FPS has not taken actions against some guard contractors that did not comply with the terms of the contracts. According to FPS guard contracts, a contractor has not complied with the terms of the contract if the contractor has a guard working without valid certifications or background suitability investigations, falsifies a guard’s training records, does not have a guard at a post, or has an unarmed guard working at a post at which the guard should be armed. If FPS determines that a contractor does not comply with these contract requirements, it can—among other things— assess a financial deduction for nonperformed work, elect not to exercise a contract option, or terminate the contract for default or cause. We reviewed the official contract files for the 7 contractors who, as we testified in July 2009, had guards performing on contracts with expired certification and training requirements to determine what action, if any, FPS had taken against these contractors for contract noncompliance. The 7 contractors we reviewed had been awarded several multiyear contracts totaling $406 million to provide guards at federal facilities in 13 states and Washington, D.C. According to the documentation in the contract files, FPS did not take any enforcement action against the 7 contractors for not complying with the terms of the contract, a finding consistent with DHS’s Inspector General’s 2009 report. In fact, FPS exercised the option to extend the contracts of these 7 contractors. FPS contracting officials told us that the contracting officer who is responsible for enforcing the terms of the contract considers the appropriate course of action among the available contractual remedies on a case-by-case basis. For example, the decision of whether to assess financial deductions is a subjective assessment in which the contracting officer and the contracting officer technical representative (COTR) take into account the value of the nonperformance and the seriousness of the deficiency, according to FPS contracting officials. FPS requires an annual performance evaluation of each contractor and at the conclusion of contracts exceeding $100,000, and requires that these evaluations and other performance-related documentation be included in the contract file. Contractor performance evaluations are one of the most important tools available for ensuring compliance with contract terms. Moreover, given that other federal agencies rely on many of the same contractors to provide security services, completing accurate evaluations of a contractor’s past performance is critical. However, we found that FPS’s contracting officers and COTRs did not always evaluate contractors’ performance as required, and some evaluations were incomplete and not consistent with contractors’ performance. We reviewed a random sample of 99 contract performance evaluations from calendar year 2006 through June 2009. These evaluations were for 38 contractors. Eighty-two of the 99 contract performance evaluations showed that FPS assessed the quality of services provided by the majority of its guard contractors as satisfactory, very good, or exceptional. For the remaining 17 evaluations, 11 showed that the contractor’s performance was marginal, 1 as unsatisfactory, and assessments for 5 contractors were not complete. According to applicable guidance, a contractor must meet contractual requirements to obtain a satisfactory evaluation and a contractor should receive an unsatisfactory evaluation if its performance does not meet most contract requirements and recovery in a timely manner is not likely. Nevertheless, we found instances where some contractors received a satisfactory or better rating although they had not met some of the terms of the contract. For example, contractors receiving satisfactory or better ratings included the 7 contractors discussed above that had guards with expired certification and training records working at federal facilities. In addition, some performance evaluations that we reviewed did not include a justification for the rating and there was no other supporting documentation in the official contract file to explain the rating. Moreover, there was no information in the contract file that indicated that the COTR had communicated any performance problems to the contracting officer. As of February 2010, FPS had yet to provide some of its guards with all of the required X-ray or magnetometer training. For example, we reported in July 2009 that in one region, FPS has not provided the required X-ray or magnetometer training to 1,500 guards since 2004. FPS officials subsequently told us that the contract for this region requires that only guards who are assigned to work on posts that contain screening equipment are required to have 8 hours of X-ray and magnetometer training. However, in response to our July 2009 testimony, FPS now requires all guards to receive 16 hours of X-ray and magnetometer training. As of February 2010, these 1,500 guards had not received the 16 hours of training but continued to work at federal facilities in this region. FPS plans to provide X-ray and magnetometer training to all guards by December 2010. X-ray and magnetometer training is important because the majority of the guards are primarily responsible for using this equipment to monitor and control access points at federal facilities. Controlling access to a facility helps ensure that only authorized personnel, vehicles, and materials are allowed to enter, move within, and leave the facility. FPS currently does not have a fully reliable system for monitoring and verifying whether its 15,000 guards have the certifications and training to stand post at federal facilities. FPS is developing a new system—Risk Assessment and Management Program (RAMP)—to help it monitor and verify the status of guard certifications and training. However, in our July 2009 report, we raised concerns about the accuracy and reliability of the information that will be entered into RAMP. Since that time, FPS has taken steps to review and update all guard training and certification records. For example, FPS is conducting an internal audit of its CERTS database. However, as of February 2010, the results of that audit showed that FPS was able to verify that about 8,600 of its 15,000 guards met the training and certification requirements. FPS is experiencing difficulty verifying the status of the remaining 6,400 guards. FPS has also received about 1,500 complaints from inspectors regarding a number of problems with RAMP. For example, some inspectors said it was difficult and sometimes impossible to find guard information in RAMP and to download guard inspection reports. Thus they were completing the inspections manually. Other inspectors have said it takes almost 2 hours to log on to RAMP. Consequently, on March 18, 2010, FPS suspended the use of RAMP until it resolves these issues. FPS is currently working on resolving issues with RAMP. Once guards are deployed to a federal facility, guards are not always complying with assigned responsibilities (post orders). As we testified in July 2009, we identified substantial security vulnerabilities related to FPS’s guard program. FPS also continues to find instances where guards are not complying with post orders. For example, 2 days after our July 2009 hearing, a guard fired his firearm in a restroom in a level IV facility while practicing drawing his weapon. In addition, FPS’s own penetration testing—similar to the covert testing we conducted in May 2009—showed that guards continued to experience problems with complying with post orders. Since July 2009, FPS conducted 53 similar penetration tests at federal facilities in the 6 regions we visited, and in over 66 percent of these tests, guards allowed prohibited items into federal facilities. We accompanied FPS on two penetration tests in August and November 2009, and guards at these level IV facilities failed to identify a fake bomb, gun, and knife during X-ray and magnetometer screening at access control points. During the first test we observed in August 2009, FPS agents placed a bag containing a fake gun and knife on the X-ray machine belt. The guard failed to identify the gun and knife on the X-ray screen, and the undercover FPS official was able to retrieve his bag and proceed to the check-in desk without incident. During a second test, a knife was hidden on an FPS officer. During the test, the magnetometer detected the knife, as did the hand wand, but the guard failed to locate the knife and the FPS officer was able to gain access to the facility. According to the FPS officer, the guards who failed the test had not been provided the required X-ray and magnetometer training. Upon further investigation, only 2 of the 11 guards at the facility had the required X-ray and magnetometer training. In response to the results of this test, FPS debriefed the contractor and moved one of the guard posts to improve access control. In November 2009, we accompanied FPS on another test of security countermeasures at a different level IV facility. As in the previous test, an FPS agent placed a bag containing a fake bomb on the X-ray machine belt. The guard operating the X-ray machine did not identify the fake bomb and the inspector was allowed to enter the facility with it. In a second test, an FPS inspector placed a bag containing a fake gun on the X-ray belt. The guard identified the gun and the FPS inspector was detained. However, the FPS inspector was told to stand in a corner and was not handcuffed or searched as required. In addition, while all the guards were focusing on the individual with the fake gun, a second FPS inspector walked through the security checkpoint with two knives without being screened. In response to the results of this test, FPS suspended 2 guards and provided additional training to 2 guards. In response to our July 2009 testimony, FPS has taken a number of actions that, once fully implemented, could help address the challenges the agency faces in managing its contract guard program. For example, FPS Increased guard inspections at facilities in some metropolitan areas. FPS has increased the number of guard inspections to two a week at federal facilities in some metropolitan areas. Prior to this new requirement, FPS did not have a national requirement for guard inspections, and each region we visited had requirements that ranged from no inspection requirements to each inspector having to conduct five inspections per month. Increased X-ray and magnetometer training requirements for inspectors and guards. FPS has increased its X-ray and magnetometer training for inspectors and guards from 8 hours to 16 hours. In July 2009, FPS also required each guard to watch a government-provided digital video disc (DVD) on bomb component detection by August 20, 2009. According to FPS, as of January 2010, approximately 78 percent, or 11,711 of the 15,000 guards had been certified as having watched the DVD. Implementing a new system to monitor guard training and certifications. As mentioned earlier, FPS is also implementing RAMP. According to FPS, RAMP will provide it with the capability to monitor and track guard training and certifications and enhance its ability to conduct and track guard inspections. RAMP is also designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures that are in place to mitigate risk. It is also expected to enable FPS to manage guard certifications and to conduct and track guard inspections electronically as opposed to manually. However, as mentioned earlier, as of March 18, 2010, FPS suspended the use of RAMP until it can resolve existing issues. Despite FPS’s recent actions, it continues to face challenges in ensuring that its $659 million guard program is effective in protecting federal facilities. While the changes FPS has made to its X-ray and magnetometer training will help to address some of the problems we found, there are some weaknesses in the guard training. For example, many of the 15,000 guards will not be fully trained until the end of 2010. In addition, one contractor told us that one of the weaknesses associated with FPS’s guard training program is that it focuses primarily on prevention and detection but does not adequately address challenge and response. This contractor has developed specific scenario training and provides its guards on other contracts with an additional 12 hours of training on scenario-based examples, such as how to control a suicide bomber or active shooter situation, evacuation, and shelter in place. The contractor, who has multiple contracts with government agencies, does not provide this scenario-based training to its guards on FPS contracts because FPS does not require it. We also found that some guards were still not provided building-specific training, such as what actions to take during a building evacuation or a building emergency. According to guards we spoke to in one region, guards receive very little training on building emergency procedures during basic training or the refresher training. These guards also said that the only time they receive building emergency training is once they are on post. Consequently, some guards do not know how to operate basic building equipment, such as the locks or the building ventilation system, which is important in a building evacuation or building emergency. FPS’s decision to increase guard inspections at federal facilities in metropolitan areas is a step in the right direction. However, it does not address issues with guard inspections at federal facilities outside metropolitan areas, which are equally vulnerable. Thus, without routine inspections of guards at these facilities, FPS has no assurance that guards are complying with their post orders. We believe that FPS continues to struggle with managing its contract guard program in part because, although it has used guards to supplement the agency’s workforce since the 1995 bombing of the Alfred P. Murrah Federal Building, it has not undertaken a comprehensive review of its use of guards to protect federal facilities to determine whether other options and approaches would be more cost-beneficial. FPS also has not acted diligently in ensuring that its guard contractors meet the terms of the contract and taking enforcement action when noncompliance occurs. We also believe that completing the required contract performance evaluations for its contractors and maintaining contract files will put FPS in a better position to determine whether it should continue to exercise contract options with some contractors. Moreover, maintaining accurate and reliable data on whether the 15,000 guards deployed at federal facilities have met the training and certification requirements is important for a number of reasons. First, without accurate and reliable data, FPS cannot consistently ensure compliance with contract requirements and lacks information critical for effective oversight of its guard program. Second, given that other federal agencies rely on many of the same contractors to provide security services, completing accurate evaluations of a contractor’s past performance is critical to future contract awards. Thus, in our report we recommend that the Secretary of Homeland Security direct the Under Secretary of NPPD and the Director of FPS to take the following eight actions: identify other approaches and options that would be most beneficial and financially feasible for protecting federal buildings; rigorously and consistently monitor guard contractors’ and guards’ performance and step up enforcement against contractors that are not complying with the terms of the contract; complete all contract performance evaluations in accordance with FPS and Federal Acquisition Regulation requirements; issue a standardized record-keeping format to ensure that contract files have required documentation; develop a mechanism to routinely monitor guards at federal facilities provide building-specific and scenario-based training and guidance to its develop and implement a management tool for ensuring that reliable, comprehensive data on the contract guard program are available on a real- time basis; and verify the accuracy of all guard certification and training data before entering them into RAMP, and periodically test the accuracy and reliability of RAMP data to ensure that FPS management has the information needed to effectively oversee its guard program. DHS concurred with seven of our eight recommendations. Regarding our recommendation to issue a standardized record-keeping format to ensure that contract files have required documentation, DHS concurred that contract files must have required documentation but did not concur that a new record-keeping format should be issued. DHS commented that written procedures already exist and are required for use by all DHS’s Office of Procurement Operations staff and the components it serves, including NPPD. We believe that the policies referenced by DHS are a step in the right direction in ensuring that contract files have required documentation; however, although these policies exist, we found a lack of standardization and consistency in the contract files we reviewed among the three Consolidated Contract Groups. Overall, we are also concerned about some of the steps FPS plans to take to address our recommendations. For example, FPS commented that to provide routine oversight of guards in remote regions it will use an employee of a tenant agency (referred to as an Agency Technical Representative) who has authority to act as a representative of a COTR for day-to-day monitoring of contract guards. However, several FPS regional officials told us that the Agency Technical Representatives were not fully trained and did not have an understanding of the guards’ roles and responsibilities. These officials also said that the program may not be appropriate for all federal facilities. We believe that if FPS plans to use Agency Tenant Representatives to oversee guards, it is important that the agency ensure that the representatives are knowledgeable of the guard’s responsibilities and are trained on how and when to conduct guard inspections as well as how to evacuate facilities during an emergency. Furthermore, while we support FPS’s overall plans to better manage its contract guard program, we believe it is also important for FPS to have appropriate performance metrics to evaluate whether its planned actions are fully implemented and are effective in addressing the challenges it faces managing its contract guard program. Mr. Chairman, this concludes our testimony. We are pleased to answer any questions you might have. For further information on this testimony, please contact Mark L. Goldstein, (202) 512-2834 or by e-mail at goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Tammy Conquest, Assistant Director; Tida Barakat; and Jonathan Carver. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,225 full-time employees, and about 15,000 contract security guards. FPS obligated $659 million for guard services in fiscal year 2009. This testimony is based on our report issued on April 13, 2010, and discusses challenges FPS continues to face in (1) managing its guard contractors and (2) overseeing guards deployed at federal facilities, and (3) the actions FPS has taken to address these challenges. To address these objectives, GAO conducted site visits at 6 of FPS's 11 regions; interviewed FPS officials, guards, and contractors, and analyzed FPS's contract files. GAO also reviewed new contract guard program guidance issued since our July 2009 report and observed guard inspections and penetration testing done by FPS. FPS faces a number of challenges in managing its guard contractors that hamper its ability to protect federal facilities. FPS requires contractors to provide guards who have met training and certification requirements. FPS's guard contract also states that a contractor who does not comply with the contract is subject to enforcement action. GAO reviewed the official contract files for the seven contractors who, as GAO testified in July 2009, had guards performing on contracts with expired certification and training requirements to determine what action, if any, FPS had taken against these contractors for contract noncompliance. These contractors had been awarded several multiyear contracts totaling $406 million to provide guards at federal facilities in 13 states and Washington, D.C. FPS did not take any enforcement actions against these seven contractors for noncompliance. In fact, FPS exercised the option to extend their contracts. FPS also did not comply with its requirement that a performance evaluation of each contractor be completed annually and that these evaluations and other performance-related data be included in the contract file. FPS plans to provide additional training and hold staff responsible for completing these evaluations more accountable. FPS also faces challenges in ensuring that many of the 15,000 guards have the required training and certification to be deployed at a federal facility. In July 2009, GAO reported that since 2004, FPS had not provided X-ray and magnetometer training to about 1,500 guards in 1 region. As of January 2010, these guards had not received this training and continued to work at federal facilities in this region. X-ray and magnetometer training is important because guards control access points at federal facilities. FPS currently does not have a fully reliable system for monitoring and verifying whether its 15,000 guards have the certifications and training to stand post at federal facilities. FPS developed a new Risk Assessment and Program Management system to help monitor and track guard certifications and training. However, FPS is experiencing difficulties with this system and has suspended its use. In addition, once guards are deployed to a federal facility, they are not always complying with assigned responsibilities (post orders). Since July 2009, FPS has conducted 53 penetration tests in the 6 regions we visited, and in over half of these tests some guards did not identify prohibited items, such as guns and knives. In response to GAO's July 2009 testimony, FPS has taken a number of actions that, once fully implemented, could help address challenges it faces in managing its contract guard program. For example, FPS has increased the number of guard inspections at federal facilities in some metropolitan areas. FPS also revised its X-ray and magnetometer training; however, all guards will not be fully trained until the end of 2010, although they are deployed at federal facilities. Despite FPS's recent actions, it continues to face challenges in ensuring that its $659 million guard program is effective in protecting federal facilities. Thus, among other things, FPS needs to reassess how it protects federal facilities and rigorously enforce the terms of the contracts.