To determine the challenges FPS faces in managing its guard contractors and guards, we conducted site visits at 6 of FPS’s 11 regions. To select these 6 regions, we considered the number of FPS guards, contractors, and federal facilities, and the geographic dispersion of the regions across the United States. At each region, we observed FPS’s guard inspection process and interviewed FPS’s regional manager, contract guard program managers, inspectors who are responsible for conducting guard inspections; guards, and contractors. We also interviewed officials at GSA headquarters and regional security officials in all 11 FPS regions, to identify any concerns GSA has with FPS’s contract guard program. We also met with representatives of the National Association of Security Companies to learn about the contract security guard industry. In addition, we reviewed and analyzed FPS’s contract requirements and training and certifications requirements, and reviewed the Security Guard Information Manual. We also randomly selected 663 out of approximately 15,000 guard training records that were maintained in FPS’s Contract Guard Employment Requirements Tracking System (CERTS) and validated them against the contractual requirements that were in effect at the time of our review. To assess the reliability of the CERTS data, we interviewed agency officials about data quality, reviewed relevant documentation, and performed our own electronic testing of the data. Because CERTS was not fully reliable for our purpose of determining the extent to which there were guards with expired certifications or training records, we corroborated our findings using FPS regional spreadsheets and information provided by the contractors, or the actual guard files. To determine what actions, if any, FPS has taken against contractors for not complying with the terms of the contract, we reviewed the contract files for 7 of FPS’s 38 guard contractors. We selected these 7 contractors because our previous work showed that they had contract compliance issues. In addition to reviewing FPS’s contract files, we interviewed contracting officials in these locations to learn about what information should be included in the contract files. We also requested all contract evaluations for January 2006 through June 2009. We estimate that the number of guard contracts requiring a performance evaluation during this period would have totaled approximately 375. We analyzed a random sample of 99 FPS contractor evaluations to determine how FPS evaluated the performance of its contractors on an annual basis. We conducted covert testing at 10 judgmentally selected level IV facilities. The facilities were selected from FPS’s most current listing of federal facilities by security level. The criteria for choosing these facilities include public access, location in a major metropolitan area, and level IV facility security level. The results of our audit work are not generalizable. However, almost 54 percent of FPS’s 15,000 guards and 52 percent of the 2,360 facilities that have guards are located in the 6 regions where we conducted our audit work. Because of the sensitivity of some of the information in our report, we cannot provide information about the specific locations of the incidents discussed. To determine what actions, if any, FPS has taken to address challenges with managing its contract guard program, we reviewed new contract guard program guidance issued since our July 2009 testimony. We conducted follow-up site visits at 3 of the original 6 FPS regions that we visited and interviewed FPS officials, contractors, and guards who are responsible for implementing FPS’s new contract guard program guidance. We also observed guard inspections and covert testing done by FPS in August and November 2009. We conducted this performance audit from July 2008 to February 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Since the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma City, FPS has relied on a substantial contract guard force to help accomplish its mission of protecting federal facilities. The level of security FPS provides at each of the 9,000 federal facilities varies depending on the building’s security level. While the contractor has the primary responsibility for training and ensuring that the guards have met certification requirements, FPS is ultimately responsible for oversight of the guards and relies on about 752 inspectors located in its 11 regions to inspect guard posts and verify that training, certifications, and time cards are accurate. It is also responsible for providing X-ray and magnetometer training to the guards. Figure 1 shows the location of FPS’s 11 regions and the number of guards and federal facilities with guards in each of these regions, as of July 2009. Some of the key responsibilities of FPS’s guards include controlling access, enforcing property rules and regulations, detecting and reporting criminal acts, and responding to emergency situations involving the safety and security of the facility. Guards may only detain, not arrest, an individual, and their authority typically does not extend beyond the facility. Before guards are assigned to a post or an area of responsibility at a federal facility, FPS requires that they all undergo background suitability checks and complete approximately 128 hours of training provided by the contractor or FPS, including 8 hours of X-ray and magnetometer training. Guards must also pass an FPS-administered written examination and possess the necessary certificates, licenses, and permits as required by the contract. FPS also requires its guards to complete 40 hours of refresher training every 2 to 3 years, depending on the terms of the contract. Some states also require that guards obtain additional training and certifications. In addition, in response to our July 2009 report, in August 2009, FPS revised its X-ray and magnetometer training requirements and began requiring its guards to watch a 15-minute digital video disc (DVD) on bomb component detection that addresses types of bombs, bomb components, abnormal behavioral such as apprehension or nervousness, and actions to take if a bomb threat is detected. FPS also requires the contractor to ensure that all guards view this DVD when they receive refresher training, which occurs every 2-3 years after the basic training. As of October 2009, FPS had 125 guard contracts with 38 different contractors. The majority of FPS guard service contracts are for routine security services at federal facilities and are for a 12-month base period. They also have four 12-month options. FPS’s contractors are responsible for providing and maintaining all guard services as described in the contract statement of work, including licensing. FPS has three Consolidated Contracting Groups (CCG) located in Philadelphia, Pennsylvania; Grand Prairie, Texas; and Federal Way, Washington, that provide contracting support for guard services and other FPS mission-related acquisitions. Within the CCGs, 43 warranted contracting officers are dedicated to FPS contracts. After awarding a contract, the contracting officers are responsible for enforcing the terms and conditions of the guard contracts, including authorizing and negotiating any changes to the contract. Each year the contracting officer is required to perform an annual review of the contract and take enforcement action if the services have not been provided, in accordance with the terms of the contract. The contracting officer also issues modifications and ensures proper payments are made in accordance with the contract. In addition to the 43 warranted contracting officers, approximately 60 Contracting Officer Technical Representatives (COTR) work with the contracting officers to complete annual contractor performance evaluations and determine if a contract option should be exercised. COTRs are responsible for daily contract oversight, assessing a contractor’s performance, and ensuring that the contractor is meeting all training, certification, and suitability requirements. Many of the COTRs are current or former inspectors and may have other job duties in addition to their COTR responsibilities, depending on their regional resource alignment. FPS’s inspectors are also involved in the oversight of contract guards. The inspectors help the COTRs oversee guards and contractors. For example, the COTR relies on inspectors to perform guard inspections and report any problems with respect to the performance of guards on post to the COTR. Finally, FPS has a contract guard program manager in each of its 11 regions who is responsible for coordinating with the contracting officers and the COTRs to ensure that performance monitoring and reporting are being used to ensure continuous high-quality contractor performance in their regions. FPS continues to face challenges with overseeing its guard contractors that hamper its ability to protect federal facilities. FPS generally requires its contractors to provide guards who have completed the training and certification requirements shown in table 1. The most notable area where FPS contract requirements vary is regarding X-ray and magnetometer training. For example, for 3 of the 7 contractors we reviewed, FPS’s contracts do not require X-ray and magnetometer training if the guards were not assigned to an access control point. In contrast, guards employed by the other 4 contractors we reviewed were required to receive X-ray and magnetometer training regardless of their duty station. On the basis of our review of FPS’s contractual requirements and guard training and certification records maintained by FPS and/or the contractor, we reported in July 2009 that 62 percent, or 411, of the 663 guards employed by 7 of FPS’s 38 guard contractors and subsequently deployed to a federal facility had at least one expired certification. Examples of expired certifications included firearms qualification, background investigation, domestic violence declaration, CPR, or first aid training certification. More specifically, we also found that over 75 percent of the 354 guards at one level IV facility had expired certifications or the contractor had no record of the training. According to the contractor information for another contract, almost 40 percent of the 191 guards at another level IV facility had domestic violence declarations that had expired. Guards are not permitted to carry firearms unless they have such declarations. Since our July 2009 report, we have requested information from FPS to determine whether the status of these guards’ certifications had changed. FPS’s data showed that of the 663 guards, 435 are now fully certified and trained, 167 are not fully certified and trained, and 61 guards are no longer working on the contract. We also testified in July 2009 that some guard contractors were not providing building-specific training, such as on actions to take during a building evacuation or a building emergency. This lack of training may have contributed to several incidents in which guards neglected their assigned responsibilities. For example, At a level IV facility, the guards did not follow evacuation procedures and left two access points unattended, thereby leaving the facility vulnerable. At a different level IV facility, a guard allowed employees to enter the building while an incident involving suspicious packages was being investigated. At a level III facility, a guard allowed employees to access an area that was required to be evacuated because of a suspicious package. In addition to receiving insufficient building-specific training, guards generally said that they did not receive scenario-based training and thus were not sure what they should do in certain situations. During our site visits at 6 FPS regions, we interviewed over 50 guards and presented them with an incident that occurred at a federal facility in 2008. Specifically, we asked the guards whether they would assist an FPS inspector chasing an individual escaping from a federal facility in handcuffs. According to FPS policies and in accordance with contract requirements, contract guards are responsible for detecting, delaying, detaining, or apprehending persons attempting to gain unauthorized access to government property or otherwise violating laws, rules, and regulations. The guards’ responses varied, however. Some guards stated that they would assist the FPS inspector and apprehend the individual, while others stated that they would likely do nothing and stay at their posts because they feared being fired for leaving their posts. Some guards also told us that they would not intervene because of the threat of a liability lawsuit for use of force and did not want to risk losing their jobs. Moreover, guards employed by some contractors were not always complying with post orders once they were deployed to federal facilities. FPS’s post orders describe a number of things that guards are prohibited from doing while on post. For example, guards are prohibited from sleeping, using government property such as computers, and test-firing a weapon unless at a range course. However, as we testified in July 2009, when FPS routinely inspects guard posts, it has found incidents at level IV facilities where guards were not complying with post orders, including the following: A guard was caught using government computers while he was supposed to be standing post, to further his private for-profit adult Web site. A guard attached a motion sensor to a pole at the entrance to a federal facility garage to alert him whenever a person was approaching his post. Another law enforcement agency discovered the device and reported it to FPS. A guard, during regular business hours, accidentally fired his firearm in a restroom while practicing drawing his weapon. A guard failed to recognize or did not properly X-ray a box containing semiautomatic handguns at the loading dock at one federal facility we visited. FPS became aware of the situation only because the handguns were delivered to FPS. In each of these incidents, the guards were fired or disciplined. However, FPS continues to find instances where guards are not complying with post orders. For example, 2 days after the July 2009 hearing, another guard fired his firearm in a restroom in a level IV facility while practicing drawing his weapon. FPS has not taken actions against some guard contractors that did not comply with the terms of the contracts. According to FPS guard contracts, a contractor has not complied with the terms of the contract if the contractor has a guard working without valid certifications or background suitability investigations, falsifies a guard’s training records, does not have a guard at a post, or has an unarmed guard working an armed post. If FPS determines that a contractor does not comply with these contract requirements, it can—among other things—assess a financial deduction for nonperformed work; elect not to exercise a contract option; or terminate the contract for default or cause. Deductions are one type of action FPS may use to address contractor nonperformance issues. We reviewed the official contract files for the 7 contractors who, as we testified in July 2009, had guards performing on contracts with expired certification and training records to determine what action, if any, FPS had taken against these contractors for contract noncompliance. According to the documentation in the contract files, FPS did not take any enforcement action against them for not complying with the terms of the contract, a finding consistent with DHS’s Inspector General’s 2009 report. In fact, FPS exercised the option to extend the contracts of these 7 contractors. FPS contracting officials told us that the contracting officer who is responsible for enforcing the terms of the contract considers the appropriate course of action among the available contractual remedies on a case-by-case basis. For example, the decision of whether to assess financial deductions is a subjective assessment in which the contracting officer and the COTR take into account the value of the nonperformance and the seriousness of the deficiency, according to FPS contracting officials. According to FPS’s Acquisitions Division Director, financial deductions are rarely taken for contract noncompliance and when they are the amount is generally insignificant. FPS requires that a performance evaluation be completed annually and at the conclusion of the contract for those contracts exceeding $100,000. Contractor performance evaluations are one of the most important tools available for ensuring that the contractor meets the terms of the contract. According to contracting officials, monetary deductions do little to change contractor behavior, but contractors recognize the importance of evaluations and that FPS uses them to help determine whether to extend the contract. FPS policy also requires contracting officials to consider past performance as one of several technical evaluation factors in awarding new contracts. In addition, given that other federal agencies rely on many of the same contractors to provide security services, the need to complete accurate evaluations of a contractor’s past performance is critical. FPS’s contracting officers and COTRs did not always evaluate contractors’ performance as required, and some evaluations were incomplete and not consistent with contractors’ performance. We reviewed a random sample of 99 contract performance evaluations from calendar year 2006 through June 2009. These evaluations were for 38 contractors. Eighty-two of the 99 contract performance evaluations showed that FPS assessed the quality of services provided by the majority of its guard contractors as “satisfactory,” “very good,” or “exceptional.” For the remaining 17 evaluations, 11 showed that the contractor’s performance was “marginal,” 1 as “unsatisfactory,” and assessments for 5 contractors were not complete. According to applicable guidance, a contractor must meet contractual requirements to obtain a satisfactory evaluation and a contractor should receive an unsatisfactory evaluation if its performance does not meet most contract requirements and recovery in a timely manner is not likely. Nevertheless, we found instances where some contractors received a satisfactory or better rating although they had not met some of the terms of the contract. For example, contractors receiving satisfactory or better ratings included the 7 contractors that had guards with expired certification and training records working at federal facilities. In addition, some performance evaluations that we reviewed did not include a justification for the rating and there was no other supporting documentation in the official contract file to explain the rating. Moreover, there was no information in the contract file that indicated that the COTR had communicated any performance problems to the contracting officer. FPS’s contracting officials told us that the contract files should contain annual performance evaluations. In addition, if a contractor has not met the terms of the contract, the contract file should also contain guard inspection reports and correspondence between the contracting officer and contractor, and any other written reports that can be used to evaluate the contractor’s performance in meeting the terms of the contract. In addition, DHS’s Office of Procurement Operations has also established procedures for preparing and organizing contract files and has provided contracting officials with a standard checklist to identify the documentation required in each stage of the contract award life cycle. According to this checklist, the contract file should contain information about performance monitoring, quality assurance records, and evaluations of contractor performance for contracts over $100,000. The Federal Acquisition Regulation (FAR) also prescribes requirements for establishing, maintaining, and disposing of contract files. It requires the head of each office that performs contracting, contract administration, or payment functions to establish files containing records of all contractual actions. FPS’s CCGs did not follow these procedures for the contract files we reviewed. Specifically, our review of the official contract files for the 7 contractors who had guards with expired training and certification records working at federal facilities showed that the files were poorly documented, did not contain all of the required performance-related information, and varied among the CCGs. For example, contract files for 5 of the 7 contractors we reviewed did not have guard inspection reports, justifications for extending the contract, or annual performance evaluations. Without the performance-related information, FPS has difficulty deciding whether to exercise a contract option. Moreover, because federal agencies rely on many of the same contractors to provide security services, the need to consistently document contractor performance is important in determining future contracts. While FPS has given its guard contractors the responsibility to conduct most of the training of guards, FPS is responsible for conducting the 8 hours of X-ray and magnetometer training that all guards are required to have. However, as we reported in July 2009, FPS was not providing some of its guards with all of the required training in the six regions we visited. For example, in one region, FPS has not provided the required X-ray or magnetometer training to its almost 1,500 guards since 2004. X-ray and magnetometer training is important because the majority of the guards are primarily responsible for using this equipment to monitor and control access points at federal facilities. Controlling access to a facility helps ensure that only authorized personnel, vehicles, and materials are allowed to enter, move within, and leave the facility. In the absence of the X-ray and magnetometer training, one contractor in the region said that it is relying on veteran guards who have experience operating these machines to provide some on-the-job training to new guards. FPS officials subsequently told us that the contract for this region requires that only guards who are assigned to work on posts that contain screening equipment are required to have 8 hours of X-ray and magnetometer training. However, in response to our July 2009 testimony, FPS now requires all guards to receive 16 hours of X-ray and magnetometer training. As of January 2010, these guards had not received the 16 hours of training but continued to work at federal facilities in this region. FPS plans to provide X-ray and magnetometer training to all guards by the end of 2010. Lapses and weaknesses in FPS’s X-ray and magnetometer training have contributed to several incidents at federal facilities in which the guards neglected to carry out their responsibilities. For example, at a level IV federal facility in a major metropolitan area, an infant in a carrier was sent through the X-ray machine. Specifically, according to an FPS official in that region, a woman with her infant in a carrier attempted to enter the facility, which has child care services. While retrieving her identification, the woman placed the carrier on the X-ray machine. Because the guard was not paying attention and the machine’s safety features had been disabled, causing the belt to operate continuously, the infant in the carrier was sent through the X-ray machine. FPS investigated the incident and dismissed the guard. However, the guard subsequently sued FPS for not providing the required X-ray training. The guard won the suit because FPS could not produce any documentation to show that the guard had received the training, according to an FPS official. As we reported in July 2009, FPS’s primary system—CERTS—for monitoring and verifying whether guards have the training and certifications required to stand post at federal facilities is not fully reliable. Moreover, five of the six regions we visited did not have current information on guard training and certifications. Guard contractors are responsible for maintaining the status of each element of the guards’ certifications, such as firearms qualification, domestic violence certification, and first aid training. These certifications are subsequently entered into and tracked in CERTS by FPS personnel in the regional program offices. According to FPS officials in these five regions, updating CERTS is time-consuming and they do not have the resources needed to keep up with the thousands of paper files. Consequently, these five regions were not generally relying on CERTS and instead were relying on the contractor to self-report training and certification information about its guards. Not having a fully reliable system to better track whether training has occurred may have contributed to a situation in which a contractor allegedly falsified training records. As we reported last summer, in 2007, FPS was not aware that a contractor who was responsible for providing guard service at several level IV facilities in a major metropolitan area had allegedly falsified training records until it was notified by an employee of the company. According to FPS’s affidavit, the contractor allegedly repeatedly self-certified to FPS that its guards had satisfied CPR and first aid training requirements, as well as the contractually required biannual recertification training, although the contractor knew that the guards had not completed the required training and were not qualified to stand post at federal facilities. According to FPS’s affidavit, in exchange for a $100 bribe, contractor officials provided a security guard with certificates of completion for CPR and first aid. The case is currently being litigated in U.S. District Court. FPS has limited assurance that its 15,000 guards are complying with post orders. As we testified in July 2009, we identified substantial security vulnerabilities related to FPS’s guard program. Each time they tried, our investigators successfully passed undetected through security checkpoints monitored by FPS guards with the components for an improvised explosive device (IED) concealed on their persons at 10 level IV facilities in four cities in major metropolitan areas. We planned additional tests but suspended them after achieving 100 percent test results, which highlighted the vulnerabilities federal facilities face. The specific components for this device, items used to conceal the device components, and the methods of concealment that we used during our covert testing are classified, and thus are not discussed in this report. Of the 10 level IV facilities we penetrated, 8 were government owned and 2 were leased facilities. The facilities included field offices of a U.S. Senator and a U.S. Representative as well as agencies of the Departments of Homeland Security, Transportation, Health and Human Services, Justice, and State, and others. The 2 leased facilities did not have any guards at the access control point at the time of our testing. In August 2009, FPS told us that the 2 leased facilities did not have guards because the facilities were recently reclassified from a level IV to level II based on the new Interagency Security Committee security standards. Using publicly available information, our investigators identified a type of device that a terrorist could use to cause damage to a federal facility and threaten the safety of federal workers and the general public. The device was an IED made up of two parts—a liquid explosive and a low-yield detonator—and included a variety of materials not typically brought into a federal facility by employees or the public. Although the detonator itself could function as an IED, investigators determined that it could also be used to set off a liquid explosive and cause significantly more damage. To ensure safety during this testing, we took precautions so that the IED would not explode. For example, we lowered the concentration level of the material. To gain entry into each of the 10 level IV facilities, our investigators showed photo identification (state driver’s licenses) and walked through the magnetometer machines without incident. The investigators also placed their briefcases with the IED material on the conveyor belts of the X-ray machines, but the guards detected nothing. Furthermore, our investigators did not receive any secondary searches from the guards that might have revealed the IED material that we brought into the facilities. At security checkpoints at 3 of the 10 facilities, our investigators noticed that the guard was not looking at the X-ray screen as some of the IED components passed through the machine. A guard questioned an item in the briefcase at 1 of the 10 facilities, but the materials were subsequently allowed through the X-ray machine. At each facility, once past the guard screening checkpoint, our investigators proceeded to a restroom and assembled the IED. At some of the facilities, the restrooms were locked. Our investigators gained access by asking employees to let them in. With the IED completely assembled in a briefcase, our investigators walked freely around several floors of the facilities and into various executive and legislative branch offices. In addition, recent FPS penetration testing—similar to the covert testing we conducted in May 2009—showed that guards continued to experience problems with complying with post orders. Since July 2009, FPS has conducted 53 penetration tests in the six regions we visited. The guards identified the prohibited items (guns, knives, and fake bombs) in 18 tests but did not identify the items in 35 tests. More specifically, in August 2009, we accompanied FPS on 2 of these penetration tests at a level IV facility. During 1 test, FPS agents placed a bag containing a fake gun and knife on the X-ray machine belt. The guard failed to identify the gun and knife on the X-ray screen, and the undercover FPS official was able to retrieve his bag and proceed to the check-in desk without incident. During a second test, a knife was hidden on an FPS officer. During the test, the magnetometer detected the knife, as did the hand wand, but the guard failed to locate the knife and the FPS officer was able to gain access to the facility. According to the FPS officer, the guards who failed the test had not been provided the required X-ray and magnetometer training. Upon further investigation, only 2 of the 11 guards at the facility had the required X-ray and magnetometer training. In response to the results of this test, FPS debriefed the contractor and moved one of the guard posts to improve access control. In November 2009, we accompanied FPS on another test of security countermeasures at a different level IV facility. As in the previous test, a FPS agent placed a bag containing a fake bomb on the X-ray machine belt. The guard operating the X-ray machine did not identify the fake bomb and the inspector was allowed to enter the facility with it. In a second test, a FPS inspector placed a bag containing a fake gun on the X-ray belt. The guard identified the gun and the FPS inspector was detained. However, the FPS inspector was told to stand in a corner and was not handcuffed or searched as required. In addition, while all the guards were focusing on the individual with the fake gun, a second FPS inspector walked through the security checkpoint with two knives without being screened. In response to the results of this test, FPS suspended 2 guards and provided additional training to 2 guards. In response to our July 2009 testimony, FPS has increased the number of guard inspections at federal facilities in some metropolitan areas. FPS currently requires two guard inspections to be completed a week at level IV facilities. Prior to this new requirement, FPS did not have a national requirement for guard inspections, and each region we visited had requirements that ranged from no inspection requirements to each inspector having to conduct five inspections per month. Overall, FPS’s data show that the number of guard inspections has increased nearly 40 percent, from 4,639 inspections in July 2009 to 6,501 in October 2009. However, about 54 percent of these inspections occurred either at level IV facilities or in metropolitan areas and not in rural areas, where we found that guard inspections are rarely done. In our 2008 report, we found incidents in which guards deployed to federal facilities in rural areas had not been inspected in over 1 year or where the inspections were done over the telephone, instead of in person. In addition, while FPS’s Director authorized overtime to complete the additional inspections, previous funding challenges that resulted in FPS limiting overtime raise questions about whether it will be able to continue to authorize overtime to fund these increased inspections. Moreover, concerns remain about the quality of guard inspections. According to officials in one region, guard program officials recently provided training for inspectors on how to conduct and document guard inspections. However, despite this training, program officials said that the quality of the guard inspections and reports remains inconsistent. The guard inspection reports are one of the key factors FPS uses to assess a contractor’s performance. FPS is in the process of providing additional X-ray and magnetometer training, in response to our July testimony, but guards will not be fully trained until the end of 2010. FPS plans to train its inspectors—who will subsequently be responsible for training the guards—first. Under the new program, FPS will require inspectors to receive 30 hours of X-ray and magnetometer training and guards to receive 16 hours of training. Prior to this new requirement, FPS required guards to receive 8 hours of training on X-ray and magnetometer machines. In July 2009, FPS also required each guard to watch a government-provided DVD on bomb component detection by August 20, 2009. According to FPS, as of January 2010, approximately 78 percent, or 11,711, of the 15,000 guards had been certified as having watched the DVD. While the changes FPS has made to its X-ray and magnetometer training will help to address some of the problems we found, there are some weaknesses in the guard training. For example, one contractor told us that one of the weaknesses associated with FPS’s guard training program is that it focuses primarily on prevention and detection but does not adequately address challenge and response. This contractor has developed specific scenario training and provides its guards on other contracts with an additional 12 hours of training on scenario-based examples, such as how to control a suicide bomber or active shooter situation, evacuation, and shelter in place. The contractor, who has multiple contracts with government agencies, does not provide this scenario-based training to its guards on FPS contracts because FPS does not require it. We also found that some guards were still not provided building-specific training, such as what actions to take during a building evacuation or a building emergency. According to guards we spoke to in one region, guards receive very little training on building emergency procedures during basic training or the refresher training. These guards also said that the only time they receive building emergency training is once they are on post. Consequently, some guards do not know how to operate basic building equipment, such as the locks or the building ventilation system, which is important in a building evacuation or building emergency. In 2007, FPS began developing a new system to replace several legacy GSA systems including CERTS, Security Tracking System, and other systems associated with the facility security assessment program. The new system, referred to as the Risk Assessment Management Program (RAMP), is designed to be a central database for capturing and managing facility security, including the risks posed to federal facilities and the countermeasures that are in place to mitigate risk. It is also expected to enable FPS to manage guard certifications and to conduct and track guard inspections electronically as opposed to manually. RAMP will also allow FPS to produce regular reports on the status of guards and guard contracts and to address issues with guards and contractors as they arise. According to FPS officials, the first phase of RAMP training started in some regions in October 2009. However, as of December 2009, about half of the 752 inspectors had not received RAMP training. FPS also has experienced technical difficulties with RAMP, for example, server issues, and the system is not always available for use. Consequently, the 386 inspectors that were trained are not able to use RAMP and are doing guard inspections manually, a fact that increases the risk of inaccurate data. We are encouraged that FPS is attempting to replace some of its legacy GSA systems with a more reliable and accurate system. However, FPS has not fully addressed some issues associated with implementing RAMP. For example, we are concerned about the accuracy and reliability of the information that will be entered into RAMP. According to FPS, the agency plans to transfer data from several of its legacy systems, including CERTS, into RAMP. In July 2009, we testified on accuracy and reliability issues associated with CERTS. Since that time, FPS has taken steps to review and update all guard training and certification records. For example, FPS is conducting an internal audit of its CERTS database. As of February 2010, the results of that audit showed that FPS was able to verify the status for about 8,600 of its 15,000 guards. FPS is experiencing difficulty verifying the status of the remaining 6,400 guards, in part because it does not have a system to obtain reliable information on a real-time basis. Despite FPS’s recent efforts, challenges remain. While RAMP is a step in the right direction, it is not fully operational. Equally important, RAMP will not put FPS in an effective position to provide the oversight and decision making that are necessary to ensure that its 15,000 guards deployed at federal facilities in metropolitan and rural areas, private contractors, and 1,225 full-time employees in headquarters and 11 regions are performing as required and achieving FPS’s facility protection mission. We have previously reported that for an agency to effectively manage and control its operations, it must have relevant and reliable information relating to its mission on a real-time basis. FPS does not have this capability. FPS relies on its 11 regions to manage its contract guard program, including the collection and analysis of performance information. However, each of the 11 regions differs in how it manages, collects, and reports contract guard information. Without the ability to access contract guard information on a real-time basis, FPS cannot ensure appropriate oversight and accountability, or that the agency’s facility protection mission is accomplished. In addition, since 2002, we and DHS’s Inspector General have reported that oversight of the contract guard program is a challenge for FPS. For example, in 2008, we reported on the poor quality of contract guards and the lack of guard inspections. However, FPS has only recently begun addressing some of these challenges and has not undertaken a comprehensive review of the agency’s use of contract guards to protect federal facilities since the bombing of Alfred P. Murrah Federal Building in 1995. We also identified a number of changes that have had a cascading impact on FPS’s management of the contract guard program. Chief among them is FPS’s decision to move to an inspector-based workforce. Under this approach, FPS eliminated its police officer position and is primarily using about 752 inspectors and special agents to oversee its 15,000 contract guards, provide law enforcement services, conduct building security assessments, and perform other duties as assigned. Many inspectors in the regions we visited stated that they are not provided sufficient time to complete guard inspections because FPS’s priority is physical security activities, such as completing facility security assessments. The combined effect of recent changes and long-standing challenges has contributed to the poor oversight of the contract guard program, and we believe it indicates a need for a reassessment of the current approach to protect federal facilities and greater oversight. FPS also has not completed a workforce analysis to determine if its current staff of about 752 inspectors will be able to effectively complete the additional inspections as required and provide the X-ray and magnetometer training to 15,000 guards in addition to their current physical security and law enforcement responsibilities. Our previous work has raised questions about the wide range of responsibilities inspectors have and the quality of facility security assessments and guard oversight. According to the Director of FPS, while having more resources would help address the weaknesses in the guard program, the additional resources would have to be trained and thus could not be deployed immediately. Finally, according to the Director of FPS, the agency recognized that its guard program has long-standing challenges, and in response to recent concerns about the guard program identified by GAO and others, FPS contemplated assuming responsibility for all guard training and/or federalizing some guard positions at some federal facilities. However, FPS decided not to pursue federalizing guard positions because of the cost. While federalizing guard positions may not be cost-beneficial, we believe that given the long-standing challenges FPS faces with managing its guard program, it should continue to conduct research to determine if other options for protecting federal facilities may be more cost-beneficial. FPS continues to face challenges in ensuring that its $659 million guard program is effective in protecting federal facilities. While FPS has recently taken some actions, such as requiring more guard training and inspections, to address these long-standing challenges, guards employed by private contractors continue to neglect or inadequately perform their assigned responsibilities. We believe that FPS continues to struggle with managing its contract guard program in part because, although it has used guards to supplement the agency’s workforce since the 1995 bombing of the Alfred P. Murrah Federal Building, it has not undertaken a comprehensive review of its use of guards to protect federal facilities to determine whether other options and approaches would be more cost-beneficial. FPS also has not acted diligently in ensuring that its guard contractors meet the terms of the contract and taking enforcement action when noncompliance occurs. In addition, we believe that FPS’s overall approach to protecting federal facilities, coupled with many unresolved operational issues, has hampered its oversight of the contract guard program. The combined effect of these long-standing challenges suggests that FPS needs to do more to protect the over 1 million government employees and members of the public who visit federal facilities each year. Thus, we believe that among other things, FPS needs to reassess how it protects federal facilities and take a stronger role in overseeing contractor performance. We also believe that completing the required contract performance evaluations for its contractors and maintaining contract files will put FPS in a better position to determine whether it should continue to exercise contract options with some contractors. FPS’s decision to increase guard inspections at federal facilities in metropolitan areas is a step in the right direction. However, it does not address issues with guard inspections at federal facilities outside metropolitan areas, which are equally vulnerable. Thus, without routine inspections of guards at these facilities, FPS has no assurance that guards are complying with their post orders. In addition, ensuring that its guards are adequately trained to respond to building- specific situations, for example, how to handle an evacuation or shelter in place situation at a federal facility, is equally important. The lack of building-specific and scenario-based training may have contributed to several incidents in which guards neglected their assigned responsibilities. Moreover, maintaining accurate and reliable data on whether the 15,000 guards deployed at federal facilities have met the training and certification requirements is important for a number of reasons. First, without accurate and reliable data, FPS cannot consistently ensure compliance with contract requirements and lacks information critical for effective oversight of its guard program. Second, given that other federal agencies rely on many of the same contractors to provide security services, the need to complete accurate evaluations of a contractor’s past performance is critical to future contract awards. Finally, until FPS develops and implements a management tool, in addition to RAMP, that provides it with reliable contract guard data on a real-time basis, the agency will not be in an effective position to provide the oversight and decision making that are necessary to ensure that its 15,000 guards deployed at federal facilities in metropolitan and rural areas, private contractors, and 1,225 full-time employees in headquarters and 11 regions are performing as required and achieving FPS’s facility protection mission. Given the long-standing and unresolved issues related to FPS’s contract guard program and challenges in protecting federal facilities, employees, and the public who use these facilities, we recommend that the Secretary of Homeland Security direct the Under Secretary of NPPD and the Director of FPS to take the following eight actions: identify other approaches and options that would be most beneficial and financially feasible for protecting federal facilities; rigorously and consistently monitor guard contractors’ and guards’ performance and step up enforcement against contractors that are not complying with the terms of the contract; complete all contract performance evaluations in accordance with FPS issue a standardized record-keeping format to ensure that contract files have required documentation; develop a mechanism to routinely monitor guards at federal facilities provide building-specific and scenario-based training and guidance to its develop and implement a management tool for ensuring that reliable, comprehensive data on the contract guard program are available on a real- time basis; and verify the accuracy of all guard certification and training data before entering them into RAMP, and periodically test the accuracy and reliability of RAMP data to ensure that FPS management has the information needed to effectively oversee its guard program. We provided a draft of this report to DHS for review and comment. DHS concurred with seven of the eight recommendations in this report. Regarding the report’s recommendation—issue a standardized record- keeping format to ensure that contract files have required documentation—DHS concurred that contract files must have required documentation and did not concur that a new record-keeping format should be issued. DHS commented that written procedures already exist and are required for use by all DHS’s Office of Procurement Operations staff and the components it serves, including NPPD. We believe that the policies referenced by DHS are a step in the right direction in ensuring that contract files have required documentation; however, although these policies exist, we found a lack of standardization and consistency in the contract files we reviewed among the three Consolidated Contract Groups. In response to this recommendation, DHS also commented it will conduct an internal audit of the contract files to determine the extent and quality of contract administration. We agree with this next step. In addition, while DHS agreed with our other recommendations, we are concerned that some of the steps it described may not address our recommendation—to develop a mechanism to routinely monitor guards at federal facilities outside metropolitan areas. In response to this recommendation, FPS commented that to provide routine oversight of guards in remote regions it will use an employee of a tenant agency (referred to as an Agency Technical Representative) who has authority to act as a representative of a COTR for day-to-day monitoring of contract guards. However, during the course of this review, several FPS regional officials told us that the Agency Technical Representatives were not fully trained and did not have an understanding of the guards’ roles and responsibilities. These officials also said that the program may not be appropriate for all federal facilities. We believe that if FPS plans to use Agency Tenant Representatives to oversee guards, it is important that the agency ensures that the representatives are knowledgeable of the guards’ responsibilities and are trained on how and when to conduct guard inspections as well as how to evacuate facilities during an emergency. Furthermore, while we support FPS’s overall plans to better manage its contract guard program, we believe it is also important for FPS to have performance metrics to evaluate whether its planned actions are fully implemented and are effective in addressing the challenges it faces managing its contract guard program. DHS’s comments are presented in appendix I. Finally, DHS provided technical clarifications, which we incorporated into the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, the report will be available at no charge on GAO’s Web site at http//www.gao.gov. If you have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. In addition to the contact name above, Tammy Conquest, Assistant Director; Jonathan Carver; John Cooney; Collin Fallon; Brandon Haller; Daniel Hoy; Susan Michal-Smith; and Josh Ormond made key contributions to this report.

Summary: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,225 full-time employees, and about 15,000 contract security guards. FPS obligated $659 million for guard services in fiscal year 2009. This report assesses the challenges FPS faces in managing its guard contractors, overseeing guards deployed at federal facilities, and the actions, if any, FPS has taken to address these challenges. To address these objectives, GAO conducted site visits at 6 of FPS's 11 regions; interviewed FPS officials, guards, and contractors; and analyzed FPS's contract files. GAO also conducted covert testing at 10 judgmentally selected level IV facilities in four cities. A level IV facility has over 450 employees and a high volume of public contact. FPS faces a number of challenges in managing its guard contractors that hamper its ability to protect federal facilities. FPS requires contractors to provide guards who have met training and certification requirements, but 7 of 7 guard contractors we reviewed were not in compliance with this requirement. Specifically, we reported in July 2009 that 62 percent, or 411, of the 663 guards employed by 7 of FPS's 38 contractors and deployed to federal facilities had at least one expired certification, including those showing that the guard has not committed domestic violence, which make the guards ineligible to carry firearms. As of February 2010, according to FPS data, 435 of the 663 guards are now fully certified, 167 are not fully certified, and 61 guards are no longer working on the contract. FPS's guard contract also states that a contractor who does not comply with the contract is subject to enforcement action. FPS did not take any enforcement actions against these 7 contractors for noncompliance. In fact, FPS exercised the option to extend their contracts. FPS also did not comply with its requirement that a performance evaluation of each contractor be completed annually and that these evaluations and other performance-related data be included in the contract file. FPS also faces challenges in ensuring that many of the 15,000 guards have the required training and certification to be deployed at a federal facility. In July 2009, we reported that since 2004, FPS had not provided X-ray and magnetometer training to about 1,500 guards in one region. As of January 2010, these guards had not received this training and continued to work at federal facilities in this region. X-ray and magnetometer training is important because guards control access points at federal facilities. In addition, once guards are deployed to a federal facility, they are not always complying with assigned responsibilities (post orders). For example, we identified security vulnerabilities when GAO investigators successfully passed undetected through security checkpoints monitored by FPS guards with components for an improvised explosive device concealed on their persons at 10 level IV facilities in four cities in major metropolitan areas. Since July 2009, FPS has conducted 53 similar tests, and in over half of these tests some guards did not identify prohibited items, such as guns and knives. In response to GAO's July 2009 testimony, FPS has taken a number of actions that once fully implemented could help address challenges it faces in managing its contract guard program. For example, FPS has increased the number of guard inspections at federal facilities in some metropolitan areas. FPS also revised its X-ray and magnetometer training; however, guards will not all be fully trained until the end of 2010, although they are deployed at federal facilities. FPS recognized that its guard program has long-standing challenges and in 2009 contemplated a number of changes to the program, including assuming responsibility for all guard training and/or federalizing some guard positions at some federal facilities. However, FPS has not taken any actions in pursuing these ideas.