State’s Foreign Affairs Manual requires that U.S. government Foreign Service and Civil Service employees under chief-of-mission authority with assignments or short-term TDY to designated high-threat countries complete FACT training before deploying. USAID’s Automated Directives System additionally requires FACT training for USAID’s U.S. personal services contractors deploying to these posts. The 1-week course, held at a U.S. location, provides practical, hands-on instruction in topics such as detection of surveillance, familiarization with firearms, awareness of improvised explosive devices, and provision of emergency medical care (see fig. 1 for other examples of topics addressed in FACT training). To ensure that personnel are prepared to confront current risks in high- threat environments, State requires that personnel complete the course every 5 years and updates the FACT training curriculum periodically to reflect changing threats abroad. For example, in 2009, the ambassador to one high-threat country noted that personnel needed to be familiar with the sound of sirens announcing a rocket attack and with the physical features of protective bunkers, in part because personnel were injuring themselves when entering the bunkers. In response, State’s Diplomatic Security Training Center added two bunkers at its training facility and began conducting duck-and-cover exercises with recorded sirens. State also revised the FACT training curriculum in 2013 to include instruction on helicopter operations, vehicle rollover training, and evacuation from a smoke-filled environment. State initially established the FACT training requirement for personnel in one country in 2003 and extended it to eight more countries over the next 9 years. In June 2013, State doubled the number of countries for which it required FACT training. Prior to that date, the requirement applied to assigned personnel and those on short-term TDY in a designated high- threat country for 30 or more cumulative days in a 365-day period (with the exception of personnel on short-term TDY to one country, where State required FACT training for personnel with 60 cumulative days or more of TDY status). In December 2012, the Accountability Review Board, which State convened to investigate the attacks on the mission in Benghazi, Libya, recommended that FACT training be required for personnel assigned to all high-threat, high-risk countries. An independent panel established as a result of the Accountability Review Board also identified training as critical to State’s ability to ensure a safe and secure environment for employees. In response to the Accountability Review Board’s recommendation, in June 2013, State issued a memorandum notifying U.S. agencies that it was increasing the number of countries for which it requires FACT training from 9 to 18. State also required that employed eligible family members of personnel in all designated high-threat countries complete FACT training and changed the requirement for short-term TDY personnel. Under the new requirement, short-term TDY personnel must take FACT training if they spend more than 45 cumulative days in a calendar year in one or more of the designated countries. 13 FAM 322(b). training. In extraordinary circumstances, State may grant a waiver of the FACT training requirement to individuals on a case-by-case basis. Using data from multiple sources related to State and USAID assigned personnel, we determined that 675 of 708 State personnel and all of the 143 USAID personnel on assignments to the designated high-threat countries on March 31, 2013, were in compliance with the FACT training requirement. We found 33 State assigned personnel who were not in compliance with the mandatory training requirement. We were unable to assess compliance among short-term TDY personnel because of gaps in State’s data. First, State has not established a mechanism to identify the universe of short-term TDY personnel who are required to take FACT training. Second, State’s eCountry Clearance (eCC) system—the most comprehensive data source for identifying short-term TDY personnel granted country clearance to high-threat posts—has limitations. According to GAO’s Standards for Internal Control in the Federal Government, program managers need operating information to determine whether they are meeting compliance requirements. Based on our review of available data, we found that 675 of 708 State personnel and all of the 143 USAID personnel in the designated high- threat countries on March 31, 2013, complied with the FACT training requirement. We identified 33 noncompliant State personnel. According to State officials, of the 22 noncompliant individuals in one country, 18 were State personnel’s employed eligible family members who were required to take the training; State officials explained that these individuals were not aware of the requirement at the time. The officials noted that enrollment of family members in the course is given lower priority than enrollment of direct-hire U.S. government employees but that space is typically available. In addition, a senior official at the embassy in another country as of March 31, 2013, did not complete FACT training before or during his tenure. According to State officials, this resulted from a pressing situation in the country; however, this individual did not receive a waiver from the FACT training requirement. State provided a variety of reasons why the remaining 10 personnel were not in compliance with the requirement (see app. III for more information). Because State does not maintain a single source of data on assigned U.S. personnel who are required to complete FACT training, State or an independent reviewer has to obtain and reconcile information from three State databases—State’s Global Employment Management System (GEMS), Student Training Management System, and Post Personnel—as well as other sources to assess the extent of compliance among all U.S. agencies with the FACT training requirement. In addition, limitations in these various State data systems containing information needed to assess compliance make it difficult to readily identify personnel subject to the FACT training requirement. As a result, the data are not readily available for decision making and require resource- and labor-intensive efforts to determine compliance. According to internal control standards, program managers need operating information to determine whether they are meeting compliance requirements. The following is a list of the current data systems and the limitations associated with each. Global Employment Management System. GEMS—the centralized personnel database for State’s U.S. direct-hire personnel and employed eligible family members—identifies direct-hire personnel on assignments, including assignments to the designated high-threat countries. However, GEMS does not consistently identify State personnel who are required to complete FACT training. In some cases, the GEMS data that we reviewed included dates for employees’ arrival at post; in other cases, it included employees’ hire dates. As a result, to determine whether these personnel had completed FACT training within 5 years of arrival at the posts, additional employee profile information must be obtained from State’s Bureau of Human Resources. Moreover, GEMS data do not contain a field identifying whether certain personnel are subject to the FACT training requirement based on their employment type or position. For example, the GEMS data do not readily identify eligible family members, some of whom were required to complete FACT training. As a result of this limitation, additional evidence is required to verify whether they were subject to the FACT training requirement. Student Training Management System. State’s Student Training Management System is the official system of record for State, USAID, and other agency personnel’s FACT training completion dates. Although the Student Training Management System shows personnel who enrolled in FACT training, it does not consistently include training completion dates. For example, the data that we reviewed lacked FACT training completion dates for 9 of 143 assigned USAID personnel. State officials could not provide a definitive explanation for the absence of these completion dates in the training management system. For these nine records, State and USAID officials had to provide alternate forms of evidence, such as Foreign Service Institute training transcripts or FACT training rosters, to show that personnel had completed the training. Post Personnel. State’s Post Personnel system—a database managed by the overseas posts—contains information on all U.S. executive branch personnel assigned under chief-of-mission authority. Therefore, we reviewed data from Post Personnel to identify some USAID personnel who were required to complete FACT training, because USAID officials told us that data maintained in USAID’s internal staffing report for March 31, 2013, might not include all personal services contractors at the designated high-threat countries. We attempted to compare Post Personnel records for USAID personnel with FACT training completion records in State’s Student Training Management System to examine compliance among USAID personnel. However, we found that the Post Personnel data excluded 18 USAID assigned personnel who, according to a USAID staffing report, were assigned to countries for which State required FACT training on March 31, 2013. According to State officials, Post Personnel is not an official or reliable system of record for information. State is in the process of developing a new, centralized system to replace Post Personnel—the Overseas Personnel System—that will track the location of all U.S. employees stationed at overseas posts and is expected to become operational in February 2014, according to State Bureau of Human Resources officials. However, according to agency officials, the new system will not integrate data from State’s Student Training Management System or other personnel data systems. Gaps in State’s data on U.S. short-term TDY personnel at high-threat countries make it impossible for State or an independent reviewer to readily assess compliance with the FACT training requirement among State and USAID short-term TDY personnel who are required to complete FACT training. First, State does not systematically maintain data on the universe of U.S. personnel on short-term TDY status in designated high- threat countries who are required to complete the training. Second, neither the eCC system—the primary mechanism that State and USAID short-term TDY personnel generally use to request country clearance— nor any other State system is set up to permit those responsible for granting country clearance to determine whether the personnel requesting clearance have reached the cumulative 45 days threshold in one designated country or across multiple high-threat countries. Determining whether U.S. personnel have reached, or will reach, the cumulative-days threshold is a key factor in identifying short-term TDY personnel who should have completed FACT training before receiving country clearance. We attempted to use data from the eCC system and State’s Student Training Management System to identify the universe and determine compliance with the FACT training requirement for short-term TDY personnel. However, we were unable to do so because we could not obtain a reliable or comprehensive universe of short term TDY personnel in designated high-threat countries. Although we attempted to overcome these data limitations by examining other State records, we ultimately concluded that the available data and records on State and USAID short- term TDY personnel were not sufficiently reliable to determine the extent of compliance for these personnel. This lack of reliable data is inconsistent with internal control standards, which state that agencies need operating information to determine whether they are meeting their compliance requirements. Without such data, agencies cannot determine the extent to which personnel comply with the mandatory training requirement. Several weaknesses in State oversight of personnel’s compliance with the FACT training requirement limit State’s ability to help ensure that all personnel subject to the requirement are prepared for service in high- threat countries. First, State’s policy manual is outdated, and certain guidance related to FACT training is inconsistent and unclear. Second, State and USAID management personnel responsible for assigning civilian personnel and granting them country clearance do not consistently verify FACT training completion before the personnel deploy to high-threat countries. Third, State management does not monitor or evaluate overall levels of compliance with the training requirement. Effective management of an organization’s workforce is essential to achieving results and an important part of internal control. Only when the right personnel for the job are on board and are provided the right support, including training, is operational success possible. State has not updated the Foreign Affairs Manual to reflect changes made to the FACT training requirement in June 2013. In addition, State’s eCC system provides inconsistent and unclear instructions to employees regarding the FACT training-related information they must include on eCC request forms. Moreover, we found that State’s guidance regarding the required frequency of FACT training is unclear. According to Standards for Internal Control in the Federal Government, information should be recorded and communicated to management and others in the agency in a form and within a time frame that enables them to carry out their responsibilities. Without up-to-date, consistent, and clear guidance, agencies and personnel may not have the information needed to ensure compliance with the FACT training requirement. As of January 2014, State had not updated its Foreign Affairs Manual to reflect its policy change, announced in June 2013, that (1) increased the number of designated high-threat countries requiring FACT training from 9 to 18, (2) changed the cumulative-days threshold for the FACT training requirement from 30 or more cumulative days in one high-threat country to more than 45 cumulative days in one or more of the countries, and (3) described the conditions that indicate whether eligible family members must complete the course. Although State informed other federal agencies and personnel under chief-of-mission authority about the changes to the FACT training requirement in a June 2013 memorandum and a July 2013 cable, respectively, we found that USAID was not implementing changes to the requirement as of January 2014. USAID officials told us that they had not implemented the revised requirement in part because they were made aware that the State’s Bureau of Diplomatic Security did not have the capacity to train staff assigned to the newly designated high-threat countries; therefore, they believed the changes had not taken effect. Updating the Foreign Affairs Manual is important given that USAID revised its Automated Directives System guidance in June 2013 to provide a specific cross-reference to the FACT training requirement in the USAID did this to help ensure that its staff are Foreign Affairs Manual.aware of the designated high-threat locations for which FACT training is required, in response to a GAO letter sent to USAID in April 2013 highlighting gaps in its Automated Directives System guidance. Instructions in the eCC system—as previously noted, the primary mechanism generally used to request and grant country clearance to short-term TDY personnel—included the FACT training requirement for eight of the nine designated high-threat countries that we reviewed (see fig. 2). However, instructions contained in the eCC system provide inconsistent or unclear guidance to U.S. personnel. This occurs because State headquarters has not provided instructions to posts in designated high- threat countries regarding the FACT training documentation that personnel should include in the clearance requests that they submit through the eCC system. Rather, State has granted each overseas post responsibility for developing its country requirements information in the system. According to State officials, each post is responsible for maintaining and updating its own requirements. Thus, some inconsistencies have occurred. Figure 3 illustrates the inconsistency in eCC system instructions for designated high-threat countries. Examples of inconsistency and lack of clarity in eCC country instructions that we reviewed include the following: The eCC instructions for four countries required employees to record their FACT training completion dates on the eCC request or provide evidence of FACT training before they arrive at post. The eCC instructions for the other four relevant high-threat countries did not require employees to provide any documentation of FACT training before they arrive at post (see fig. 3). The instructions for three countries required employees to specify the dates of training; instructions for the fourth country required employees to provide evidence of training completion but do not specify what evidence should be provided—such as a completion date or training completion certificate—or how or to whom the evidence should be provided. The eCC instructions for only two countries required officials from the sponsoring agency or office to ensure that employees completed FACT training before arriving at post. The eCC instructions for one of these countries required the employee’s sponsoring agency to provide written verification that the employee has completed FACT training; the instructions for the other country required the employee’s sponsoring agency to ensure employees have FACT training before traveling to post. We also found other State guidance regarding the FACT training requirement to be inconsistent and unclear. Specifically, State officials have provided inconsistent guidance regarding the frequency with which personnel must repeat FACT training. According to State’s Bureau of Diplomatic Security, as of November 2013, FACT training must be current through the end of an assignment to a designated high-threat country; that is, the FACT training certificate must remain valid for the duration of the personnel’s entire tour of duty. In contrast, according to State Orientation and In-Processing Center (OIP) officials and instructions, all required training must be completed within 5 years of arrival at the post, and the period since the last training may exceed 5 years during the assignment. In October 2013, State officials said that they were in the process of clearing a “Frequently Asked Questions” cable intended to resolve the inconsistency in the guidance, but the officials did not provide a date when the cable would be issued. Although State and USAID have processes in place to notify assigned and short-term TDY personnel of the FACT training requirement and to enroll them in training, neither agency consistently verifies completion of the training before its respective personnel deploy to high-threat countries. While State’s Foreign Affairs Manual notes that it is each employee’s responsibility to ensure his or her compliance with the FACT training requirement, the manual also states that agency management is responsible for ensuring adequate controls over all department operations. Without such controls for ensuring FACT training compliance, State increases the risk that personnel may deploy to the designated high-threat countries without completing the mandatory training. State OIP verifies that all State and USAID assigned personnel departing for five of the designated high-threat countries have complied with the FACT training requirement, and USAID verifies compliance with the requirement for assigned USAID personnel departing for two additional countries. State does not verify compliance for personnel assigned to the other designated high-threat countries (see fig. 4). Verification of FACT training compliance varies across countries. U.S. personnel with assignments to five countries submit eCC travel requests that are routed through OIP to the posts. According to OIP officials, OIP forwards the eCC request form to the posts only after verifying, using State’s Student Training Management System, that personnel have completed FACT training within 5 years of the assignment start date. USAID generally verifies whether personnel on assignments to two additional countries have completed FACT training before arrival by requesting their FACT training completion certificate. State and USAID generally do not verify short-term TDY personnel’s completion of FACT training before deployment. We found two instances—USAID in two countries—where agency officials told us that they verified FACT training compliance before short-term TDY personnel arrived at post.FACT training completion for either of these countries. Furthermore, State and USAID officials told us that they do not obtain evidence of FACT training completion for short-term TDY personnel for six additional countries. For the remaining country, although the eCC instructions call for personnel to provide evidence of FACT training, post officials told us that they do not review the evidence provided. Moreover, according to a State official responsible for managing the eCC system, the department has issued no documented protocol or standard operating procedure to posts regarding reviewing and approving eCC requests to ensure compliance with the FACT training requirement. In contrast, State officials told us that they do not verify Although State OIP helps to ensure that eCC requests submitted by short-term TDY personnel traveling to two countries include FACT training completion dates, the office does not verify that the dates are accurate. In addition, OIP does not review eCC requests or verify FACT training compliance for short-term TDY personnel traveling to the three other high-risk countries for which OIP supports short-term TDY travel. According to OIP officials, OIP tested the accuracy of a random sample of 34 employee eCC records over a 2-week period and concluded that it is unnecessary to verify eCC data on FACT training completion, based on We believe that OIP’s methodology for conducting this the test’s results.test is not sufficient or reliable for determining that no further verification is necessary. While OIP’s sample provided anecdotal insights about employees’ recorded training dates, the sample results were not generalizable to the entire population. Thus, conclusions about the population’s accuracy based on OIP’s sample are not appropriate. To verify short-term TDY personnel’s compliance with the FACT training requirement, agencies would need to determine how many days within a calendar year personnel have traveled to designated high-threat countries. In June 2013, the department changed the cumulative-days requirement to 45 cumulative days or more in a calendar year in any of those countries. However, State’s data systems do not enable personnel to view an employee’s history of travel to more than one of the designated countries. For short-term TDY personnel traveling to two specific countries, State officials noted that OIP officials use the eCC system to determine cumulative numbers of days traveled within each country; however, they cannot determine personnel’s cumulative numbers of days traveled across countries. Furthermore, in-country officials who approve country clearance requests can generally view employees’ travel histories only for that particular country and generally do not have eCC system authority to look at employee travel histories for other countries. According to State officials, the department has no plans to ensure short- term TDY personnel’s compliance with the 45 cumulative-day requirement. The officials said that (1) the process to view personnel’s travel records is labor intensive and (2) they would not want to burden post officials by asking them to track personnel’s cumulative travel days. We realize that this would be a difficult task, but one of the first steps to ensuring compliance with the requirement is to collect the necessary data. State, which is primarily responsible for the safety and security of U.S. government personnel on official duty abroad, has not monitored or evaluated the overall extent of compliance with the FACT training requirement among assigned and short-term TDY personnel. According to State officials, an agency working group began exploring options in November 2013 for a process to validate and track FACT training, which is intended to ensure an additional measure of compliance with the requirement. While State’s Foreign Affairs Manual notes that it is each employee’s responsibility to fulfill the FACT training requirement, the manual also notes that agency management is responsible for ensuring adequate controls over agency operations and that all managers are responsible for maintaining and monitoring systems of management control. In addition, according to Standards for Internal Control in the Federal Government, agency management should assess the quality of performance over time and, based on these reviews, should ensure that any findings from audits and other reviews are promptly resolved. The lack of monitoring prevents State officials from identifying systematic deficiencies in their efforts to ensure FACT training compliance. The presence of U.S. personnel at overseas posts is critical to promoting U.S. interests and assisting foreign partners. This includes the deployment of personnel to high-threat countries where they may be targeted by Al Qaeda, its affiliates, and other violent extremist organizations. State has identified the need, and established the requirement, for employees to complete a mandatory security course (FACT) to better prepare employees for work in high-threat environments. The lack of security awareness training by one individual could put not only his or her own safety in jeopardy but could also place at risk the safety of others serving in an overseas high-threat country. While State’s Foreign Affairs Manual notes that it is the employee’s responsibility to ensure compliance with the FACT training requirement, it also notes that agency management is responsible for ensuring adequate controls over all agency operations. Accordingly, it is essential that State provide U.S. personnel with access to the most up-to-date information on the requirements for training, establish mechanisms to identify the individuals who are required to complete FACT training, and ensure that they are in compliance with the requirements. State has not yet updated the Foreign Affairs Manual to reflect changes related to the FACT training requirement from June 2013, provided consistent and clear policy guidance, or monitored compliance with the requirement. Undertaking these steps is essential to ensuring that all U.S. personnel deploying to designated high-threat countries are adequately prepared for challenges associated with working in a high-threat security environment. We are making 10 recommendations to the Secretary of State and one recommendation to the USAID Administrator. To ensure that State’s policy guidance reflects the June 2013 mandatory FACT training requirements and provides clear information to U.S. agencies on which personnel are required to take FACT training, we recommend that the Secretary of State update the Foreign Affairs Manual to reflect the nine additional countries that were added in June 2013, reflect the requirement for all eligible family members assigned or on short-term TDY to the designated high-threat countries to complete FACT training before deployment, indicate that short-term TDY personnel who spend more than 45 cumulative days in a calendar year at one or more of the designated posts are required to complete FACT training, and clarify whether FACT training completion must be valid during an employee’s entire assignment or short-term TDY visit. To strengthen State’s ability to ensure that U.S. civilian personnel are in compliance with the FACT training requirement, we recommend that the Secretary of State identify a mechanism to readily determine the universe of assigned U.S. civilian personnel under chief-of-mission authority who are required to complete FACT training; identify a mechanism to readily determine the universe of short-term TDY U.S. civilian personnel who are required to complete FACT training—specifically, required personnel who have spent 45 days or more in the designated high-threat countries in a calendar year; ensure that eCC instructions regarding the documentation of the FACT training requirement for short-term TDY personnel are consistent for all designated high-threat countries; take steps to ensure that management personnel responsible for assigning personnel to designated high-threat countries consistently verify that all assigned U.S. civilian personnel under chief-of-mission authority who are required to complete FACT training have completed it before arrival in the designated high-threat countries; take steps to ensure that management personnel responsible for granting country clearance consistently verify that all short-term TDY U.S. civilian personnel under chief-of-mission authority who are required to complete FACT training have completed it before arrival in the designated high-threat countries; and monitor or evaluate overall levels of compliance with the FACT training requirement among U.S. civilian personnel under chief-of- mission authority who are subject to the requirement. We recommend that the USAID Administrator take steps to ensure that all USAID short-term TDY personnel who are required to take FACT training complete the training before arrival in the designated high-threat countries, as USAID has done for its assigned personnel. We provided a draft of this report to State and USAID for their review and comment. State and USAID provided written comments, which we have reprinted in appendices IV and V, respectively. State also provided technical comments, which we incorporated as appropriate. State fundamentally concurred with our recommendations. State noted that it has efforts underway to address these recommendations. In addition, State noted that it established a working group chaired by the Executive Assistant for the Under Secretary for Management in November 2013 to identify areas where improvements can be made, such as in the areas of notification, enrollment, and tracking of FACT training. State indicated that it plans to distribute internal and external guidance on this issue and document all existing and new measures accordingly. USAID did not specifically agree or disagree with our recommendation that it take steps to ensure that all USAID short-term TDY personnel who are required to take FACT training complete the training before arrival in the designated high-threat countries. USAID noted challenges in verifying whether its short-term TDY personnel are in compliance with the FACT training requirement and indicated that the onus is on the employee to fulfill the requirement. However, USAID indicated that it plans to take some steps to assist employees in tracking their compliance with the requirement. Specifically, USAID stated that every country clearance will include (1) a reminder to employees about the FACT training requirement and (2) a statement that employees must keep track of their cumulative days of travel to FACT training posts, so that they do not exceed 45 days at FACT training posts without getting the required training. USAID also noted that its efforts will include a warning that if an employee fails to meet this responsibility, he or she could be subject to discipline. We are sending copies of this report to the appropriate congressional committees, the Secretary of State, and the USAID Administrator. In addition, the report is available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7331 or johnsoncm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI. This report reviews issues related to compliance with the Department of State’s (State) Foreign Affairs Counter Threat (FACT) training, including internal controls to ensure compliance. Specifically, we examined (1) compliance with the FACT training requirement among civilian personnel employed by State and the U.S. Agency for International Development (USAID) and (2) State’s and USAID’s oversight of their personnel’s compliance with the requirement. Our work focused on personnel at State and USAID, the two primary foreign affairs agencies with civilian personnel in the countries for which State requires FACT training. We met with officials from relevant components of these agencies. For State, we met with officials from the Bureau of Diplomatic Security; Bureau of Human Resources; Office of Management Policy, Rightsizing and Innovation; Orientation and In- Processing Center; relevant headquarters-based regional bureaus; and the Foreign Service Institute. We interviewed State officials in seven of the nine countries for which State required FACT training as of March 2013. For USAID, we met with officials from the agency’s Office of Human Resources, the Office of Security, and regional offices for designated high-threat countries. We also interviewed USAID officials in five of the nine countries that were designated as high threat as March 13, 2013. Although we include Afghanistan in our discussion of State and USAID processes to ensure compliance, we did not assess compliance among State and USAID personnel in Afghanistan because we have previously reported on the extent of compliance with the FACT training requirement among U.S. personnel assigned to that country. We evaluated the extent of compliance among State and USAID assigned and short-term temporary duty (TDY) personnel in the countries for which State or USAID required FACT training as of March 31, 2013, against the relevant provisions in State’s Foreign Affairs Manual (13 FAM 321-323) and USAID’s Automated Directives System (ADS 458). To do so, we collected available personnel and training data for State and USAID assigned and short-term TDY personnel who were in the designated countries on March 31, 2013. We chose this date because it was a recent date during our initial planning of the review. We assessed compliance with the requirement among State and USAID direct-hire personnel and U.S. personal services contractors, who are required to complete FACT training per State’s Foreign Affairs Manual and USAID’s Automated Directives System. We also assessed the extent of compliance among employed eligible family members of personnel assigned to relevant designated posts in three countries, the only locations in our compliance assessment for which State specified that employed eligible family members were required to complete FACT training, as of March 31, 2013. We excluded Diplomatic Security special agents and security protective specialists from our analysis, because State’s guidance specifically exempts these personnel from the FACT training requirement. We excluded regional security officers, deputy regional security officers, and assistant regional security officers from our analysis, because, according to State, these personnel are categorized as Diplomatic Security special agents and as such are exempt from the FACT training requirement. In addition, we excluded personnel who were at the designated country or post on March 31, 2013, but who arrived before the FACT training requirement took effect for that country. Because FACT training is valid for a 5-year period, we obtained FACT training completion data for 2008 through 2013 from State’s Global Employment Management System (GEMS) and Student Training Management System (STMS). For State and USAID assigned personnel who did not complete FACT training, we asked State and USAID officials to provide one of the following: (1) evidence that these individuals completed equivalent training—for example, an employee profile or training roster indicating completion of either of two courses, Security for Non-traditional Operating Environments or the diplomatic security antiterrorism course designed for one country; (2) evidence that these individuals were otherwise exempt from the requirement—for example, an employee profile illustrating that an employee was a Diplomatic Security special agent; or (3) an explanation for the noncompliance of personnel who were not exempt but failed to comply with the requirement. We used data from GEMS and State’s Bureau of African Affairs to compile information for State assigned personnel who were in the designated countries on March 31, 2013. All State records obtained from GEMS contained FACT training completion dates for assigned personnel who had completed the training; we used these completion dates in our compliance review. For USAID assigned personnel, we used data from State’s Post Personnel system and a USAID staffing report for March 31, 2013. The USAID personnel data obtained from State’s Post Personnel system did not contain FACT training completion dates. For our compliance review, we assessed the USAID personnel records against FACT training completion records in STMS. To determine whether a USAID assigned personnel record could be categorized as a match with an STMS record containing a FACT training completion date, we compared data for the employees’ first and last names and available data for partial social security numbers and partial dates of birth. To assess the reliability of the data that we used for assessing State and USAID assigned personnel’s compliance with the FACT training requirement, we interviewed agency officials responsible for compiling these data or maintaining the systems that generated the data, and we performed basic reasonableness checks of the data for obvious inconsistencies and gaps. When we found discrepancies or missing data fields, we brought them to the attention of relevant agency officials and worked with the officials to correct the discrepancies and missing fields. To assess the comprehensiveness of USAID Post Personnel data, we compared data for USAID assigned personnel with data from USAID’s staffing report for March 31, 2013. We found data on State and USAID assigned personnel to be sufficiently reliable for the purpose of our report. We were unable to conduct an assessment of the extent of compliance with the FACT training requirement among short-term TDY personnel because we determined that the data were not sufficiently reliable for the purposes of our report. We worked for 7 months with various entities within State and at USAID to obtain data identifying the universe of short- term TDY personnel in the designated countries as of March 31, 2013, who were required to take FACT training. We collected data from the eCountry Clearance (eCC) system as well as data provided by posts for where short-term TDY personnel were present on March 31, 2013. Through multiple data analysis steps, we identified problems with the reliability of agency and employment type data contained in the eCC system. For example, one eCC record listed an individual’s employer incorrectly; according to a State official, the individual identified as a State employee in the eCC system was actually a commercial contractor working for USAID. We ultimately concluded that these data were not sufficient or reliable for the purpose of our report. To assess the reliability of the FACT training completion data from STMS, we asked State and USAID to provide additional documentation of FACT training completion. We obtained training records, such as rosters, for those personnel who State and USAID officials told us had completed FACT training but who did not have FACT training completion dates in STMS. We asked State’s Bureau of Diplomatic Security to explain discrepancies between these records and the STMS data; however, the bureau did not provide clear explanations. To test the reliability of the dates in STMS, we tested a nonrepresentative sample of 27 personnel from a list of State and USAID assigned and short-term TDY personnel who had FACT training completion dates within the last 5 years in STMS. We compared these dates with dates in training rosters that we obtained from State’s Bureau of Diplomatic Security for each of the personnel, and we confirmed that all 27 personnel could be accounted for in the training rosters. We determined that the FACT training completion data from STMS were sufficiently reliable for the purposes of our report. To assess State and USAID’s management oversight of assigned and short-term TDY personnel’s compliance with the FACT training requirement, we reviewed relevant documents from State and USAID, including State’s Foreign Affairs Manual, USAID’s Automated Directives System, and other standard operating procedures. We also interviewed knowledgeable State and USAID officials, as well as State Orientation and In-Processing Center contractors, to determine the steps that these agencies take to ensure compliance with the FACT training requirement. We compared these steps with State and USAID management and internal controls guidance. We also assessed the agencies’ processes for ensuring compliance against selected standards for enhancing internal controls in Standards for Internal Control in the Federal Government. We conducted this performance audit from March 2013 to March 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. This appendix provides examples of attacks against U.S. personnel and facilities overseas from September 2012 through September 2013. We derived this information from a chronology developed by the Department of State’s Bureau of Diplomatic Security, Office of Intelligence and Threat Analysis. September 3, 2012 – Peshawar, Pakistan: A U.S. consulate three- vehicle motorcade was attacked by a suicide vehicle-borne improvised explosive device in the vicinity of the U.S. Consulate General’s University Town housing complex. Two U.S. consulate general officers were wounded, as were two locally employed drivers, a local police bodyguard assigned to the Consulate General, and several other policemen providing security for the motorcade. September 8, 2012 – Zabul Province, Afghanistan: The Zabul Provincial Reconstruction Team was hit with two improvised explosive devices. No chief-of-mission personnel were injured. September 10, 2012 – Baghdad, Iraq: A U.S. embassy aircraft reported seeing 7 to 10 tracer rounds of unknown caliber fired behind the aircraft. There were no injuries to chief-of-mission personnel or Office of Security Cooperation in Iraq personnel, and no property damage. September 11, 2012 – Jerusalem, Israel: An Israeli “flash-bang” distraction device was thrown at the front door of an official U.S. consulate general residence. The detonation caused damage to an exterior door and hallway, but no one was hurt in the attack. September 11 to 12, 2012 – Benghazi, Libya: A series of attacks involving arson, small-arms and machine-gun fire, rocket-propelled grenades, and mortars were directed at the U.S. Mission in Benghazi and a Mission annex, as well as against U.S. personnel en route between both facilities. Four U.S. government personnel, including the U.S. Ambassador to Libya, were killed. In addition, the attacks severely wounded two U.S. personnel and three Libyan contract guards and resulted in the destruction and abandonment of both facilities. September 11 to 15, 2012 – Cairo, Egypt: Protesters overran the U.S. embassy perimeter defenses and entered the embassy compound. Though the embassy was cleared of intruders by that evening, battles continued between police and the crowd until the morning of September 15, when Central Security Forces cleared the area of protesters. No Americans were injured in the violent demonstrations. September 12, 2012 – Tunis, Tunisia: Approximately 200 demonstrators gathered at the U.S. embassy to protest inflammatory material posted on the Internet. At one point, demonstrators tried to get to the embassy perimeter wall and threw stones at the fence. The police responded immediately and secured the area. No U.S. citizens were injured. September 13, 2012 – Sana’a, Yemen: Approximately 500 protesters pushed past security forces and stormed the U.S. embassy compound, where they caused extensive damage by looting and setting several fires. According to State officials, the physical defensive features of the buildings performed fully as designed by successfully preventing intrusion, despite repeated attempts by protesters to break through them. No U.S. citizens were injured in the attack. Throughout the day, groups of protesters continued to harass a number of chief-of-mission personnel. September 14, 2012 – Chennai, India: Several hundred protesters threw rocks and other material near the U.S. Consulate General, to protest inflammatory material posted on the Internet. At one point, a Molotov cocktail was thrown over the consulate wall, causing damage but no injuries. September 14, 2012 – Khartoum, Sudan: A mob of 4,000 protesters ransacked the German and British embassies and stormed the U.S. embassy. During the several-hour siege, the U.S. embassy compound sustained extensive damage. According to State officials, the physical defensive features of the buildings performed fully as designed by successfully preventing intrusion, despite repeated attempts by protesters to break through them. The rioters captured a police truck and set it on fire, then used the vehicle as a make-shift battering ram in an unsuccessful attempt to breach one of the compound’s rear entrance doors. Police equipment, including tear gas, was seized from the truck for use against the embassy’s defenders and intruders cut the embassy’s local power supply. More than 20 windows were damaged by rocks, and several surveillance cameras were destroyed September 14, 2012 – Khartoum, Sudan: Police apprehended a man attempting to throw a Molotov cocktail at the U.S. embassy. The embassy building was not damaged and no one was injured. September 14, 2012 – Tunis, Tunisia: Thousands of protesters breached the U.S. embassy wall and caused significant damage to the motor pool, outlying buildings, and the chancery. Separately, unknown assailants destroyed the interior of the American Cooperative School in Tunis. No U.S. citizens were injured in either attack. September 15, 2012 – Sydney, Australia: Violent protesters conducted large demonstrations near the U.S. consulate general. September 16, 2012 – Karachi, Pakistan: Two hundred protesters affiliated with a Shi’a religious group named Majilis-e-wahdat-ul- Muslimeen broke through police lines and threw rocks into the U.S. consulate perimeter, causing damage to the compound access control windows. No chief-of-mission personnel were injured, but two protesters were killed, and several more were injured as security forces responded. September 17, 2012 – Sydney, Australia: A U.S. citizen who was employed by the U.S. Air Force was assaulted while waiting for a bus in the central business district. This incident took place on the heels of the violent protests near the U.S. Consulate General in Sydney on September 15. September 17, 2012 – Jakarta, Indonesia: Demonstrators threw Molotov cocktails and other material at the U.S. embassy to protest inflammatory material posted on the Internet. Eleven police officers were hurt. No U.S. citizens were injured, and damage to the embassy was minor. September 18, 2012 – Beijing, China: Anti-Japanese protesters walked to the U.S. embassy from the Japanese embassy and surrounded the U.S. Ambassador’s vehicle. No injuries were reported, and there was only minor cosmetic damage to the vehicle. September 18, 2012 – Peshawar, Pakistan: The student wing of Jamaat-e-Islami staged a demonstration at the U.S. consulate. The crowd became violent, throwing rocks and Molotov cocktails and pulling down a billboard showing an American flag. September 27, 2012 – Kolkata, India: Fifteen thousand to 20,000 protesters marched toward the American Center and then rushed the gates, throwing sticks and stones at the facility. There was minor damage to a window. October 1 and 4, 2012 – Kandahar Province, Afghanistan: The Kandahar Provincial Reconstruction Team received small-arms fire. No personnel were injured. October 13, 2012 – Maruf District, Kandahar Province, Afghanistan: As a delegation of U.S. and Afghan officials arrived for a meeting in Maruf District, a suicide bomber detonated a suicide vest. The explosion killed two U.S. citizens and five Afghan officials. One of the U.S. citizens killed was under chief-of-mission authority. October 29, 2012 – Tunis, Tunisia: A U.S. military officer assigned to the U.S. embassy was verbally harassed by two men in a car while he was stopped at a traffic light. One of the men threw a can at the officer’s car. He was not hurt in the incident. November 4, 2012 – Farah, Afghanistan: A grenade exploded at U.S. Provincial Reconstruction Team Farah. No chief-of-mission personnel were injured in the attack. November 18, 2012 – Peshawar, Pakistan: Two mortars impacted in the vicinity of the U.S. consulate housing cluster in University Town, with one round hitting the offices of the International Medical Committee, a nongovernmental organization. The Consul General’s residence sustained shrapnel damage and one local guard was slightly injured. November 21, 2012 – Jakarta, Indonesia: A group of 150 demonstrators, protesting inflammatory material posted on the Internet, staged a demonstration in which they threw objects at the U.S. embassy. November 23, 2012 – Medan, Indonesia: Approximately 100 to 120 protesters from the Islamic Defender’s Front arrived at the American Presence Post to protest events in Gaza. The protesters became aggressive and damaged a vehicle gate in an attempt to gain access to the ground floor of the building. November 23, 2012 – Peshawar, Pakistan: A single round of indirect fire impacted a non-U.S. government private residence adjacent to a U.S. consulate residence in the University Town housing cluster. The device did not detonate, no chief-of-mission personnel were injured, and no facilities were damaged. December 4, 2012 – Dhaka, Bangladesh: A U. S. embassy vehicle carrying an embassy driver and police assigned to the embassy was surrounded by protesters on Airport Road. The demonstrators threw rocks and bricks at the vehicle, shattering several windows, injuring the driver, and forcing him off the road; the crowd then attempted to set the vehicle on fire. December 22, 2012 – Tunis, Tunisia: While U.S. government investigators were visiting the Tunisian Ministry of Justice, protesters forced their way into the building to confront the team. No one was hurt. Photos of the team, taken while they were inside the Ministry of Justice, were later posted on multiple social media and other Internet sites. January 25, 2013 – Cairo, Egypt: Ten men climbed the gate of the U.S. embassy motor pool, destroyed the facility, and stole U.S. government property. January 25, 2013 – Manila, Philippines: A crowd at the U.S. embassy protested against the Visiting Forces Agreement. They threw paint on the U.S. embassy facade. January 28, 2013 – Manila, Philippines: Protesters gathered at the U.S. embassy’s consular entrance to demonstrate against the grounding of the USS Guardian. They threw paint on the facade and defaced the embassy seal. February 1, 2013 – Ankara, Turkey: A suicide bomber detonated inside the pedestrian entrance to the U.S. embassy, killing himself and a local guard. The building’s facade sustained substantial damage. The Turkish leftwing group Revolutionary People’s Liberation Party/Front claimed responsibility for the attack. February 27, 2013 – Helmand Province, Afghanistan: Six rounds of indirect fire impacted northeast of Camp Bastion/Leatherneck. At the time of the attack, a U.S. embassy aircraft was on the ground. No one was hurt in the attack. March 21, 2013 – Baghdad, Iraq: Three rockets were directed at the U.S. diplomatic support center in Baghdad. There were no injuries and minimal damage. April 6, 2013 – Baghdad, Iraq: Two rockets were fired at the U.S. diplomatic support center in Baghdad. There were no injuries or damage to the center. April 6, 2013 – Qalat City, Zabul Province, Afghanistan: A suicide vehicle-borne improvised explosive device and a separate improvised explosive device targeted a provincial reconstruction team movement. The explosion killed a U.S. embassy officer, a U.S. Defense Department- contracted interpreter and three U.S. military personnel. Two other Department of State personnel, along with eight members of the U.S. military, and four Afghan civilians were wounded in the blast. The group was en route to a boys’ school to hand out books to Afghan students. April 10, 2013 – Baghdad, Iraq: Two rockets were fired at Baghdad International Airport, impacting near the U.S. diplomatic support center compound. There were no injuries or damage to the compound. June 23, 2013 – Baghdad, Iraq: Two rounds of indirect fire were tracked in the vicinity of the international zone, with one confirmed round impacting near the embassy’s Military Attaché and Security Assistance Annex. June 29, 2013 – Baghdad, Iraq: Three rounds of indirect fire were tracked to the international zone, with two rounds impacting approximately 200 meters north of the U.S. embassy heliport and the third round reportedly impacting100 meters north of the Embassy Annex Prosperity. August 10, 2013 – Baghdad, Iraq: Two rounds of indirect fire originating north of the international zone were reported to have landed within the international zone approximately 1 kilometer away from the U.S. embassy. August 13, 2013 – Baghdad, Iraq: Three rounds of indirect fire originating north of the international zone reportedly landed within the international zone, with one round reportedly landing as close as 0.6 kilometers north of the U.S. embassy. September 13, 2013 – Herat, Afghanistan: Taliban-affiliated insurgents conducted a complex attack against U.S. Consulate Herat using truck- and vehicle-borne improvised explosive devices and seven insurgents equipped with small arms, rocket-propelled grenades, and suicide vests. The insurgents detonated a truck-borne improvised explosive device outside the consulate’s entry control point followed by a second vehicle- borne improvised explosive device, after which the seven insurgents engaged U.S. and Afghan security personnel in a sustained firefight. According to State officials, the consulate’s internal defense team neutralized all attackers at the outer perimeter. No U.S. personnel were killed or injured in the attack. The attack lasted approximately 90 minutes and resulted in the death of eight Afghan guard force members and injury to two additional third-country National Guard force members. This appendix provides information on the extent to which State and USAID assigned personnel were in compliance with the FACT training requirement as of March 31, 2013, and the reasons for noncompliance. Table 1 shows the number of State assigned personnel we identified as required to complete FACT training by country, and the number of those personnel who complied with the requirement. Table 2 shows the countries where State assigned personnel whom we identified as required to complete FACT training that were not in compliance with the FACT training requirement, the numbers of noncompliant personnel, and State’s explanations of the noncompliance. As table 3 shows, we found no instances of noncompliance with the FACT training requirement among USAID personnel on assignments at five designated posts on March 31, 2013. At that time, no USAID personnel were on assignments to relevant posts in the three other designated high-threat countries. The following are GAO’s comments on the U.S. Departments of State’s letter dated February 18, 2014. 1. The numbers in our report reflect a compliance rate of about 95 percent for State Department assigned personnel. In addition to the contact named above, Judith A. McCloskey (Assistant Director), Jaime Allentuck, Emily Gupta, Jeffrey Isaacs, Farhanaz Kermalli, Lina Khan, and Mona Sehgal made key contributions to this report. Ashley Alley, Emily Christoff, Etana Finkler, Justin Fisher, Reid Lowe, Ruben Montes de Oca, and Steven Putansu provided additional support.

Summary: U.S personnel engaged in efforts overseas have faced numerous threats to their security. To mitigate these threats and prepare U.S. personnel for work in high-threat environments, State established a mandatory requirement that specified U.S. executive branch personnel under chief-of-mission authority and on assignments or short-term TDY complete FACT security training before arrival in a high-threat environment. This report examines (1) State and USAID personnel's compliance with the FACT training requirement and (2) State's and USAID's oversight of their personnel's compliance. GAO reviewed agencies' policy guidance; analyzed State and USAID personnel data from March 2013 and training data for 2008 through 2013; reviewed agency documents; and interviewed agency officials in Washington, D.C., and at various overseas locations. This public version of a February 2014 sensitive report excludes information that State has deemed sensitive. Using data from multiple sources, GAO determined that 675 of 708 Department of State (State) personnel and all 143 U.S. Agency for International Development (USAID) personnel on assignments longer than 6 months (assigned personnel) in the designated high-threat countries on March 31, 2013, were in compliance with the Foreign Affairs Counter Threat (FACT) training requirement. GAO found that the remaining 33 State assigned personnel on such assignments had not complied with the mandatory requirement. For State and USAID personnel on temporary duty of 6 months or less (short-term TDY personnel), GAO was unable to assess compliance because of gaps in State's data. State does not systematically maintain data on the universe of U.S. personnel on short-term TDY status to designated high-threat countries who were required to complete FACT training. This is because State lacks a mechanism for identifying those who are subject to the training requirement. These data gaps prevent State or an independent reviewer from assessing compliance with the FACT training requirement among short-term TDY personnel. According to Standards for Internal Control in the Federal Government , program managers need operating information to determine whether they are meeting compliance requirements. State's guidance and management oversight of personnel's compliance with the FACT training requirement have weaknesses that limit State's ability to ensure that personnel are prepared for service in designated high-threat countries. These weaknesses include the following: State's policy and guidance related to FACT training—including its Foreign Affairs Manual , eCountry Clearance instructions for short-term TDY personnel, and guidance on the required frequency of FACT training—are outdated, inconsistent, or unclear. For example, although State informed other agencies of June 2013 policy changes to the FACT training requirement, State had not yet updated its Foreign Affairs Manual to reflect those changes as of January 2014. The changes included an increase in the number of high-threat countries requiring FACT training from 9 to 18. State and USAID do not consistently verify that U.S. personnel complete FACT training before arriving in designated high-threat countries. For example, State does not verify compliance for 4 of the 9 countries for which it required FACT training before June 2013. State does not monitor or evaluate overall levels of compliance with the FACT training requirement. State's Foreign Affairs Manual notes that it is the responsibility of employees to ensure their own compliance with the FACT training requirement. However, the manual and Standards for Internal Control in the Federal Government also note that management is responsible for putting in place adequate controls to help ensure that agency directives are carried out. The gaps in State oversight may increase the risk that personnel assigned to high-threat countries do not complete FACT training, potentially placing their own and others' safety in jeopardy. GAO is making several recommen-dations to improve oversight of compliance with the FACT training requirement. These include identifying a mechanism to readily determine the universe of U.S. personnel subject to the requirement, updating State's policy manual to reflect changes made to the requirement in June 2013, consistently verifying that all U.S. civilian personnel have completed FACT training before arriving in designated high-threat countries, and monitoring compliance with the requirement. State concurred with the recommendations and stated that it will take steps to address them. USAID did not specifically agree or disagree but noted it plans to take additional steps.