FEMA’s workforce consists of employees hired under both Title 5 and the Stafford Act, as well as individuals from two other workforce components who are not FEMA employees, but who can be deployed for disaster response: the DHS Surge Capacity Force and FEMA Corps. Title 5 employees are permanent and temporary employees who form FEMA’s day-to-day workforce, and can be deployed as needed during a disaster. Stafford Act employees include CORE and Reservists hired specifically to support disaster-related activities on a temporary or intermittent basis. COREs are temporary employees with 2- to 4-year appointments, while Reservists work on an intermittent basis and are deployed as needed. Surge Capacity Force volunteers include employees of other DHS components who augment FEMA’s workforce in the event of a catastrophic disaster. Their first and only deployment as of May 2017 was to assist in response and recovery efforts after Hurricane Sandy in 2012. FEMA manages and coordinates the Surge Capacity Force program. FEMA Corps is a national service program managed by AmeriCorps National Civilian Community Corps (NCCC). FEMA Corps members support disaster response and recovery efforts and work under the direction of FEMA staff. As shown in table 1 below, FEMA’s available disaster response workforce, including Surge Capacity Force and FEMA Corps totaled over 22,600 in March 2017. FEMA’s workforce categories are subject to different employee rights and legal protections. For example, Title 5 employees are generally afforded notice and appeal rights, while Reservists serve in temporary intermittent positions and can be terminated at any time with or without cause. In 2012, FEMA issued a policy directive outlining procedures for reporting misconduct within the agency, conducting administrative investigations, and reporting actions taken in cases where the misconduct allegation was sustained. The FEMA Administrative Investigations Policy directive (FD 123-19) lays out misconduct responsibilities for employees, managers, and supervisors, and for the personnel management offices involved in managing misconduct. The directive also describes three types of administrative investigations: Managerial Inquiry: managers or supervisors may be assigned to conduct an inquiry when the allegation is not complex (e.g., tardiness, absence without leave) and involves a minimal number of witnesses. Office of the Chief Security Officer (OCSO) Investigation: OCSO personnel are assigned to conduct investigations of allegations that are criminal in nature, or have the potential to be criminal in nature, for example travel card fraud or a physical altercation. Independent Investigation: senior FEMA or other government officials may be assigned to conduct investigations into complex allegations that involve multiple offices and witnesses, senior employees, or prohibited personnel practices such as political coercion. The process for conducting investigations is further discussed in FEMA’s Administrative Investigations Policy manual (FEMA Manual 123-19-1). FEMA’s Employee Discipline Manual (FEMA Manual 255-3-1) describes the policies, procedures, and responsibilities for taking conduct-related discipline against permanent Title 5 employees. The manual discusses options for disciplinary actions, which include reprimands and suspensions of 14 days or less, and adverse actions, which include suspensions for 15 days or more, demotions, and removals. The manual also lays out employee grievance and appeal rights. The policies and procedures described in the manual apply solely to permanent Title 5 employees. As discussed later in this report, the discipline and appeals process varies for other workforce categories. Within FEMA, three primary offices are involved in reviewing, investigating, and adjudicating employee misconduct allegations. OCSO Internal Investigations Branch (IIB): conducts investigations related to more serious allegations, such as those that may involve potential criminal misconduct. The Office of the Chief Component Human Capital Officer (OCCHCO) Labor and Employee Relations Branch (LER): advises supervisors who conduct lower level investigations and inquiries, such as time and attendance violations, and provides recommendations on any counseling or any disciplinary or adverse action for all cases. The Office of the Chief Counsel (OCC) Personnel Law Branch (PLB): provides legal advice during investigations and conducts legal reviews of certain reports of investigation and all disciplinary and adverse actions. Representatives from these three offices form FEMA’s Administrative Investigations Directive (AID) Committee, which reviews misconduct allegations, assigns investigators, and tracks the status of open cases. DHS OIG also plays a role in reviewing and investigating certain misconduct allegations. DHS Management Directive 0801.1 requires officials from all DHS components, including FEMA, to refer certain categories of misconduct to DHS OIG for review, such as allegations of criminal misconduct against a DHS employee and any allegations of misconduct against senior employees. After reviewing the allegation, DHS OIG may elect to initiate an investigation or refer the case back to the component, such as FEMA, for review. DHS OIG receives complaints (from employees, supervisors, the public, and agency referrals) against employees in all DHS components through the DHS OIG Hotline, which is a resource for reporting corruption, fraud, waste, abuse, mismanagement, or misconduct. Table 2 below shows the average number of misconduct complaints received through the DHS OIG Hotline from fiscal year 2014 through 2016 by selected DHS component. These complaints represent alleged offenses only, and not final actions or adjudication results. FEMA receives allegations of employee misconduct from individuals both within and outside the agency. Individuals (including members of the public) can report these allegations through a number of different mechanisms, including, but not limited to, FEMA’s OCSO Tipline, LER specialists, and the DHS OIG Hotline. Employees can also report misconduct to their supervisors and union representatives. The AID Committee reviews most allegations, including those declined by DHS OIG and returned to FEMA. LER reviews complaints received directly from managers or employees to determine if they need to be discussed at the AID Committee meetings. Allegations may then be assigned to one of the three types of administrative investigations discussed earlier. Once completed, reports of investigation are forwarded to LER for review. LER recommends appropriate disciplinary or adverse action, if warranted. Figure 1 below outlines the general steps in FEMA’s misconduct process, including DHS OIG’s role in reviewing and investigating allegations. Variations in potential case outcomes and the appeals process by workforce category are discussed later in this report. FEMA has developed a policy outlining procedures regarding investigations of misconduct as documented in FEMA’s Administrative Investigations Policy directive. The directive applies to all FEMA personnel. While FEMA Corps and Surge Capacity Force members are not FEMA employees, OCSO officials stated that the investigations process is the same regardless of the workforce category. FEMA has also documented misconduct policies and procedures regarding options to address misconduct and appeals for Title 5 and CORE employees. For Title 5 employees the options to address misconduct include both disciplinary and adverse actions. FEMA Corps disciplinary policies and procedures are the responsibility of AmeriCorps NCCC and are documented in their member handbook. Figure 2 outlines the options to address misconduct and appeal rights for Title 5, CORE, and FEMA Corps as documented in their respective employee discipline and program manuals. According to LER officials, as of February 2017, most supervisors had been offered training on FEMA’s 2015 Employee Discipline Manual, which applies to Title 5 employees. Three more training sessions are planned for 2017. Additionally, PLB partnered with LER in 2016 to offer misconduct and documentation training for all supervisors. In 2016, PLB and LER completed 21 joint trainings. They held two more joint trainings in March 2017. FEMA has not documented misconduct policies and procedures for Surge Capacity Force members. DHS issued the Surge Capacity Force Concept of Operations in 2010, which outlines FEMA’s base implementation plan for the Surge Capacity Force. However, the document does not address any elements pertaining to Surge Capacity Force human capital management, specifically misconduct and disciplinary policies and procedures. According to the FEMA Surge Capacity Force Coordinator, despite the lack of documentation, any incidents of misconduct would likely be investigated by FEMA’s OCSO, which would then refer the completed report of investigation to the employee’s home component for adjudication and potential disciplinary action. Additionally, OCSO officials said that while they were unaware of any misconduct investigations involving Surge Capacity Force members to date, if an incident were to occur they would follow the procedures in the Administrative Investigations Policy directive and also notify the member’s home component of the incident. However, although no allegations of misconduct were made at the time, the FCO in charge of one of the Hurricane Sandy Joint Field Offices said he had not seen anything in writing or any formal guidance that documents or explains how the process would work and stated that he would have had to contact FEMA headquarters for assistance in determining how to address any misconduct. Furthermore, he noted that taking the time to figure out the Surge Capacity Force misconduct process would have detracted from time spent on the Joint Field Office’s mission. LER officials stated that they would be able to walk through the procedures with supervisors and managers if asked. However, because these procedures are not documented, the process is not transparent and information is not readily available. LER officials noted that while LER specialists can quickly answer questions, it would be beneficial for the procedures to be documented. A PLB official also told us that FEMA should have a written policy for potential Surge Capacity Force misconduct. Standards for Internal Control in the Federal Government advises management to develop and maintain documentation of its internal control system. This documentation can assist in management’s ability to communicate controls to personnel, and is a means to retain organizational knowledge as well as communicating that knowledge to external parties. Without documented guidance, FEMA cannot ensure that Surge Capacity Force misconduct is addressed adequately in a timely and comprehensive manner, which could negatively affect the extent to which Joint Field Offices can accomplish their mission after a disaster. Furthermore, FEMA’s 2015 update to the Surge Capacity Force Concept of Operations calls for increasing the size of the Surge Capacity Force workforce from its current size of approximately 6,000 volunteers to 36,000 volunteers and also does not address any human capital management issues, including misconduct. This planned expansion further underscores the importance of documenting policies and procedures in order to address potential misconduct. FEMA’s Reservist Program Manual lacks documented policies and procedures on disciplinary options to address misconduct and appeal rights for Reservists. Both LER and PLB officials told us that, in practice, disciplinary actions for Reservists are limited to reprimands and termination. According to these officials, FEMA does not suspend Reservists because they are an intermittent, at-will workforce deployed as needed to respond to disasters. FCOs and cadre managers have the authority to demobilize Reservists and remove them from a Joint Field Office if misconduct occurs, which may be done in lieu of suspension. Furthermore, LER and PLB officials also told us that, in practice, FEMA grants Reservists the right to appeal a reprimand or termination to their second-level supervisor. Although officials stated that FEMA is carrying out these policies and procedures in practice, the actions are not documented in the Reservist Program Manual. Standards for Internal Control in the Federal Government advises management to document policies for each unit in its area of responsibility. Each unit, with guidance from management, determines the policies necessary to operate, as well as documents policies in the appropriate level of detail to allow management to effectively monitor activity. According to FEMA officials, because of the at-will nature of their employment, Reservists are not subject to the same policies, procedures, and appeal rights as Title 5 employees, such as a suspension as an option to address misconduct. However, the procedures that are executed in practice are not reflected in the Reservist Program Manual. Without documented Reservist disciplinary options and appeals policies, supervisors and Reservist employees may not be aware of all aspects of the disciplinary and appeals process. Additionally, seven supervisors and managers in two of the three regions and one of the three cadres we spoke with noted that there is a perception of inconsistency and unfairness in the discipline process. For example, one manager told us that if cadre management provided more information on outcomes in addressing misconduct, it would help improve the perception that misconduct is being seriously addressed at FEMA. Clear documentation of the Reservist disciplinary options and appeals policies and procedures currently in practice would help to address the concerns of inconsistency. FEMA revised its employee disciplinary manual for Title 5 employees in 2015, and in doing so, eliminated the agency’s table of offenses and penalties. Tables of offenses and penalties are used by agencies to provide guidance on the range of penalties available when formal discipline is taken. They also provide awareness and inform employees of the penalties which may be imposed for misconduct. Since revising the manual and removing the table, FEMA no longer communicates possible punishable offenses to its entire workforce. Instead, information is now communicated to supervisors and employees on an individual basis. Specifically, LER specialists currently use a “comparators” spreadsheet with historical data on previous misconduct cases to determine a range of disciplinary or adverse actions for each specific misconduct case. The information used to determine the range of penalties is shared with the supervisor on a case-by-case basis; however LER specialists noted that due to privacy protections they are the only FEMA officials who have access to the comparators spreadsheet. PLB and LER officials stated that the new comparators spreadsheet is an improvement over the old table, which contained overly broad categories and had not been updated since 1981. According to officials, the comparators spreadsheet is easier to use and thus it is easier to ensure cases are consistent across the agency. Supervisors and managers we spoke with shared their perspectives on how offenses and penalties are communicated both through the prior table and the new comparators spreadsheet. Specifically, 11 supervisors and managers in all three regions and cadres we spoke with, as well as both union representatives we interviewed, cited the benefits of a table in communicating punishable offenses and the range of penalties. These benefits included transparency, consistency, and possible deterrence against engaging in misconduct. For example, one supervisor noted that a table of offenses and penalties is beneficial for both employees and supervisors because it removes ambiguity and makes the disciplinary process more transparent. Additionally, as discussed earlier, other supervisors and managers told us that there is a perception that misconduct cases are handled inconsistently. However, management officials in one region, and one supervisor in another region, noted they preferred the new case-by-case comparators system and did not see benefits to having a table of offenses and penalties. Another manager noted that a table was useful in certain cases with specific rules, such as travel card misuse; however, many cases are more complicated and in those situations a strict table is less effective. The remaining supervisors and managers did not offer their perspective on this topic. Standards for Internal Control in the Federal Government advises management to consider standards of conduct, assigned responsibility, and delegated authority when establishing expectations. Management establishes expectations of competence for key roles as well as for all personnel through policies within internal control systems. Because information about offenses and penalties is not universally shared with supervisors and employees, FEMA management are limited in their ability to set expectations about appropriate conduct in the workplace and to communicate consequences of inappropriate conduct. Additionally, a FEMA OCCHCO official noted that FEMA is considering re-introducing a table which would inform employees and supervisors of misconduct offenses and penalties. Communicating information about offenses and common ranges of penalties, such as in a summary table that does not include individual case information, could help to provide transparency for employees and their supervisors on the range of penalties to expect for different types of misconduct and mitigate the perception that misconduct is handled inconsistently across FEMA’s workforce. The three offices on the AID Committee involved in investigating and adjudicating employee misconduct complaints each maintain separate case tracking spreadsheets with data on employee misconduct to facilitate their respective roles in the process. OCSO collects data in a case tracking spreadsheet about employee misconduct complaints and investigations. For example, the spreadsheet contains fields with narrative descriptions of alleged offenses and investigation updates, the locations and FEMA regions where alleged offenses occurred, and the number of days an investigation was open. According to agency officials, all of the cases discussed during weekly AID Committee meetings are in the OCSO case tracking spreadsheet. LER also collects data on employee misconduct complaints in a case tracking spreadsheet. Specifically, LER records information on lower- level allegations that do not rise to the level of AID Committee review as well as adjudication information for allegations which were investigated by OCSO. In addition to employee misconduct complaints, LER specialists record all inquiries from supervisors in the LER case tracking spreadsheet, including questions about performance, grievances, and employee counseling. Fields in the LER case tracking spreadsheet include, for example, narrative descriptions of alleged offenses and case summaries, comments with case status updates, and the disciplinary or adverse actions taken, if any. PLB collects data on misconduct-related disciplinary or adverse actions it reviews in a case tracking spreadsheet. Fields in the PLB spreadsheet include narrative descriptions of the charge or issue, the employee position and type, and the disciplinary or adverse action taken. According to PLB officials, the data are based on information provided by LER. We analyzed data provided by OCSO in its case tracking spreadsheet and found that there were 595 complaints from January 2014 through September 30, 2016. The complaints involved alleged offenses of employee misconduct which may or may not have been substantiated over the course of an investigation. Some complaints involved multiple allegations of various offenses against multiple subjects. In order to better summarize the number and type of alleged offenses, we developed eight general categories (see table 3 below). Based on our analysis, the 595 complaints contained approximately 799 alleged offenses from January 2014 through September 30, 2016. As shown in figure 3 below, the most common type of alleged offenses were integrity and ethics violations (278), inappropriate comments and conduct (140), and misuse of government property or funds (119). For example, one complaint categorized as integrity and ethics involved allegations that a FEMA employee at a Joint Field Office was accepting illegal gifts from a FEMA contractor and a state contractor. Another complaint categorized as inappropriate comments and conduct involved allegations that a FEMA employee’s supervisor and other employees had bullied and cursed at them, creating an unhealthy work environment. Finally, a complaint categorized as misuse of government property or funds involved allegations that a former FEMA employee was terminated but did not return a FEMA-owned laptop. LER officials provided summary data on employee misconduct outcomes separately from the LER case tracking spreadsheet. According to the summary data, there were 546 disciplinary or adverse actions related to employee misconduct taken during the last three calendar years — from January 2014 through December 2016. Of those actions, the most common were removals or terminations (354), reprimands (115), suspensions of 14 days or less (64), and suspensions of 15 days or more (6). The most common employee types affected by actions were Reservist (235) and Title 5 (110). We also analyzed data provided by PLB in its case tracking spreadsheet and found that PLB reviewed 454 final disciplinary or adverse actions related to employee misconduct from January 2014 through September 30, 2016. The most common types of action were reprimands (144), suspensions ranging from 1 to 45 days (121), and terminations (118). The most common employee types affected by actions were Title 5 (265), CORE (180), and Reservist (6). There are several potential explanations for the differences between the LER and PLB data on employee misconduct outcomes. A PLB official stated that PLB does not review all disciplinary actions against Reservists; therefore, LER Reservist actions may not appear in the PLB spreadsheet. Further, LER officials stated that they recently started adjusting their recordkeeping and it was possible that some actions were not input by LER specialists into the case tracking spreadsheet. Differences in the data may also be related to limitations we identified in the spreadsheets, as discussed below. OCSO, LER, and PLB collect data on employee misconduct and outcomes, but limited standardization of fields and entries within fields, limited use of unique case identifiers, and a lack of documented guidance on data entry restricts their usefulness for identifying and addressing trends in employee misconduct. We found that there was limited standardization of fields based on our review of OCSO, LER, and PLB case tracking spreadsheets. For example, we attempted to summarize misconduct allegations by employee type using the OCSO spreadsheet. Out of approximately 704 subjects named in complaints from January 2014 through September 30, 2016, the most common employee type was unknown because either the information was not consistently available, or not enough information was available in the case tracking spreadsheet. In 2014 and 2016, the OCSO spreadsheet sometimes included information on the subject’s employee type embedded within narrative summary of allegation fields. In 2015, that information was sometimes included in the narrative fields and sometimes listed in a subject type field unique to that year. There was also limited standardization of entries within fields. For example, in all years the offense field in the OCSO spreadsheet consisted of text entries that described similar offenses in different ways, such as “Travel Card Violation” and “Travel Policy Violation”, or multiple offenses related to a specific complaint, such as “Fraud / Travel Card Violation”. The LER spreadsheet also contained examples of fields with limited standardization of entries. For example, the fields which described a subject’s pay grade consisted of varied text entries, such as “9”, “GS-09”, and “GS-9”. The PLB spreadsheet had similar issues with other fields. Limited standardization of fields and entries within fields restricts the usefulness of the data for identifying and addressing trends in employee misconduct because it makes timely evaluation, summarization, and verification of the data more difficult. We found that there was limited use of unique case identifiers in the OCSO, PLB, and LER case tracking spreadsheets. The OCSO spreadsheet contained several unique case identifier fields, including an IIB case number, OIG case number, and incident number. However, the LER and PLB spreadsheets provided to GAO did not contain these unique case identifier fields. A PLB official confirmed that the LER and PLB case tracking spreadsheets do not include case numbers as identifiers, only subject names. OCSO officials also stated that LER does not use the OCSO IIB case number or the OIG case number, although LER does have access to the OCSO IIB case number from AID Committee meetings. As a result, the spreadsheets do not share the same unique identifier, which makes it more difficult to track the status and outcome of cases across the three case tracking spreadsheets. OCSO, LER, and PLB officials stated that they do not have data dictionaries or documented guidance on data entry for their respective case tracking spreadsheets. A PLB official reported that data are entered into the PLB spreadsheet by a paralegal and spot-checked by a senior PLB official. LER officials noted that they did not provide data dictionaries or guidance because the original case tracker involved a simple Excel spreadsheet rather than a more complicated database system. However, a lack of documented guidance on data entry may make it more difficult to maintain and verify the completeness and accuracy of the data. For example, we identified variations in data entry into the LER case tracking spreadsheet across LER specialists. In 2015, of the 9 LER specialists who entered information into the case tracking spreadsheet, 6 specialists did not enter information into the employee pay grade field, 2 specialists sometimes entered information, and 1 specialist always entered information. Standards for Internal Control in the Federal Government advises management to process data into quality information which is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Additionally, management should evaluate processed information, make revisions when necessary so that the information is quality information, and use the information to make informed decisions. As described above, FEMA employee misconduct data are not readily accessible and cannot be verified as accurate and complete on a timely basis. These limitations restrict management’s ability to process the data into quality information which can be used to identify and address trends in employee misconduct. For example, an OCSO official stated that senior OCSO officials recently requested employee misconduct information based on employee type, such as the number of Reservists. However, the data are largely captured in narrative fields, making it difficult to extract without manual review. LER officials stated that LER specialists do not regularly conduct trend analysis on employee misconduct cases, but if they notice an apparent trend such as a number of cases involving misuse and non- payment of travel credit cards they will discuss it during quarterly meetings with component management. Five supervisors and management officials from each of the three regions we spoke with said that information on trends and patterns in employee misconduct would be useful. For example, supervisors could use trend analysis to identify specific types of employee misconduct which have become more common, allowing them to send out policy guidance or schedule targeted trainings to help address the issue. LER and OCSO are taking steps to improve their case tracking spreadsheets. Specifically, LER officials reported that they began using Microsoft SharePoint software in January 2017 which includes drop-down selections for all fields except the subject name and comments. The officials stated that they switched to SharePoint in response to DHS requests for specific misconduct information as well as our requests, which raised their awareness of the LER spreadsheet’s limitations. Similarly, an OCSO official stated that OCSO planned to add new fields to their spreadsheet which will make it easier to generate reports and show trends. These are positive steps towards addressing the issues with employee misconduct data quality identified above. However, it is not clear that they will be sufficient to address each of the data limitations we identified and improve the ability to conduct trend analysis. For example, although the LER SharePoint spreadsheet does include an entry number field, it was unclear whether that would allow officials to track the status and outcomes of specific cases across all three case tracking spreadsheets. New fields and increased use of drop-down selections in the LER SharePoint spreadsheet may help improve standardization of fields and entries within fields, but LER specialists may differ in how they interpret fields without documented guidance on data entry. Additionally, it is unclear whether OCSO’s modifications will include increased use of drop-down selections or other means to standardize entries. An OCSO official stated that they are also exploring DHS OIG’s database software, and noted that, if it could be adapted for FEMA’s purposes, it would be a substantial improvement. There are a number of possible quality control measures that could be implemented to help improve the usefulness of FEMA’s data for use in identifying and addressing trends in employee misconduct. At a minimum, based on our analysis of FEMA’s misconduct spreadsheets, the offices could: add additional drop-down fields with standardized entries to make fields easier to summarize; add unique case identifier fields to improve the ability to track cases across the three program offices’ case tracking spreadsheets; develop guidance documents to ensure standardized data entry within each office, including a procedure for quality control checks; or consider adopting the use of database software, which could improve standardization and case tracking across offices. These actions, combined with routine reporting on misconduct trends, could improve upon the initial steps already underway at LER and OCSO and better enable FEMA to manage and report on misconduct information. In accordance with FEMA’s Administrative Investigations Policy directive, officials from OCSO, LER, and PLB conduct weekly AID Committee meetings to coordinate information on misconduct allegations and investigations. The committee reviews allegations, refers cases for investigation or inquiry, and discusses the status of investigations. According to PLB officials, FEMA’s process for addressing employee misconduct was ad hoc and informal prior to the release of the directive in 2012. For example, officials from key offices did not always meet and share information on a regular basis, as they do now. PLB officials noted that a new FEMA Chief Counsel in 2010 drove changes calling for a formalized directive and clear instructions for managing misconduct. In addition to the weekly AID Committee meetings, LER and PLB officials stated that they meet on a regular basis to discuss disciplinary and adverse actions and ensure that any penalties are consistent and defensible in court. Employee misconduct information is also shared directly with FEMA’s Chief Security Officer and Chief Counsel. For example, OCSO provides the Chief Security Officer with a monthly report of all open investigations. Additionally, PLB provides the Chief Counsel with a monthly report of significant employee litigation, and includes in that report a list of all significant investigations, such as those involving high-level employees as the subject or witness in a case. Within FEMA, these regular meetings and status reports provide officials from key personnel management offices opportunities to communicate and share information about employee misconduct. FEMA also provides DHS OIG with information on employee misconduct cases on a regular basis. DHS Management Directive 0810.1 requires that all DHS organizational elements, including FEMA, provide monthly reports to DHS OIG on all open investigations. OCSO complies with this requirement and sends a monthly report that includes updates on investigative activity to DHS OIG. OCSO officials stated that they also provide limited outcome information on a case-by-case basis if DHS OIG specifically requests this information. According to OCSO and DHS OIG officials, DHS OIG does not regularly provide FEMA with updates on ongoing investigations it conducts. However, OCSO officials stated they ask DHS OIG for status updates on these cases frequently, especially if the employee was placed on administrative leave during the investigation. Our review indicates that OCSO has not established effective procedures to ensure that all cases referred to FEMA by DHS OIG are accounted for and subsequently reviewed and addressed. As discussed earlier, FEMA is required to refer certain misconduct allegations to DHS OIG for review before taking any action. OCSO officials told us they follow the guidelines closely and refer all serious misconduct allegations to DHS OIG for initial review. They also noted that DHS OIG declines to investigate and refers most cases back to FEMA for action. As also discussed above, OCSO sends a monthly report of open investigations to DHS OIG. However, while these reports provide awareness of specific investigations, according to OCSO officials, neither office reconciles the reports to a list of referred cases to ensure that all cases are accounted for. We reviewed a non-generalizable random sample of employee misconduct complaints DHS OIG referred to FEMA for review and found that FEMA did not adequately track all referred complaints and therefore could not ensure that all complaints in the sample we selected were reviewed and addressed at the time of our inquiry. Specifically, we tracked a random sample of 20 fiscal year 2016 employee misconduct complaints DHS OIG declined to investigate and referred to FEMA for action. We found that FEMA missed 6 of the 20 complaints during the referral process and had not reviewed them at the time of our inquiry. DHS OIG referred 3 of the 6 complaints to FEMA a year or more prior to our review. As a result of our review, FEMA subsequently took action to review the complaints. The AID Committee recommended that OCSO open inquiries in 3 of the 6 cases to determine whether the allegations were against FEMA employees, assigned 2 cases to LER for further review, and closed 1 case for lack of information. According to an OCSO official, OCSO subsequently determined that none of the allegations in the 3 cases they opened involved FEMA employees and the cases were closed. The remaining 2 cases were open as of April 2017. The results from our sample cannot be generalized to the entire population of referrals from DHS OIG to FEMA; however, they raise questions as to whether there could be additional instances of misconduct complaints that FEMA has not reviewed or addressed. FEMA OCSO officials offered several possible explanations for why the complaints we identified were missed. According to these officials, they sometimes receive large batches of complaints through the FEMA Tipline – some of which may be duplicative. DHS OIG referrals also come in through the Tipline and officials said that it is possible that they may not always accurately identify and record all of the referrals for the AID Committee since some of them are misclassified and some do not involve FEMA employees. Standards for Internal Control in the Federal Government advises management to perform ongoing monitoring – including comparisons and reconciliations or other routine actions. Such activities, either undertaken internally within OCSO or in coordination with DHS OIG, could improve the process. A senior OCSO official agreed that reconciliation procedures would help ensure that all complaints referred by DHS OIG to FEMA are accounted for and noted that FEMA is working with DHS OIG to improve reporting processes and case reconciliation. Employee misconduct can detract from FEMA’s mission and negatively impact public perceptions of the agency, particularly when associated with disaster response efforts. Given the broad scope of FEMA’s mission and the growth and different categories that make up its workforce, an effective process is key to mitigating any negative employee misconduct effects. FEMA has taken actions to manage the employee misconduct investigation and adjudication process. Specifically, FEMA has developed and documented misconduct policies and procedures for most of its employees, and has established procedures for regular internal communication and coordination, as well as information sharing with DHS OIG. However, misconduct policies and procedures for Surge Capacity Force members and outcome options and appeals policies and procedures for Reservists are not documented, and FEMA does not communicate the range of penalties for offenses to all employees. Clear documentation establishing who is responsible for investigating and adjudicating misconduct is especially important given FEMA’s goal of significantly expanding the Surge Capacity Force. Because the Reservist disciplinary action options and appeals currently in practice are not documented, FEMA supervisors and Reservist employees may not be aware of all aspects of the process. Similarly, the lack of communication on the range of penalties for specific offenses to FEMA’s workforce limits management’s ability to set expectations about appropriate conduct in the workplace and to communicate consequences of inappropriate conduct. Clearly documented policies and procedures for all workforce categories and communication about offenses and penalties could help to better prepare management to address misconduct and to mitigate any perceptions that misconduct is handled inconsistently across FEMA’s workforce. In addition, while several FEMA offices collect data on employee misconduct allegations, investigations, and outcomes, limitations related to how the data are collected and managed restrict their usefulness for identifying and addressing trends in employee misconduct. Addressing these limitations by implementing quality control measures could improve FEMA’s ability to track misconduct cases and to identify potential problem areas and opportunities for targeted training. Moreover, developing reconciliation procedures to track cases referred from DHS OIG to FEMA could help reduce the risk that FEMA does not address all misconduct complaints. In order to improve employee misconduct policies and procedures, the Secretary of Homeland Security should direct the FEMA Administrator to take the following three actions: document policies and procedures to address potential Surge document Reservist disciplinary options and appeals policies and procedures that are currently in practice at the agency; and communicate the range of penalties for specific misconduct offenses to all employees and supervisors. In order to better identify and address trends in employee misconduct, the Secretary of Homeland Security should direct the FEMA Administrator to take the following actions: improve the quality and usefulness of the misconduct data it collects by implementing quality control measures, such as adding additional drop-down fields with standardized entries, adding unique case identifier fields, developing documented guidance for data entry, or considering the adoption of database software; and once the quality of the data is improved, conduct routine reporting on employee misconduct trends. In order to ensure that all allegations of employee misconduct referred by DHS OIG are reviewed and addressed, the Secretary of Homeland Security should direct the FEMA Administrator to develop reconciliation procedures to consistently track referred cases. We provided a draft of this report to DHS and FEMA for review and comment. DHS provided written comments which are reproduced in appendix II. In its comments, DHS concurred with our recommendations and described actions planned to address them. FEMA and DHS OIG also provided technical comments, which we incorporated as appropriate. With regard to our first recommendation, that FEMA document policies and procedures to address potential Surge Capacity Force misconduct, DHS stated that FEMA is developing a Human Capital plan for the Surge Capacity Force and will include policies and procedures relating to potential misconduct. DHS noted that these policies and procedures will take into account FEMA’s limited authorities over Surge Capacity personnel who are not FEMA employees. DHS estimated that this effort would be completed by June 30, 2018. This action, if fully implemented, should address the intent of the recommendation. With regard to our second recommendation, that FEMA document Reservist policies and procedures related to disciplinary options and appeals currently in practice at the agency, DHS stated that FEMA will update FEMA Directive 010-06, FEMA Reservist Program, to include procedures for disciplinary actions and appeals current in practice at the agency. DHS estimated that this effort would be completed by December 31, 2017. This action, if fully implemented, should address the intent of the recommendation. With regard to our third recommendation, that FEMA communicate the range of penalties for specific misconduct offenses to all employees and supervisors, DHS stated that FEMA’s OCCHCO is currently drafting a table of offenses and penalties and will take steps to communicate those penalties to employees throughout the agency once the table is finalized. DHS estimated that this effort would be completed by December 31, 2017. This action, if fully implemented, should address the intent of the recommendation. With regard to our fourth and fifth recommendations, that FEMA improve the quality and usefulness of its misconduct data by implementing quality control measures, and, once the quality of the data is improved, conduct routine reporting on employee misconduct trends, DHS stated that FEMA’s OCCHCO is working with the DHS OIG to develop a new case management system. The system will use drop-down fields with standardized entries and provide tools for trend analysis. Once the new system is implemented, DHS stated that FEMA will be able to routinely identify and address emerging trends of misconduct. DHS estimated that these efforts would be completed by March 31, 2018. These actions, if fully implemented, should address the intent of the recommendations. With regard to our sixth recommendation, for FEMA to develop reconciliation procedures to consistently track referred cases, DHS stated that once the new case management system described above is established and fully operational, FEMA will be able to upload all DHS OIG referrals into a single, agency-wide database. Additionally, FEMA will work with DHS OIG to establish processes and procedures that will improve reconciliation of case data. DHS estimated that these efforts would be completed by March 31, 2018. These actions, if fully implemented, should address the intent of the recommendation. We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees. If you or your staff have any questions about this report, please contact me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The objectives of this report were to determine (1) the extent to which the Federal Emergency Management Agency (FEMA) has developed policies and procedures for addressing employee misconduct; (2) what data are available on FEMA employee misconduct cases and their outcomes, and the extent to which FEMA uses these data to identify and address trends in employee misconduct; and (3) the extent to which information regarding misconduct cases is shared within FEMA’s personnel management offices and with the Department of Homeland Security Office of the Inspector General (DHS OIG). To address objective one, we reviewed, where available, FEMA’s policies and procedures for reporting, investigating, and adjudicating allegations of misconduct across all of the agency’s workforce categories, including: Title 5 employees, Cadre of On-Call Response/Recovery Employees (CORE), Reservists, Surge Capacity Force members, and FEMA Corps members. Specifically, we reviewed investigation and discipline directives and manuals, as well as program directives and manuals, and interagency agreements related to FEMA Corps, to determine the extent to which FEMA has developed misconduct policies and procedures. At FEMA headquarters we interviewed senior officials from the Office of the Chief Security Officer (OCSO), Office of the Chief Component Human Capital Officer, Labor and Employee Relations Branch (LER), and Office of the Chief Counsel, Personnel Law Branch (PLB). Additionally, we interviewed the Surge Capacity Force and FEMA Corps Coordinators, as well as AmeriCorps officials, to discuss Surge Capacity Force and FEMA Corps misconduct policies and procedures. We interviewed cadre management officials from FEMA’s three largest cadres - Public Assistance, Individual Assistance, and Logistics - to discuss Reservist misconduct policies and procedures. We also spoke with union representatives from two FEMA bargaining units to gain their perspective on how misconduct policies and procedures are implemented for Title 5 and CORE employees. Additionally, we interviewed a non-probability sample of supervisors and managers in three FEMA regions. Specifically, we interviewed three FEMA Regional Administrators or their designated representatives; five Federal Coordinating Officers (FCO), and 11 Public Assistance, Individual Assistance, and Logistics Branch Chiefs from FEMA Regions 2,4, and 6. We selected these three regions based on factors such as geographic dispersion and regions that typically respond to different types of disasters, as well as those with the highest number of misconduct allegations reported to OCSO from January 2014 through September 30, 2016. The results of these interviews are not generalizable to all 10 of FEMA’s regions or all cadres; however, they provided us with both regional and Joint Field Office perspectives on policies and procedures for addressing employee misconduct and supervisory misconduct training. To address objective two, we reviewed and analyzed misconduct case tracking spreadsheets maintained by OCSO, LER, and PLB. We were unable to identify and account for possible duplication of the same complaints in the different spreadsheets. As such, we focused our analysis on individual spreadsheets rather than on aggregating information across all spreadsheets. Specifically, in order to summarize alleged misconduct offenses recorded in the OCSO case tracking spreadsheet, we first reviewed all of the data available on complaints which were received from January 1, 2014 through September 30, 2016. Next, we created eight offense category definitions based on prior GAO reports, discussions with stakeholders, and our review of the summary of allegations and offense fields. Finally, we assigned alleged offenses from the OCSO spreadsheet to the categories. We also attempted to review and summarize the subjects included in each complaint by employee type. However, our ability to do so was limited because that information was not consistently included in the OCSO spreadsheet. In order to summarize final disciplinary and adverse actions reviewed by PLB and recorded in the PLB case tracking spreadsheet, we reviewed all of the data available from January 2, 2014 through September 28, 2016. Next, we selected actions which were categorized as related to employee misconduct and excluded proposed actions. Finally, we summarized final actions by the action type and employee type using existing spreadsheet fields. We also reviewed information on past employee misconduct outcomes and disciplinary actions provided by LER. To assess the reliability of these data, we reviewed the three spreadsheets for any gaps and inconsistencies. We also interviewed agency officials from each office about how data are entered into the spreadsheets, who enters the data, whether they have guidance documents for data entry, and the process of assigning complaints to the offices. We identified limitations which we discuss in the report, but overall found the data in the spreadsheets sufficiently reliable to provide some general information on the nature and characteristics of employee misconduct complaints. In order to determine the extent to which FEMA currently uses these data to identify and address trends in employee misconduct, we interviewed OCSO, LER, and PLB officials. Additionally, we included related questions during the interviews with supervisors and managers in FEMA Regions 2, 4, and 6. Although information obtained from these interviews, as mentioned above, is not generalizable to all 10 regions or all FEMA cadres, it provided insights into how employee misconduct information is shared with FEMA field supervisors. To address objective three, we first reviewed FEMA and DHS OIG employee misconduct directives and manuals to identify any requirements for coordination among internal FEMA offices and with DHS OIG. Next, we interviewed senior OCSO, LER, PLB, and DHS OIG officials to determine the extent to which they coordinate and communicate misconduct information and to obtain their perspectives on information sharing related to misconduct investigations and outcomes. We analyzed documents, including case tracking spreadsheets and reports, to determine what and how frequently employee misconduct information is shared within FEMA and with DHS OIG. Finally, we used fiscal year 2016 data from DHS OIG’s Enforcement Data System to randomly select a non-generalizable sample of 20 FEMA employee misconduct complaints which were referred from DHS OIG to FEMA. We compared these complaints to the OSCO case tracking spreadsheet provided by FEMA. For complaints we were unable to locate, we requested that OCSO provide us with their statuses, including whether or not OCSO had taken action to review or investigate the complaints. Additionally, we asked OCSO to coordinate with LER and PLB and obtain information on the outcomes of all 20 complaints. While not generalizable to all complaints referred from DHS OIG to FEMA, the results of our review provided insight about FEMA’s procedures for tracking referred complaints and ensuring that all allegations of misconduct are addressed. For all three objectives, we reviewed the documents and information we gathered and evaluated them against Standards for Internal Control in the Federal Government. We conducted this performance audit from June 2016 to July 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Ben Atwater (Assistant Director), Sarah Turpin (Analyst-in-Charge), David Alexander, Dominick Dale, Eric Hauswirth, Rianna Jansen, Stephen Komadina, Kristiana D. Moore, and Heidi Nielson made key contributions to this report.

Summary: FEMA is responsible for coordinating government-wide efforts in preparing for, responding to, and recovering from natural or man-made disasters, including acts of terror. The agency relies on permanent and disaster-related temporary employees and has a total workforce of over 22,000. Employee misconduct incidents can detract from FEMA's mission, damage the agency's reputation, and hamper its ability to respond to disasters and maintain public trust. GAO was asked to review employee misconduct at FEMA. This report examines: (1) the extent to which FEMA developed policies and procedures for addressing misconduct; (2) available data on FEMA misconduct cases and the extent to which FEMA uses the data to identify and address trends; and (3) the extent that misconduct cases are shared within FEMA and with DHS OIG. GAO reviewed FEMA procedures, analyzed misconduct data, and interviewed officials from FEMA HQ and three regions (selected based on geographic dispersion and number of misconduct allegations). GAO also analyzed a random, non-generalizable sample of 20 complaints referred from DHS OIG to FEMA to determine whether they were addressed. The Federal Emergency Management Agency (FEMA) has developed and documented misconduct policies and procedures for most employees, but not its entire workforce. Specifically, FEMA has developed policies and procedures regarding misconduct investigations that apply to all FEMA personnel and has also documented options to address misconduct and appeal rights for Title 5 (generally permanent employees) and Cadre of On-Call Response/Recovery Employees (temporary employees who support disaster related activities). However, FEMA has not documented misconduct policies and procedures for Surge Capacity Force members, who may augment FEMA's workforce in the event of a catastrophic disaster. Additionally, FEMA's Reservist (intermittent disaster employees) policies and procedures do not outline disciplinary actions or the appeals process currently in practice at the agency. As a result, supervisors and Reservist employees may not be aware of all aspects of the process. Clearly documented policies and procedures for all workforce categories could help to better prepare management to address misconduct and mitigate perceptions that misconduct is handled inconsistently. FEMA records data on misconduct cases and their outcomes; however, aspects of this data limit their usefulness for identifying and addressing trends. GAO reviewed misconduct complaints recorded by FEMA's Office of the Chief Security Officer (OCSO) from January 2014 through September 30, 2016, and identified 595 complaints involving 799 alleged offenses, the most common of which were integrity and ethics violations. FEMA reported 546 disciplinary actions related to misconduct from calendar year 2014 through 2016. In addition to OCSO, two other FEMA offices involved in investigating and adjudicating misconduct also record data. However, limited standardization of data fields and entries within fields, limited use of unique case identifiers, and a lack of documented guidance on data entry across all three offices restricts the data's usefulness for identifying and addressing trends in employee misconduct. Improved quality control measures could help the agency use the data to better identify potential problem areas and opportunities for training. FEMA shares misconduct case information internally and with the Department of Homeland Security Office of Inspector General (DHS OIG) on a regular basis; however, FEMA does not have reconciliation procedures in place to track DHS OIG referred cases to ensure that they are reviewed and addressed. GAO reviewed a random sample of 20 cases DHS OIG referred to FEMA in fiscal year 2016 and found that FEMA missed 6 of the 20 complaints during the referral process and had not reviewed them at the time of GAO's inquiry. As a result of GAO's review, FEMA took action to review the complaints and opened inquiries in 5 of the 6 cases (1 case was closed for lack of information). In 3 of these cases, officials determined that the complaints did not involve FEMA employees. The 2 remaining cases were open as of April 2017. While the results from this review are not generalizable to the entire population of referrals from DHS OIG to FEMA, they raise questions as to whether there could be additional instances of misconduct complaints that FEMA has not reviewed or addressed. Procedures to ensure reconciliation of referred cases across FEMA and DHS OIG records could help ensure that FEMA accounts for all complaints. GAO is making six recommendations with which DHS concurred, including that FEMA document policies and procedures for addressing Surge Capacity Force and Reservist misconduct, improve the quality and usefulness of its misconduct data, and develop reconciliation procedures to consistently track referred cases.