For many years we have advocated the use of a risk management approach that entails managing risk through actions, including setting strategic goals and objectives, assessing risk, allocating resources based on risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. Risk assessment, an important element of a risk management approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. FPS meets its mission to protect GSA’s federal facilities by assessing the risks that face those facilities and identifying the appropriate countermeasures to mitigate those risks. Despite the importance of this mission, FPS has not implemented an effective risk management program. In August 2010, we reported that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements. Instead, FPS uses a facility-by- facility approach to risk management: we reported in 2010 that FPS assumes that all facilities with the same security level have the same risk regardless of their location. For example, a level IV facility in a metropolitan area is generally treated the same as one in a rural area. This building-by-building approach prevents FPS from comprehensively identifying risk across the entire portfolio of GSA’s facilities and allocating resources based on risk. Both our and DHS’s risk management frameworks include processes for assessing comprehensive risk across assets in order to prioritize countermeasures based on the overall needs of the system. In response to our recommendations in this area, FPS began developing a new system, the Risk Assessment and Management Program (RAMP). According to FPS, RAMP will support all components of the risk assessment process, including gathering and reviewing building information; conducting and recording interviews with GSA and tenant agencies; assessing threats, vulnerabilities, and consequences to develop a detailed risk profile; recommending appropriate countermeasures; and producing facility security assessment (FSA) reports. FPS also plans to use RAMP to track and analyze workforce data, contract guard program data, and other performance data, such as the types and definitions of incidents and incident response times. We are finalizing our ongoing review of FPS’s efforts to develop and implement RAMP as well as FPS’s transition to DHS’s National Protection and Programs Directorate (NPPD) and expect to report on these issues soon. Over the last 3 years we have reported on the challenges FPS has faced in the human capital area since moving to DHS from GSA in 2003. As mandated by Congress, in 2009 FPS increased the size of its workforce to 1,200 full time employees. However, FPS continues to operate without a strategic human capital plan. We recommended in 2009 that FPS develop a human capital plan to guide its current and future workforce planning efforts. We have identified human capital management as a high-risk issue throughout the federal government, including within DHS. A human capital plan is important to both align FPS’s human capital program with current and emerging mission and programmatic goals, and develop effective processes for training, retention, and staff development. In 2009, we reported that the absence of such a plan has contributed to inconsistent human capital activities among FPS regions and headquarters, as several regions told us they have implemented their own processes for performance feedback, training, and mentoring. In addition, we found that FPS’s workforce planning is limited because FPS headquarters does not collect data on its workforce’s knowledge, skills, and abilities. Without such information, FPS is not able to determine what its optimal staffing levels should be or identify gaps in its workforce needs and determine how to modify its workforce planning strategies to fill these gaps. FPS concurred with our recommendation and drafted a workforce analysis plan in June 2010. According to FPS, the plan must be reviewed by the Office of Management and Budget (OMB) before it is subject to approval by the Secretary of Homeland Security. FPS also has yet to fully ensure that its recent move to an inspector- based workforce does not hinder its ability to protect federal facilities. In 2007, FPS essentially eliminated its police officer position and moved to an all inspector-based workforce. FPS also decided to place more emphasis on physical security activities, such as completing FSAs, and less emphasis on law enforcement activities, such as proactive patrol. We reported in 2008 that these changes may have contributed to diminished security and increases in inspectors’ workload. Specifically, we found that when FPS is not providing proactive patrol at some federal facilities, there is an increased potential for illegal entry and other criminal activity. Moreover, under its inspector-based workforce approach, FPS is relying more on local police departments to handle crime and protection issues at federal facilities; however, we previously reported that at approximately 400 federal facilities across the United States, local police may not have the authority to respond to incidents inside those facilities. We recommended in 2008 that FPS clarify roles and responsibilities of local law enforcement agencies in responding to incidents at GSA facilities. While FPS agreed with this recommendation, FPS has decided not to pursue agreements with local law enforcement officials, in part because of local law enforcement officials’ reluctance to sign such agreements. In addition, FPS believes that the agreements are not necessary because 96 percent of the properties in its inventory are listed as concurrent jurisdiction facilities where both federal and state governments have jurisdiction over the property. Nevertheless, we continue to believe that these agreements would, among other things, clarify roles and responsibilities of local law enforcement agencies when responding to crime or other incidents. We are currently reviewing to what extent FPS is coordinating with state and local police departments to ensure adequate protection of federal facilities and will issue a report next year. FPS’s contract guard program is the most visible component of the agency’s operations and the agency relies on its guards to be its “eyes and ears” while performing their duties. Guards are responsible for controlling access to federal facilities by checking the identification of government employees and the public who enter federal facilities, and operating security equipment to screen for prohibited items. Since 2009, we have identified weaknesses in FPS’s contract guard program which hamper its ability to protect federal facilities. For example, we reported in 2009 and in 2010 that FPS does not have a reliable system to ensure that its 13,000 guards have the training and certifications required to stand post at federal facilities or comply with post orders once they are deployed. In 2009, we also identified substantial security vulnerabilities related to FPS’s guard program. In April and May 2009, GAO investigators conducted covert tests and were able to successfully pass components of an improvised explosive device (IED) concealed on their persons through security checkpoints monitored by FPS guards at 10 Level IV facilities in 4 major metropolitan areas. In addition, FPS’s penetration testing—similar to our covert testing—shows that guards continue to have problems with detecting prohibited items. For example, in March 2011, FPS contract guards allowed components for an active bomb to remain in a Level IV federal building in Detroit, Michigan for 3 weeks before a bomb squad was called to remove them. We also found in 2010 that although some guard contractors did not comply with the terms of their contracts, FPS did not take any enforcement action against them. According to FPS guard contracts, a contractor has not complied with the terms of the contract if, for example, the contractor has a guard working without valid certifications or background suitability investigations, or falsifies a guard’s training records. If FPS determines that a contractor does not comply with these contract requirements, it can—among other things—assess a financial deduction for nonperformed work, elect not to exercise a contract option, or terminate the contract for default or cause. We reviewed the official contract files for the 7 contractors who, as we testified in July 2009, had guards performing on contracts with expired certification and training records to determine what action, if any, FPS had taken against these contractors for contract noncompliance. According to the documentation in the contract files, FPS did not take any enforcement action against the contractors for not complying with the terms of the contract. Instead, FPS exercised the option to extend the contracts for these 7 contractors. Additionally, although FPS requires an annual performance evaluation of each guard contractor and at the conclusion of contracts exceeding $100,000, FPS did not always evaluate the performance of its contractors as required, and some evaluations were incomplete and not consistent with contractors’ performance. In response to our recommendations, FPS has taken several steps to improve the oversight of its contract guard program. Since July 2009, FPS has increased its penetration tests in some regions and the number of guard inspections it conducts at federal facilities in some metropolitan areas. Additionally, FPS began the process of providing additional x-ray and magnetometer training for its workforce. Under the new requirement, inspectors must receive 30 hours of x-ray and magnetometer training and guards are required to take 16 hours. Previously, guards were required to receive 8 hours of training on x-ray and magnetometer machines. Finally, FPS expects to use RAMP, once it is developed, to determine whether its 13,000 guards have met its training and certification requirements and to conduct guard inspections. As stated earlier, we are finalizing our review of FPS’s RAMP. We reported in May 2011 that FPS increased its basic security fee 4 times in 6 years to try to cover costs (an increase of over 100 percent). However, FPS has not reviewed its fees to develop an informed, deliberate fee design. We found that timely, substantive fee reviews are especially critical for fee-funded agencies to ensure that fee collections and operating costs remain aligned. FPS has broad authority to design its security fees, but the current fee structure has consistently resulted in total collection amounts less than agency costs, is not well understood or accepted by tenant agencies, and continues to be a topic of congressional interest and inquiry. In 2008, we recommended that FPS evaluate whether its use of a fee- based system or an alternative funding mechanism is the most appropriate manner to fund the agency. Although FPS agreed with this recommendation it has not begun such an analysis. Based on our updated work in 2011, we recommended that such an analysis include the examination of both alternative fee structures and a combination of fees and appropriations as well as the options and trade-offs discussed in our 2011 report. FPS agreed with this recommendation. We have reported that FPS is limited in its ability to assess the effectiveness of its efforts to protect federal facilities. To determine how well it is accomplishing its mission to protect federal facilities, FPS has identified some output measures. These measures include determining whether security countermeasures have been deployed and are fully operational, the amount of time it takes to respond to an incident, and the percentage of FSAs completed on time. As we reported in 2010, while output measures are helpful in assessing performance, outcome measures can provide FPS with broader information on program results, such as the extent to which its decision to move to an inspector-based workforce will enhance security at federal facilities. Outcome measures could also help identify the security gaps that remain at federal facilities and determine what action may be needed to address them. In addition, we reported in 2010 that FPS does not have a reliable data management system that will allow it to accurately track these measures or other important measures such as the number of crimes and other incidents occurring at GSA facilities. Without such a system, it is difficult for FPS to evaluate and improve the effectiveness of its efforts to protect federal employees and facilities, allocate its limited resources, or make informed risk management decisions. For example, weaknesses in one of FPS’s countermeasure tracking systems make it difficult to accurately track the implementation status of recommended countermeasures such as security cameras and x-ray machines. Without this ability, FPS has difficulty determining whether it has mitigated the risk of federal facilities to crime or a terrorist attack. FPS concurred with our recommendations and states that its efforts to address them will be completed in 2012 when its automated information systems are fully implemented. FPS has begun several initiatives that, once fully implemented, should enhance its ability to protect the more than 1 million federal employees and members of the public who visit federal facilities each year. Since 2008, we have made 28 recommendations to help FPS to address its challenges with risk management, strategic human capital planning, oversight of its contract guard workforce, and its fee-based funding structure. DHS and FPS have generally agreed with these recommendations. As of July 2011, as shown in Table 1, FPS was in the process of addressing 21 of them, although none were fully implemented. Of the remaining 7, 5 were recommendations from our May 2011 report, and we would not necessarily expect them to be fully implemented yet. According to FPS officials, the agency has faced difficulty in implementing many of our recommendations because of changes in its leadership, organization, funding, and staffing levels. In addition, FPS officials stated that its progress in implementing our recommendations has been affected by delays in developing several new management systems, such as RAMP. Chairmen Lungren and Bilirakis, Ranking Members Clarke and Richardson, and members of the Subcommittees, this completes my prepared statement. I would be happy to respond to any questions you or other members of the Subcommittees may have at this time. For further information on this testimony, please contact me at (202) 512- 2834 or by e-mail at goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Tammy Conquest, Assistant Director; Colin Fallon; Chelsa Gurkin; Alicia Loucks; Jackie Nowicki, Assistant Director; Justin Reed; and Susan Michal-Smith. Budget Issues: Better Fee Design Would Improve Federal Protective Service’s and Federal Agencies’ Planning and Budgeting for Security. GAO-11-492. Washington, D.C.: May 20, 2011. Homeland Security: Preliminary Observations on the Federal Protective Service’s Workforce Analysis and Planning Efforts. GAO-10-802R. Washington, D.C.: June 14, 2010. Homeland Security: Federal Protective Service’s Use of Contract Guards Requires Reassessment and More Oversight. GAO-10-614T. Washington, D.C.: April 14, 2010. Homeland Security: Federal Protective Service’s Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards. GAO-10-341. Washington, D.C.: April 13, 2010. Homeland Security: Ongoing Challenges Impact the Federal Protective Service’s Ability to Protect Federal Facilities. GAO-10-506T. Washington, D.C.: March 16, 2010. Homeland Security: Greater Attention to Key Practices Would Improve the Federal Protective Service’s Approach to Facility Protection. GAO-10-142. Washington, D.C.: October 23, 2009. Homeland Security: Federal Protective Service Has Taken Some Initial Steps to Address Its Challenges, but Vulnerabilities Still Exist. GAO-09-1047T. Washington, D.C.: September 23, 2009. Homeland Security: Federal Protective Service Should Improve Human Capital Planning and Better Communicate with Tenants. GAO-09-749. Washington, D.C.: July 30, 2009. Homeland Security: Preliminary Results Show Federal Protective Service’s Ability to Protect Federal Facilities Is Hampered By Weaknesses in Its Contract Security Guard Program. GAO-09-859T. Washington, D.C.: July 8, 2009. Homeland Security: The Federal Protective Service Faces Several Challenges That Raise Concerns About Protection of Federal Facilities. GAO-08-897T. Washington, D.C.: June 19, 2008. Homeland Security: The Federal Protective Service Faces Several Challenges That Raise Concerns About Protection of Federal Facilities. GAO-08-914T. Washington, D.C.: June 18, 2008. Homeland Security: The Federal Protective Service Faces Several Challenges That Hamper Its Ability to Protect Federal Facilities. GAO-08-683. Washington, D.C.: June 11, 2008. Homeland Security: Preliminary Observations on the Federal Protective Service’s Efforts to Protect Federal Property. GAO-08-476T. Washington, D.C.: February 8, 2008. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: As part of the Department of Homeland Security (DHS), the Federal Protective Service (FPS) is responsible for protecting federal employees and visitors in approximately 9,000 federal facilities owned or leased by the General Services Administration (GSA). FPS has a budget of approximately $1 billion and maintains approximately 1,200 full-time employees and about 13,000 contract security guards that help accomplish the agency's facility protection mission. This testimony is based on past reports and testimonies and discusses challenges FPS faces in carrying out its mission with regard to (1) risk management, (2) strategic human capital planning, (3) oversight of its contract guard program, and (4) ensuring that its fee-based funding structure is the appropriate mechanism for funding the agency. GAO also addresses the extent to which FPS has made progress in responding to these challenges. To perform this work, GAO used its key facility protection practices as criteria, visited FPS regions and selected GSA buildings, reviewed training and certification data for FPS's contract guards, and interviewed officials from DHS, GSA, guard contractors, and guards. FPS continues to face challenges in carrying out its mission. Specifically: (1) The absence of a risk management program hampers FPS's ability to protect federal facilities. For many years, GAO has advocated the importance of a risk management approach. GAO reported in August 2010 that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements. Instead, FPS uses a facility-by-facility approach which assumes that facilities with the same security level have the same risk regardless of their location. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS's security goals, as GAO has recommended, there is limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. (2) FPS has not fully addressed several key human capital issues. FPS continues to operate without a strategic human capital plan to guide its current and future workforce planning efforts, as GAO recommended in 2009. Further, FPS is not able to determine what its optimal staffing levels should be because FPS headquarters does not collect data on its workforce's knowledge, skills, and abilities. FPS has yet to fully ensure that its recent move to an inspector-based workforce does not hinder its ability to protect federal facilities. (3) FPS faces longstanding challenges in managing its contract guard workforce. Weaknesses in FPS's contract guard program hamper its ability to protect federal facilities. GAO reported in 2009 and 2010 that FPS cannot ensure that its contract guards have required training and certifications. FPS is in the process of addressing GAO recommendations. For example, FPS revised its x-ray and magnetometer training for its inspectors and guards. (4) FPS has not reviewed its fee design or determined an appropriate funding mechanism. FPS increased its basic security fee four times in 6 years to try to cover costs, but has not reviewed its fees to develop an informed, deliberate design. FPS's current fee structure has consistently resulted in total collection amounts less than agency costs and continues to be a topic of congressional interest and inquiry. FPS has yet to evaluate whether its fee-based structure or an alternative funding mechanism is most appropriate for funding the agency, as GAO recommended in 2008 and 2011. FPS has made some progress in improving its ability to protect federal facilities. For example, in response to GAO recommendations, FPS is developing the Risk Assessment and Management Program (RAMP), which could enhance its ability to comprehensively assess risk at federal facilities and improve oversight of its contract guard program. DHS and FPS have initiatives in process to address 21 of the 28 recommendations GAO has made related to the challenges above, although none are yet fully implemented. According to FPS officials, this is in part because of changes in the agency's leadership, organization, funding, staffing levels, and delays in developing several new management systems, such as RAMP. DHS and FPS have generally concurred with GAO's past recommendations. DHS and FPS have initiatives in process, for example, to address risk management, strategic human capital planning, and oversight of its contract guard program.