social Security Administration and did not conduct these analyses for the other five delegations involving facilities of the Departments of Commerce, Interior, and State; the Nuclear Regulatory Commission; and the Federal Trade Commission. According to FPS officials, they were not always able to obtain, from the agency requesting a delegation, comparable cost data to complete the cost model. FPS officials also acknowledged that FPS has yet to establish management controls to ensure that required analyses are conducted. Without these analyses, FPS does not have a sound basis to determine whether cost or security considerations support its delegations of authority recommendations. GAO recommends that the Secretary of DHS direct FPS (1) to improve the accuracy of its delegation data, (2) update its cost estimation model to align with leading practices, and (3) establish management controls to ensure that its staff conducts the required cost and capability analyses. DHS concurred with the recommendations.