In 1988, Congress enacted the Military Whistleblower Protection Act to provide protection to servicemembers who report wrongdoing within DOD. According to DOD policy, a military whistleblower is a servicemember who makes, prepares to make, or is perceived as making or preparing to make a protected communication—that is, a report of a violation of law or regulation, gross waste of funds, or abuse of authority, among others, to an authorized individual or organization. An authorized individual includes, among others, a Member of Congress, an IG, and any person or organization in the servicemember’s chain of command. Further, any lawful communication to a Member of Congress or IG is Reprisal occurs when a responsible management official protected.takes, threatens to take, withholds, or threatens to withhold a personnel action because a servicemember made or was preparing to make a protected communication. A personnel action is any action taken on a servicemember that affects or has the potential to affect a servicemember’s current position or career, such as an adverse performance evaluation, letter of reprimand, or separation from service, among others. Servicemembers and former servicemembers may submit reprisal complaints to DODIG or an IG within DOD. In 2013, Congress expanded the time for servicemembers to file a reprisal complaint from 60 days to 1 year following the date on which the servicemember becomes aware of the personnel action. While the law affords military whistleblowers certain protections, those who allege they have suffered reprisal generally do not receive relief from the alleged reprisal until DOD has completed an investigation and substantiated the claims of reprisal. DODIG can conduct an investigation into a military reprisal complaint or refer the investigation to the appropriate service IG; however, according to DOD policy, no determination is complete without final approval from DODIG. Whistleblower Reprisal Investigations is the directorate within DODIG’s Administrative Investigations component that is responsible for conducting and overseeing investigations of reprisal and restriction complaints filed by servicemembers. According to DOD policy, the Whistleblower Reprisal Investigations directorate is to approve service IG recommendations to dismiss cases, review and approve the results of investigations conducted by the service IGs, and initiate follow-up investigations to correct any inadequacies in service IG investigations. The majority of DODIG’s investigation workload for military reprisal cases is related to oversight reviews of investigations conducted by the service IGs. The directorate is also responsible for investigating reprisal complaints filed by DOD civilian employees, and employees of DOD contractors and subcontractors, among others. According to DODIG’s semiannual reports to Congress, military whistleblower reprisal complaints account for approximately 60 percent of the reprisal complaints it receives. Figure 1 provides a summary of the investigation process, as described in DODIG guidance. According to DODIG’s Guide to Investigating Military Whistleblower Reprisal and Restriction Complaints, DODIG and service IG investigators are to assess reprisal complaints by answering four questions to determine whether the elements of reprisal are present. Specifically: 1. Did the servicemember make or prepare to make a protected communication, or was the servicemember perceived as having made or prepared to make a protected communication? 2. Was an unfavorable personnel action taken or threatened against the servicemember, or was a favorable personnel action withheld or threatened to be withheld, following the protected communication? 3. Did the responsible management official have knowledge of the servicemember’s protected communication or perceive the servicemember as making or preparing to make a protected communication? 4. Would the same personnel action have been taken, withheld, or threatened absent the protected communication? During the complaint intake process, the investigator is to review the complaint and timeline and conduct an interview with the servicemember to determine whether (1) the servicemember made or prepared to make a protected communication and (2) a responsible management official took a personnel action against the servicemember. The investigator is to also assess whether the allegation supports an inference that the responsible management official had knowledge of the protected communication and suggests a causal connection between the protected communication and the personnel action, such as whether the personnel action closely followed the protected communication. If the investigating officer determines there was no protected communication, no personnel action, or no inference of responsible management official knowledge or causation, the investigating officer can recommend that DODIG dismiss the case. If a servicemember’s complaint contains a personnel action and a protected communication, and an inference of knowledge and causation, the case is to proceed to a full investigation, according to DODIG guidance.official would have taken the personnel action if the servicemember had not made a protected communication, the investigating officer is to determine the official’s reasons for taking the action, the timing between the protected communication and the personnel action, the official’s motive, and whether the servicemember was treated differently than other servicemembers who did not make protected communications. The investigating officer is to determine the case outcome based on a “preponderance of the evidence,” defined by DODIG as the degree of relevant evidence that a reasonable person, considering the record as a whole, would accept as sufficient to find that a contested fact is more likely to be true than untrue. When determining whether the responsible management According to DODIG guidance, if the investigating officer finds: (1) that the servicemember made a protected communication, and that the responsible management official (2) took a personnel action against the servicemember following the protected communication, (3) had knowledge of the protected communication, and (4) would not have taken the personnel action without the protected communication, the investigator writes a report that substantiates the reprisal complaint. After the investigator completes the report, it is subject to DODIG supervisory and managerial review and approval, as well as a legal sufficiency review. If the investigation is conducted by a service IG investigator, the service IG headquarters reviews and forwards the report to DODIG for oversight and final approval. In cases where DODIG substantiates a reprisal complaint, the servicemember may take an additional step to petition the appropriate Board for the Correction of Military Records for relief from the personnel action. DOD did not meet statutory notification requirements to inform servicemembers about delays in investigations for about half of military whistleblower reprisal investigations in fiscal year 2013. Further, in the notifications that DOD sent, reasons about the delays were general in nature and projected report completion dates were, on average, significantly underestimated. In addition, DOD rarely met internal timeliness requirements for completing military whistleblower reprisal investigations within 180 days for cases that it did not dismiss at intake. The average length of an investigation during fiscal years 2013 and 2014 was almost three times the DOD requirement. According to 10 U.S.C. § 1034 if, during the course of the investigation, the IG determines that it is not possible to submit the report of investigation to the Secretary of Defense and the service Secretary within 180 days after the receipt of the allegation, the IG shall provide to the Secretary of Defense, the service Secretary concerned, and the servicemember making the allegation a notice of that determination including the reasons why the report may not be submitted within that time and an estimate of the time when the report will be submitted. DODIG considers its office to be in accordance with the statute as long as it either completes the investigation within 180 days or submits a letter to the servicemember within 180 days, according to a senior DODIG official. In February 2012, we found that DODIG officials acknowledged that they and the service IGs had not been making the required notifications, but that they were taking steps to ensure that they met statutory notification requirements. For example, in February 2012, DODIG issued policy guidance to the service IGs reemphasizing the statutory requirement to notify servicemembers if investigations are not completed within 180 days.are to determine whether the service IG sent the 180-day notification letter as part of DODIG’s oversight review of service IG-investigated Further, according to oversight investigators we spoke with, they cases and in fiscal year 2013, it was included as an item on DODIG’s oversight worksheet for oversight investigators to look for during their oversight review. DODIG officials stated that they have taken additional action to ensure they meet statutory notification requirements since fiscal year 2013, which was the time frame covered by our case-file review. Specifically, in fall 2013, DODIG assigned an oversight investigator to periodically reconcile 180-day notification letters with the service IGs to ensure that the service IGs have sent the required letters and that DODIG has received a copy, according to DODIG officials. In addition, DODIG developed a mechanism in its case management system to indicate which cases are older than 180 days. However, DOD officials told us they have not developed a tool, such as an automated alert, to proactively ensure that they are in compliance with the statutory 180-day notification requirement. On the basis of our file review of a stratified random sample of 124 cases closed by DODIG in fiscal year 2013, we found that DOD has made improvements related to these reporting requirements and that some case files that required letters contained evidence that DOD had sent the letters. However, we estimate that about 47 percent of the files for cases that DOD took longer than 180 days to close in fiscal year 2013 did not contain evidence that the investigating IG sent the required letters to servicemembers. In addition, we found that in cases in which DODIG or the service IG sent the required letter, it typically did so after the case had reached the 180-day mark. Based on our file review, we estimate that for cases in which DODIG or the service IG sent a 180-day notification letter to the servicemember to explain the delays in the investigation, the median notification time was about 353 days after the servicemember filed the complaint. In some service investigations, the investigating IG did not send the required letter to the servicemember until it forwarded the report of investigation to DODIG for review, more than 1 year after the servicemember filed the complaint. Further, the letters that DOD sent provided general reasons for the delay, but, on average, significantly underestimated the date by which it would complete the investigation. For example, reasons for the investigation delay included case complexity, case volume, and delays that the service IG experienced in coordinating information, witnesses, and testimony. Based on the results of our file review, we estimate that the median time for case completion stated by DODIG and the service IGs in the letters, which they sent, on average, around 353 days into the investigation, was However, we estimate that for cases in about an additional 78 days.which the investigating IG sent the required letter, the median time for case closure was actually 488 days, 57 days past the stated estimate for case completion. Service IG officials stated that, for most cases over 180 days, they provide a standard estimate for case completion because it is difficult to estimate the amount of time required for case completion due to the unique characteristics of each case and the number of layers of review prior to case closure. According to federal standards for internal control, an agency must have relevant, reliable, and timely communications relating to internal and external events in order to determine whether the agency is achieving its compliance with various laws and regulations. On the basis of our file review, we estimate that, on average, the notifications present in 53 percent of investigations closed in fiscal year 2013 in which they were required were untimely and contained unreliable estimates. Figure 2 shows the median notification timeframes and estimates for case completion for fiscal year 2013 cases over 180 days. GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). DOD rarely met internal timeliness requirements for completing military whistleblower reprisal investigations in fiscal years 2013 and 2014. According to DOD Directive 7050.06, which implements the statute 10 U.S.C. § 1034 and establishes DOD policy, DODIG shall issue a whistleblower reprisal investigation report—containing a thorough review of the facts and circumstances, relevant documents acquired, and summaries or transcripts of interviews conducted—within 180 days of the receipt of the allegation of reprisal. We found that the average investigation time for all cases that DOD (that is, both DODIG and the service IGs) investigated and closed in fiscal years 2013 and 2014 was 526 days. The average length of DODIG- investigated cases closed in fiscal years 2013 and 2014 was 443 days. The average length of service IG–investigated cases during this time was 530 days, which is almost three times DOD’s internal timeliness requirement. For cases DODIG dismissed after completing the complaint intake process, the average processing time was 48 days. See table 1 for details regarding case-processing times for cases closed by DODIG and the service IGs in fiscal years 2013 and 2014. In our total timeliness calculations for all DOD investigations, we did not include complaints that DODIG or the service IGs dismissed at intake because the IG determined that the complaint did not have sufficient evidence to warrant an investigation. While the statute requires the service IG receiving the reprisal allegation to promptly notify DODIG of the allegation, services do not consistently provide DODIG notification when they receive complaints that do not contain a protected communication or personnel action, according to service IG officials and guidance. Specifically, the Air Force IG’s guidance states that DODIG must be notified when a complaint contains an allegation of reprisal. However, the guidance states that a complaint does not contain a reprisal allegation unless the first two elements of reprisal—a protected communication and a personnel action—are present. DODIG officials stated that any service determination that a complaint does not meet its first two elements of reprisal must be submitted to DODIG for oversight. However, officials from the two service IGs, which accounted for approximately 80 percent of the service IG reprisal investigative workload in fiscal years 2013 and 2014 told us that they do not track or report to DODIG complaints that they dismiss at intake because they lacked a protected communication or personnel action. Since DODIG does not have data on cases that the services dismiss at intake, because the services do not notify them of these cases, we did not have data on all cases that were dismissed at intake. Therefore we reported the timeliness of cases that DODIG dismissed at intake separately, and did not include them in our overall timeliness calculations. In fiscal years 2013 and 2014, DODIG investigated and closed a total of 39 cases and dismissed another 375 complaints after completing the intake process. The service IGs closed a total of 674 cases during this period. See table 2 for the number of cases closed by each investigating organization in fiscal years 2013 and 2014. DOD received a total of 640 reprisal complaints in fiscal year 2013 and 584 reprisal complaints in fiscal year 2014. As of September 30, 2014, DODIG and the service IGs had a total of 822 open military whistleblower reprisal cases. While the majority of these open cases were filed from fiscal years 2012 through 2014, some of these cases had been open since fiscal year 2008. We found that almost 20 percent of DOD’s open military reprisal cases were filed in fiscal year 2012 and had been open for at least 2 years. Further, approximately 33 percent of the open military reprisal cases were filed in 2013 and had been open for at least 1 year. Table 3 provides additional information on DOD’s open military reprisal cases and when the servicemembers filed their reprisal complaints. Appendix II provides information about substantiation rates and the general characteristics of military whistleblower reprisal cases. DOD officials described several factors affecting the timeliness of military reprisal investigations and stated that they are taking steps to improve investigation timeliness. For example, in addition to investigations, DODIG’s workload includes completing the intake process for complaints filed with DODIG. Intake requires staff to review complaints and determine whether there is sufficient evidence for those complaints to warrant an investigation. As we stated previously, DODIG dismissed 375 complaints after completing the intake process in fiscal years 2013 and 2014. Further, service IG officials indicated that the decentralized investigation structure is a factor that affects the timeliness of their investigations. For example, service IGs assign investigations to field- level investigators, which, according to officials, results in a multilayer review process as the investigation is reviewed by each organizational level of the service with each layer of review adding to case-processing times. Additionally, all six field-level service investigators we interviewed stated that, in their opinion,180 days was not a reasonable amount of time to complete all investigations unless an investigator has no competing responsibilities and is able to focus solely on one reprisal investigation at a time. Service IG investigators further stated that in addition to competing responsibilities, the complexity of cases, the volume of cases, and low staffing numbers all affect the timeliness of investigations. We found in February 2012 that DODIG also identified staffing shortages as a factor affecting the timely processing of cases and that staffing levels had not kept up with an increased reprisal caseload. DODIG officials stated that they have increased their personnel levels to accommodate the increased caseload. Specifically, DODIG’s Whistleblower Reprisal Investigations directorate increased from 30 staff in January 2012 to 53 staff in March 2015. Further, DODIG officials stated that DOD leadership has made improving the timeliness of administrative investigations—which include both investigations of whistleblower reprisal and of other allegations made against senior officials—a priority. Specifically, in an effort to improve the timeliness of senior official investigations, including senior official whistleblower reprisal cases, DODIG convened a timeliness task force in coordination with the service IGs, which issued a report with recommendations in November 2014. Specifically, the task force recommended that DODIG expand its case management system to track and manage the timeliness of senior official investigations. DODIG officials stated that they believe the expansion of the case management system will improve timeliness for all reprisal investigations. Following the issuance of the task force’s report, in January 2015, the Deputy Secretary of Defense issued a memorandum endorsing the findings of the report, specifically stating that the service IGs should not impose any staffing reductions on the investigation offices because they must be adequately resourced when faced with multiple high-priority investigations. GAO-12-362. the final outcome. DODIG officials stated that they use this metric to track timeliness for service IG reprisal investigations. However, according to officials, this calculation is inaccurate for cases opened prior to the case management system being implemented in December 2012, which accounts for approximately 24 percent of open investigations. Specifically, based on the results of our file review, we estimate that the timeliness metric in DODIG’s case management system underestimates total case time for each case closed in fiscal year 2013 by at least 26 days on average, which limits DODIG’s ability to monitor the timeliness of all service IG investigations. DODIG officials stated that they are able to identify the cases that are affected by the inaccurate timeliness metric and that they have implemented processes to manually calculate the case age for these cases. Further, as we discuss later in this report, DOD has not implemented procedures to ensure accurate and complete recording of total case- processing time. DODIG collects timeliness information but cannot analyze the data to identify potential reforms because the case management system is under development and has limited reporting capabilities. In addition, the service IGs have separate case management systems; therefore the timeliness of all service investigative phases is not maintained in DODIG’s case management system, which does not allow DODIG to consistently track all case processing times. Finally, DODIG responds to ad hoc congressional requests related to investigation timeliness, but does not include overall timeliness information in its semiannual reports to Congress, as we recommended in February 2012. We continue to believe these recommendations are valid and should be implemented. DODIG implemented a new whistleblower reprisal investigation case management system to improve its monitoring of investigations; however, as of March 2015, the system is under development and has limited reporting capabilities. In addition, DODIG has provided its staff with limited user guidance on how to use and record information in the case management system. Further, DOD’s use of multiple case management systems hinders its visibility over total workload and investigative activity at the service IG level, such as the number and status of military whistleblower reprisal investigations in process at the service IGs. DOD’s planned expansion of its reprisal case management system to the service IGs may not result in improved visibility over its workload without further planning and guidance. In February 2012, we found that DOD’s efforts to improve case processing-times had been hindered by unreliable and incomplete data, and, as previously discussed, we recommended that DOD implement policies and procedures to ensure accurate and complete recording of In case-processing time. DOD concurred with this recommendation.December 2012, DODIG took steps to improve its military whistleblower reprisal investigation data by implementing a new case management system to monitor its administrative investigations, including senior official and whistleblower reprisal investigations. We found the data from this case management system reliable for our purposes of reporting the average lengths of investigations for this report—an improvement since February 2012, when we reported that similar data from DODIG’s previous system were not reliable for our reporting purposes. According to DODIG, the case management system is intended to streamline processing, investigations, and service IG oversight reviews by serving as an automated, real-time complaint tracking and investigative management tool that electronically stores all case-file documentation. However, as of March 2015, the case management system was under development and according to officials has limited reporting capabilities. According to a DODIG official, DOD selected an incremental process to develop the case management system in order to incorporate user feedback into each phase of development, and, in accordance with this type of development, in December 2012 DODIG staff began using the case management system prior to the completion of the system. DODIG officials stated that they had planned to finish the development of the case management system by February 2014; however, according to these officials, DODIG delayed funding for the final development phase until fiscal year 2015, delaying the completion of the case management system. As a result of the delayed funding, DODIG has not been able to incorporate all user feedback to ensure that the case management system is fully functioning at the desired level, according to DODIG officials. For example, according to DODIG officials, the case management system’s reporting capabilities are limited. The case management system contains the fields necessary to track the length of various investigative phases for DODIG investigations as we recommended in February 2012, such as the dates for the legal and internal review processes, but according to a DODIG official, it cannot track this information for service IG investigations. In addition, the case management system contains dashboards for users to manage cases by the whistleblower statutes for which DODIG is responsible. For example, users can view the dashboards to determine the number of investigations or oversight cases assigned to a particular investigator and the number of DODIG investigations over 180 days, among other things. DODIG can also determine the length of time it took to complete these phases when users drill down to individual cases and review key dates for these phases in the investigation and oversight events tabs. However, according to DODIG officials, DODIG is not able to extract and aggregate these data from its case management system for analysis and reporting purposes, which would allow it to identify possible areas for implementing case-processing reforms, as we recommended in February 2012. DODIG officials stated that even though they have not completed the final development phase of the case management system, using the system has improved their ability to provide oversight of the service IG investigations, allowing them to track the corrective actions that services have taken in substantiated reprisal cases. Officials stated they can also calculate overall case age, the number of days to complete the intake phase, the number of days to complete the investigation phase, and the number of days in oversight, in response to findings in our previous report. However, DODIG can calculate these milestones only for cases that it investigates, which is a small portion of the military reprisal investigations on which this report focuses. In addition, as we previously stated, we found the case management system’s field to calculate case age was inaccurate because it underestimates total case time for cases opened in the prior system and closed in fiscal year 2013 by at least 26 days on average. Further, according to DODIG officials, DODIG spent approximately $2.22 million on the development of the case management system as of February 2015, and plans to spend approximately $1.4 million to further develop the case management system prior to the end of fiscal year 2015. DODIG officials stated that they plan to complete the final phase of case management system development, which includes improvements to reporting capabilities, by the end of fiscal year 2015. Other needed improvements include restrictions on which cases users can access and edit, as well as additional fields to better track specific types of case outcomes, such as cases withdrawn by servicemembers, according to DODIG officials. However, DODIG officials stated that they are unsure of the extent to which they will be able to make improvements to the case management system during the next phase of development given their current funding levels. As a result, DODIG officials stated that they have initiated a process to prioritize the improvements based on necessary and desired changes. DODIG has provided limited guidance to case management system users on how to populate case information into the new whistleblower reprisal case management system. DODIG investigators have been using the case management system to manage reprisal investigations since December 2012. As previously discussed, according to officials, DODIG planned to finish the final development phase for its case management system in February 2014, but changed that benchmark to September 2015. According to an official, when the case management system was implemented, DODIG internally developed and provided its staff with a user manual. According to oversight investigators, guidance on the case management system is limited and does not include detailed operating instructions, such as the type of information to enter into the case notes fields. Further, one oversight investigator stated that the guidance DODIG provided before the system was implemented was minimal and included features of the system that were not yet operable. DODIG officials provided documentation of two types of guidance, a draft user manual created by Whistleblower Reprisal directorate staff with screen captures of the system, and desk aids for various staff positions that provide descriptions of the data fields the investigators are to complete. DODIG officials noted that they have issued several versions of the desk aids since they implemented the case management system. During our case file review, we found that DODIG investigators had incorrectly coded some cases in the case management system as fully investigated when the service IG had dismissed the case prior to a full investigation. Based on the results of our file review, we estimate that, in fiscal year 2013, about 43 percent of cases that DODIG investigators coded as fully investigated were incorrectly coded in this way. Due to these miscoded cases, we are unable to report on the number of military whistleblower reprisal complaints that DOD fully investigated in fiscal years 2013 and 2014. In its semiannual reports to Congress, DODIG reports on the number of military whistleblower reprisal investigations fully investigated by DODIG and the service IGs. DODIG officials stated that they use their case management system to compile information for these semiannual reports. Based on our estimate of the number of cases affected by the miscoding in fiscal year 2013, DODIG may have mischaracterized its investigative work in its fiscal year 2013 semiannual reports to Congress. DODIG officials stated that they were aware that DODIG staff had improperly coded some reprisal cases as fully investigated when they were dismissed prior to a full investigation, but that they were not aware of the extent of the miscoding. Further, DODIG officials stated that they are taking steps to ensure that future cases are coded properly. For example, DODIG officials said that once they realized that DODIG staff were coding cases incorrectly, they provided desk aids to users in March 2014 that describe how to code cases that were fully investigated and those that were dismissed prior to a full investigation. However, during our case-file review we found that DODIG staff were still coding cases incorrectly as of April 2014. Further, in September 2013, DODIG assigned an Investigations Analyst to monitor its whistleblower reprisal investigations data. According to DODIG officials, the Investigations Analyst uses a dashboard in the case management system which helps identify missing data or entry errors, and then manually corrects them. As previously discussed, DODIG’s case management system is to serve as a real-time complaint tracking and investigative management tool for investigators within its Administrative Investigations component. Further, DODIG’s fiscal year 2014 performance plan for oversight investigators notes that investigators should ensure the case management system reflects current, real-time information on case activity. However, based on our file review of a sample of 124 cases closed in fiscal year 2013, we found that DODIG investigators were not using the case management system for real-time case management as intended by DODIG officials. Specifically, we estimate that DODIG personnel uploaded key case documents to the case management system after DODIG had closed the case in 77 percent of cases closed in fiscal year 2013. For example, DODIG staff uploaded, among other things, reports of investigation, oversight worksheets, 180-day letters, and copies of the servicemembers’ complaints after the case had already closed, indicating that the case management system was not being used for real-time case management at that time. Further, we estimate that, for 83 percent of cases closed in fiscal year 2013, DODIG staff made changes to the case variables in the case management system in 2014, at least 3 months after case closure. For cases where DODIG made changes to the data, we estimate that about 68 percent had significant changes, such as changes to the date the servicemember filed the complaint and the organization that conducted the investigation, as well as the result code, which indicates whether the case was fully investigated. In explaining why the changes were made, DODIG officials stated that leadership from DODIG’s Whistleblower Reprisal Investigations directorate instructed oversight investigators and other DODIG staff to verify and correct the data as necessary for all cases closed in fiscal years 2013 and 2014 by comparing case management system data to case file documentation. DODIG officials stated that this was necessary to ensure the reliability of DODIG’s investigative data because the case management system was new to investigators and they had not been consistently recording information. Further, officials stated that prior to the implementation of the case management system, investigators reviewed hard-copy case files of service IG investigations and they did not immediately transition to reviewing case files electronically when the case management system was implemented in December 2012. The guidance DODIG has issued for the new case management system does not include instructions that the staff are to use the system for real-time case management and investigation review or which types of events to record, both of which could have helped guide the transition from hard-copy to electronic case file review. DODIG officials stated that they plan to further develop their draft manual for the case management system expansion to the service IGs which they anticipate will be complete by the end of fiscal year 2016, as discussed later in the report. Officials further stated they will continue to update internal desk aides, which contain only descriptions of the case management system’s fields, as needed, but do not plan to issue additional internal guidance for DODIG staff on the case management system because they believe that the current guidance is sufficient. However, DODIG’s draft user manual does not instruct users on how to access the system, troubleshoot errors they may encounter, or monitor their caseloads using the case management systems dashboards. Further, DODIG’s Administrative Investigations manual, which provides guidance to the Whistleblower Reprisal Investigations directorate staff, is outdated because it refers only to DODIG’s prior case management system, which was replaced in December 2012. According to CIGIE quality standards for investigations, accurate processing of information is essential to the mission of an investigative organization. It should begin with the orderly, systematic, accurate, and secure maintenance of a management information system. Written guidance should define the data elements to be recorded in the system. Further, management should have certain information available to perform its responsibilities, measure its accomplishments, and respond to DODIG officials stated that requests by appropriate external customers.they plan to develop a user manual when they expand the case management system to service IGs, as discussed later in the report. Without updating and finalizing the internal user guidance from 2012 as necessary until the case management system is complete, including providing instructions on how to use the system as a real-time tracking system in the meantime, DODIG will continue to face challenges in its ability to report on the military whistleblower reprisal program. For example, unless investigators update and upload case information during the course of an investigation, DODIG will be unable to report on the real- time status of investigations and therefore may not be able to respond to congressional requests for case information without significant efforts. Further, DOD uses the case management system to compile information for reporting to Congress on its military reprisal investigation workload and thus may have inaccurately represented its workload—the number of cases fully investigated—to Congress in its semiannual reports. Without updating and finalizing internal guidance on how to correctly enter case information into the case management system, DODIG cannot ensure the reliability of its data without manually reviewing and correcting each case. Each service IG conducts and monitors the status of military whistleblower reprisal investigations in a different case management system. Although DODIG has access to one of the service’s case management systems, according to officials DODIG does not have complete visibility over service investigations from complaint receipt to investigation determination. As a result, DODIG may not know that some servicemembers have filed reprisal complaints until the service IGs forward the completed reports of investigation to DODIG for review. Further, DODIG does not have knowledge of the real-time status of service-conducted investigations and is unable to anticipate when service IGs will send completed reports of investigation for review, according to officials. DODIG is required to review all service IG determinations in military reprisal investigations in addition to its responsibility for conducting investigations of some military reprisal complaints. Without a common system to share data, DODIG’s oversight of the timeliness of service investigations and visibility of its own future workload is limited. Our analysis indicates that DODIG’s case management system did not have record of at least 22 percent of service investigations both open as of September 30, 2014, and closed in fiscal years 2013 and 2014. According to DOD officials, DOD’s decentralized structure for military reprisal investigations, paired with the fact that servicemembers can submit complaints to DOD or their respective service IG, or their chain of command, contributes to the possibility of duplicate complaints or that one IG fails to notify another of an ongoing reprisal investigation. According to DOD Directive 7050.06, when the service IGs receive reprisal complaints from servicemembers, those offices are required to notify DODIG within 10 days; however, based on our file review, we estimate that there was no evidence of this required notification in 30 percent of cases closed in fiscal year 2013 where the servicemember In response, DODIG officials filed the complaint with the service IG.noted that one of their oversight investigators was assigned to reconcile DODIG’s open military reprisal investigations with the service’s open reprisal investigations in fall 2013. According to service IG officials, this reconciliation is conducted at various points throughout the year by manually comparing lists of investigations from each IG’s respective case management system. Through our analysis we identified challenges reconciling DODIG and services IG cases because the investigating organizations do not share a common case identifier. In addition, in fiscal years 2013 and 2014 each investigating organization did not consistently track the other organization’s unique case identifier. DODIG officials stated that they have since taken steps to ensure that DODIG tracks the service IGs’ case identifiers in its case management system. For example, the oversight investigator that DODIG assigned to reconcile cases updates service case identifiers in DODIG’s case management system as part of the reconciliation process. Further, service IG officials stated that there have been instances where DODIG did not notify them that it was investigating a reprisal complaint from one of their servicemembers and they did not find out about the investigation until after DODIG had conducted the investigation. Standards for internal control in the federal government state that, for an entity to run and control its operations, it must have relevant, reliable, and timely communications relating to internal and external events. DOD is taking steps to improve its visibility over service investigations. In November 2014, a DODIG task force that focused on improving the timeliness of DOD’s senior official investigations recommended that DOD expand the case management system to the service IGs as a way to improve investigation timeliness. According to DODIG officials, expanding the case management system is also an effort to improve DODIG’s visibility of administrative investigations conducted by the service IGs. In January 2015, the Deputy Secretary of Defense endorsed the recommendation to expand the case management system to the service IGs, stating that an enterprise data system is essential to achieving a more seamless and efficient processing of complaints and investigations across the department. that they plan to expand the case management system to the service IGs by the end of fiscal year 2016. Deputy Secretary of Defense Memorandum, Report on Task Force to Improve Timeliness of Senior Official Investigations. However, DODIG does not have an implementation plan for the expansion and has not yet taken steps to develop one. According to DODIG officials, they are in the process of developing a strategy to expand the case management system and are in the early stages of the planning process. DODIG officials stated they have set an aggressive time frame for the expansion because leadership has made investigation timeliness a priority and they believe a common case management system is part of the solution. Officials stated that they have completed the process to classify the case management system as a defense business system in April 2014 and that DODIG has been using the system to process all whistleblower reprisal investigations since December 2012. Further, officials stated that they developed a working group comprising representatives of each of the service IGs to facilitate planning for the expansion. The working group held its first meeting in February 2015, and plans to meet bimonthly until the expansion is complete. A DODIG official tasked with leading the expansion of the case management system stated that he intends to refer to best practices for project management to help facilitate the planning process for this expansion project. The Project Management Institute’s Guide to Project Management Body of Knowledge (PMBOK® Guide) provides guidelines for managing individual projects, including developing a project management plan. A project management plan defines the basis of all project work, including how the project is executed, monitored and controlled, and closed. According to the PMBOK® Guide, project management plans should include a scope—to describe major deliverables, assumptions, and project constraints—project requirements, schedules, costs, stakeholder roles and responsibilities, and stakeholder communication techniques, among other things. Further, project management plans are to be updated when issues are found during the course of the project, which may modify project policies or procedures, and when actions are needed to forestall negative effects on the project. Project management plans also include methods to define and document stakeholder needs. According to the Project Management Institute, detailed requirements documentation is essential for stakeholders to understand what needs to be (1) done to deliver the project and (2) produced as the result of the project. DODIG officials stated that, in coordination with the service IGs, they will review and incorporate some needs of each service IG prior to expanding the case management system, but they do not plan to fully customize the case management system for each service IG, such as developing a different interface for each service. Service IG officials expressed concerns that they have requirements, such as specific data fields and report capabilities to meet leadership needs to be incorporated into the case management system prior to expansion. For example, service IG officials stated that it is important that case management system user roles are defined in a way that reflects how their organizations operate and that case access is restricted according to the organizational level of the user. Some service IG officials stated that they are concerned that DODIG will expand the case management system without incorporating all of their needs and that they will not be able to meet their respective service leaderships’ reporting requirements as a result. These officials stated that if DODIG’s case management system does not meet their needs they may need to continue to use their current case management systems, which would be duplicative. Given DOD’s stated plans to expand the case management system to the service IGs by the end of fiscal year 2016, doing so without developing an implementation plan that addresses the needs of DODIG and the service IGs, and defines project goals, schedules, costs, stakeholder roles and responsibilities, and stakeholder communication techniques, puts DODIG at risk of creating a system that will not improve its visibility over total workload or investigation timeliness. Further, without such a plan, DODIG may not be well-positioned to monitor the expansion and measure project success. In addition, without developing a plan in coordination with the service IGs that defines the roles and responsibilities of all stakeholders, and sets expectations for communication, DODIG may not be able to balance all stakeholder needs and interests. Further, as previously discussed, DODIG has not completed the development of the case management system and it does not meet DODIG user needs. Finally, in the absence of an implementation plan that adequately addresses the requirements of the service IGs, the service IGs may not know whether or when their needs will be met and as a result they may unnecessarily continue to use their own systems, which could be duplicative. In 2011, DOD designated a team in DODIG’s Directorate for Whistleblower Reprisal Investigations to review service-conducted investigations on a full-time basis; however, DODIG has not formalized the process for the review of military whistleblower reprisal investigations. For example, it is unclear to what extent DODIG has incorporated the relevant investigative standards into its process. Several factors affect the quality of DOD’s oversight of service-conducted military whistleblower reprisal investigations, including the absence of standardized guidance and DODIG feedback to the service investigators. Finally, DOD does not have a tool for investigators to certify their independence to ensure its military whistleblower reprisal investigations are objective in fact and appearance. In September 2011, DODIG took steps to improve its oversight of service IG investigations by establishing an investigator team that is solely dedicated to the oversight review of service IG-conducted military reprisal investigations, according to officials, but it has not formalized its process by providing detailed guidance to its oversight team. DODIG is responsible for reviewing and approving service determinations regarding whistleblower reprisal complaints, including both (1) service determinations that an investigation into a reprisal complaint is not warranted, and (2) the results of completed service reprisal investigations. To improve oversight, DODIG officials said that they staffed the team with investigators who had experience at either DOD or service IGs. The oversight investigators are to document their review using an oversight worksheet, which captures information about how the service investigation was conducted as well as the investigation’s findings and conclusions. DODIG has used various versions of this oversight worksheet since it established the oversight team. Our case-file review included case files closed in fiscal year 2013, and during this period DODIG’s oversight worksheet was designed to capture information about (1) the servicemember’s allegations of reprisal, (2) the personnel action or actions taken against the servicemember, (3) service investigation thoroughness, (4) documentation, (5) timeliness, (6) objectivity, and (7) whether there were any deficiencies or inconsistencies in the service investigation report, among other things. DODIG adheres to CIGIE standards, but the extent to which it incorporates these standards is unclear, and service IGs are not members of CIGIE. CIGIE’s Quality Standards for Investigations provide a framework to help ensure high-quality investigations are conducted by member IG offices. CIGIE’s general standards apply to investigative organizations and include investigator qualifications, independence, and due professional care. CIGIE’s qualitative standards relate to how the investigation is planned, executed, and reported, as well as how the investigative information is managed. As a CIGIE member, DODIG is expected to incorporate CIGIE’s quality standards into its operations manuals or handbooks. Table 4 highlights some of the CIGIE standards that DODIG has incorporated into its oversight worksheet that investigators use to review service IG investigations. We found that DODIG’s attestation to CIGIE standards, which is part of its oversight review, was inconsistent. For example, DODIG has changed the language on versions of its oversight worksheet between 2012 and 2014, and DODIG oversight investigators did not always attest to whether the investigations in our fiscal year 2013 sample were conducted in accordance with CIGIE standards. As a member of CIGIE, DODIG must develop and document its quality-control policies and procedures in accordance with its agency requirements, then communicate those policies and procedures to its personnel, according to CIGIE standards. The oversight worksheet that DODIG was using as of March 2015 did not contain a block for CIGIE attestation, to indicate whether the investigation was conducted in accordance with CIGIE standards, but the worksheet asks whether the investigator gathered all relevant evidence and whether the investigator demonstrated IG impartiality during interviews. In contrast, the oversight worksheet that DODIG oversight investigators used during the fiscal year 2013 time frame of our sample contained template language for the oversight investigator to indicate whether the service conducted the investigation in accordance with CIGIE standards, but the worksheets in our sample did not consistently attest to whether the approved investigation adhered to CIGIE standards, and the basis for the determination was unclear. Specifically, of the 89 service IG investigations in our sample, DODIG oversight investigators attested that 55 percent of them were conducted in accordance with CIGIE standards as reflected on the oversight worksheet. Further, the service IGs are not members of CIGIE, and the service IG investigators are not subject or consistently trained to CIGIE standards. In 2012 DODIG hired a training officer and in 2013 developed a basic whistleblower reprisal investigations course for DODIG and service IG investigators. DODIG officials stated that they incorporated some CIGIE standards into this and other trainings as well as in their semiannual symposiums, but service IG officials stated that these DODIG-offered trainings do not reach all field-level investigators. A senior DODIG official stated that even though the service IGs are not subject to CIGIE standards, DODIG would not approve a service IG investigation that did not appear to adhere to CIGIE standards. Also, while DODIG’s Administrative Investigations manual directs DODIG investigators to follow CIGIE standards, none of the DODIG-conducted military reprisal investigations in our sample included an attestation similar to the statement on the oversight worksheet for service IG cases stating they adhered to CIGIE standards. DODIG officials stated that the attestation is not necessary for its own reprisal investigations because, as a CIGIE member, all of its investigations adhere to CIGIE standards. DODIG provided the oversight team with limited instructions on how to review service IG cases. We interviewed each member of DODIG’s oversight team to discuss their procedures for investigation review and found that they have different approaches for how they review investigations prior to completing the oversight worksheet. For example, some read the allegation of reprisal first, while others begin their oversight review by reading the service investigator’s report of investigation. According to the oversight investigators we spoke to, once they review the investigation documentation and complete the oversight worksheet, they are to forward the package to their supervisors for discussion and review. For some cases, before final approval, oversight investigators discuss the oversight review during regular meetings with other oversight investigators, and with Whistleblower Reprisal Investigation management, according to officials. Finally, officials stated that management reviews some case files before DODIG issues the approval memo back to the service IG. DODIG officials stated that they have informal weekly meetings with the oversight team to discuss cases and oversight processes; however, some of the oversight investigators we spoke with noted that they had not received any detailed guidance that was specifically focused on how to conduct oversight of service IG military reprisal cases. For the 89 oversight files in our sample, DODIG rarely disagreed with the service IG’s final determination of whether to substantiate the reprisal allegation(s), even if the oversight investigator noted deficiencies in the investigation documentation. We estimate that DODIG sent the case back to the service IG for additional work in about 8 percent of service cases closed in fiscal year 2013. DODIG disagreed with the service determination of whether to substantiate the complaint, and took over the investigation, in 2 of the cases in our sample. DODIG officials stated that oversight investigators are in regular contact with the service IG headquarters to correct inadequacies in service investigations, but that these communications may not be documented in the case files. During our case file review, we identified examples of DODIG oversight investigators not consistently completing the oversight worksheet. Specifically, from the results of our case file review, we estimate that for about 45 percent of service investigations closed in fiscal year 2013, DODIG oversight worksheets were missing narrative that indicated the investigator had thoroughly documented all case deficiencies or inconsistencies, as required on the oversight worksheet. In those 45 percent of cases, we noted issues that include the following: Case deficiencies were not consistently documented: Some service investigation case files did not contain all DODIG required elements, such as required letters, interview transcripts or summaries, legal reviews, and other supporting documentation, but the oversight investigators did not note the missing documentation on the oversight worksheet. Specifically, we estimate that in 19 percent of service investigated cases, the oversight investigator indicated that there were adequate transcripts or summaries of testimony; however, documentation of those interview transcripts was not included in the case file. DODIG did not always note deficiencies that service IG headquarters identified: We found instances in which DODIG investigators did not document deficiencies that the service IGs had identified. For example, a service IG-completed oversight worksheet, included in the investigation case file the service IG forwarded to DODIG for review, noted that the investigators did not appear fair and impartial in the servicemember interview transcript. In this interview transcript the investigator stated that in the military nothing is unbiased because there is a chain of command; however, DOD oversight investigators attested that the investigative file did not contain evidence of bias on the oversight worksheet. DODIG officials stated that there is no written requirement for oversight investigators to note deficiencies identified by the service IGs; however on oversight worksheets for other cases, the oversight investigators did note service IG-identified deficiencies. Service IG officials also highlighted inconsistencies between the oversight investigators. For example, service IG officials stated that they prefer to work with certain DODIG oversight investigators because they know what to expect from those oversight investigators, and this speeds up the oversight review. In contrast, these officials stated that they receive more questions about cases from oversight investigators with whom they work less frequently. DODIG did not always explain why deficiencies did not affect the outcome of the service investigation: In the instances when the DODIG oversight investigator identified deficiencies with the service IG investigation, the oversight investigator typically included a statement indicating that the noted deficiencies did not have a material effect on the outcome of the investigation. However, the oversight investigators did not always explain why the deficiencies did not affect the outcome of the investigation. For example, on some oversight worksheets that we reviewed, the oversight investigators noted that the service IG investigator did not analyze a protected communication or a personnel action as part of the investigation, but that these items did not affect the outcome of the investigation. We also found that the files in these cases lacked documentation of the oversight investigators’ analysis of the effect of noted deficiencies on the outcome of the investigation. Oversight investigators stated that when they note any deficiencies in investigations, they typically discuss those deficiencies with their supervisors in order to determine whether to approve the case. DODIG officials stated that there are several gray areas in reprisal investigations and that these types of discussions are common practice when DODIG is deciding whether to approve a case; however, we found in our case-file review that the results of these conversations are not always documented on the oversight worksheet. CIGIE standards state that reasonable steps should be taken to ensure that pertinent issues are sufficiently resolved and that the results of investigative activities should be accurately and completely documented in the case file. Further, Standards for Internal Control in the Federal Government provide that internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. Ensuring that oversight investigators document the basis for their determinations regarding independent decision making enables reviewers to ensure that such determinations are appropriate. Moreover, DODIG does not have detailed guidance that specifies the steps and documentation requirements of the DODIG oversight investigators’ review of service reprisal investigations, and whether or how any noted investigation deficiencies would affect the outcome of the investigation. DODIG has focused on its October 2014 issuance of the updated Guide to Investigating Military Whistleblower Reprisal and Restriction Complaints, which details best practices for reprisal investigations, but does not specify the steps DODIG investigators are to follow when conducting oversight of service IG investigations. In addition, DODIG’s Administrative Investigations manual includes a 5-page overview of oversight reviews. However, the manual is not specific to oversight reviews of military whistleblower reprisal investigations and encompasses investigations of senior officials, and does not state what deficiencies are substantive and would affect the outcome of the investigation. Further, part one of DODIG’s Administrative Investigations manual refers investigators to a forthcoming third portion of the manual for detailed guidance on conducting oversight of military whistleblower reprisal investigations, which has not been developed. However, as of January 2015, DODIG officials stated that they were no longer planning to issue the third part of the manual and that they plan to incorporate some additional oversight procedures into the existing manual. Officials did not provide details on what procedures they plan to incorporate or when they plan to make the changes. Without additional guidance for its oversight investigator team, which would help formalize the oversight process, DODIG will continue to face inconsistency in both its oversight documentation and its review of service IG investigation outcomes. CIGIE standards state that to facilitate due professional care, organizations should establish written investigative policies and procedures. The complexity of reprisal investigations paired with the decentralized service IG structure underscores the importance of clear and consistent oversight review procedures and documentation requirements to ensure consistency across the department and that each reprisal complaint receives due professional care. Senior DODIG officials stated that DODIG’s Administrative Investigations component is taking steps to implement quality-assurance processes and that these processes will help prepare the component for an eventual peer review. For example, a senior DODIG official said that on a quarterly basis, DODIG completes an internal control checklist for 20 DODIG whistleblower reprisal investigations and 20 oversight reviews of service IG military whistleblower reprisal investigations to assess the thoroughness of the case files and the completeness of the information in the case management system, among other things. This official also stated that they brief DODIG leadership on the results of these quarterly quality-assurance checks. The Whistleblower Reprisal Investigations directorate has undergone external reviews, but CIGIE has not established peer-review criteria for administrative investigations, such as whistleblower reprisal investigations, according to DODIG officials. Senior DODIG officials stated that, if established, they would like to participate in an eventual administrative peer review of their whistleblower reprisal investigations. However, without documentation of the steps it took to reach its case determinations and why any noted case deficiencies did not affect the outcome of the investigation, as well as consistent attestation of adherence to CIGIE standards, a third-party reviewer may find it difficult to assess the quality of DODIG’s oversight process for military whistleblower reprisal investigations. DODIG and the service IGs use different terms in their guidance to refer to their investigation stages. DODIG took a step to improve guidance by issuing an updated reprisal investigation guide for military reprisal investigations for both DODIG and service IG investigators in October 2014. The guide discusses DODIG’s four questions that investigators use to determine whether the four elements of reprisal are present; various investigative steps; and, provides sample interview questions, among other things. However, DODIG describes the guide as best practices for conducting military reprisal intakes and investigations and, according to DODIG officials does not explicitly direct the services to follow DODIG’s preferred investigation process and stages. DODIG officials stated that they have no role in the development of service IG regulations. DODIG guidance describes two investigation stages: (1) intake and (2) full investigation. During the intake process, the investigator is to determine whether the servicemember made a protected communication and a responsible management official took a personnel action against the servicemember. In addition, if the investigator determines that the allegation supports an inference that the responsible management official had knowledge of the protected communication as well as a causal connection between the protected communication and the personnel action, and the servicemember reported the alleged reprisal within 1 year, the case is to proceed to a full investigation. According to DODIG’s investigation guide, during the intake process an investigator is to review the complaint, personnel action, and timeline; and interview the servicemember to clarify the allegation. During a full investigation, investigators are to formally interview the servicemember (and provide a written record of the interview), obtain relevant documentation (of the protected communication and personnel action, among other things), interview knowledgeable witnesses, interview the responsible management official who took the personnel action, and obtain a legal review of the report of investigation. Each of the service IGs has a stage between intake and full investigation, commonly referred to as a preliminary inquiry or a reprisal complaint analysis. DODIG does not have a similar in-between investigation stage, and therefore DODIG officials stated that oversight investigators should classify preliminary inquiries conducted by the service IGs as intakes in the case management system, but there is no written guidance for reviewing preliminary inquiries. We found that the service investigators typically complete much more investigative work, such as interviewing witnesses, when conducting a preliminary inquiry than DODIG requires during the intake process. Based on our case file review, we found that DODIG oversight investigators were not consistently classifying the preliminary inquiries as intakes, and classified many preliminary inquiries as full investigations in the case management system. DODIG oversight investigators approved cases as full investigations when those cases did not contain all elements required for full investigations and approved the dismissal of cases that were preliminary inquiries coded as full investigations, on a basis that can only be determined by conducting a full investigation. Specifically, we estimate that in 38 percent of preliminary inquiries closed in fiscal year 2013, service IGs dismissed cases because they determined that the responsible management official would have taken the personnel action absent the protected communication. In contrast, DODIG guidance states that an investigator answers the question of whether the responsible management official would have taken the personnel action absent the protected communication during a full investigation, which requires an interview with the responsible official to determine his or her reasons and motive for taking the personnel action. In addition, a senior DODIG official stated that an investigator must interview the responsible management official to determine whether the personnel action would have occurred absent the protected communication. However, there was no evidence in these case files that the investigator interviewed the responsible management official, and instead, investigators determined that the responsible management officials took personnel actions as a result of the servicemembers’ performance histories. Further, we found through our file review that the service IGs’ preliminary inquiry case files were less complete than the service IGs’ full investigation case files, although DODIG oversight investigators approved preliminary inquiries as full investigations. For example, based on our sample results, we estimate that at least 79 percent of service preliminary inquiries closed in fiscal year 2013 were missing at least one key element, such as interviews with the servicemember. We estimate that at least 23 percent of service full investigations closed in fiscal year 2013 were missing at least one element. Further, as previously discussed, DODIG’s guidance requires investigators to interview the servicemember for all complaints, during the intake process and if the case proceeds to a full investigations; however, we estimate that 59 percent of service preliminary inquiry case files compared to 10 percent of service full investigation case files were missing evidence of a servicemember interview. CIGIE quality standards for investigations state that to facilitate due professional care, organizations should establish written investigative policies and procedures that are revised regularly according to evolving laws, regulations, and executive orders. DODIG’s investigation guide does not discuss preliminary inquiries or define any requirements for this stage of investigation. DODIG officials have stated that they would like the service IGs to stop preparing preliminary inquiries and to use DODIG’s preferred investigation stages—intake and full investigation; however, DODIG guidance does not explicitly direct the services to use its preferred terms and stages. Additionally, a DODIG oversight investigator stated that the service IGs’ varying interpretations of DOD policy and inconsistent application of DODIG guidance makes it difficult for oversight investigators to systematically review reprisal cases. The oversight investigator also stated that DODIG should explicitly direct the services to follow certain procedures currently included in DODIG guidance, but DODIG officials stated the office does not have a role in the development of service IG regulations. Further, in the absence of standardized investigation stages, DODIG investigators miscoded investigations in fiscal year 2013. We estimate that about 43 percent of the cases that DODIG closed in fiscal year 2013 that staff coded as full investigations were not fully investigated, and were instead preliminary inquiries as indicated in the service report of investigation. DODIG officials stated that this miscoding was likely the result of oversight investigators wanting to recognize the amount of work that service IG investigators completed, since those investigators typically complete the steps of a full investigation, except for an interview with the responsible management official and a legal review. Without directing the service IGs to follow standardized investigation stages and issuing guidance clarifying how the stages are defined, it will be difficult for DODIG to ensure consistent program implementation. For example, the service IGs may do more investigative work than DODIG requires by conducting a preliminary inquiry, when DODIG would dismiss the case at intake. On the other hand, the service IGs may dismiss cases after conducting a preliminary inquiry when a DODIG investigator would conduct a full investigation and collect additional testimonial evidence. The amount of investigative work is inconsistent across DOD and is dependent on which IG investigates the complaint, which could lead to the perception that not all servicemember complaints are treated equally. In addition, without standardized investigation stages and corresponding guidance, investigators may be unclear about what elements are required for each stage of investigation, resulting in incomplete reprisal case files. Finally, without standardized investigative stages and agreement among DODIG oversight investigators about how to classify preliminary inquiries, DODIG may continue to miscode service preliminary inquiries in its case management system. Since this system is the basis for DODIG’s semiannual reports to Congress, DODIG may mischaracterize the number of fully investigated complaints in these reports. DODIG has developed tools to assess service IG investigation quality and to note any case deficiencies, but DODIG does not consistently provide the service IGs with this feedback. As previously discussed, DODIG oversight investigators are to document their reviews of service IG investigations by completing an oversight worksheet. The worksheet contains the criteria against which the reports of investigation are to be evaluated to ensure that the investigations adhered to CIGIE professional standards, such as independence and thoroughness. The worksheet also includes spaces where the oversight investigator can include comments regarding any criteria the investigation did or did not meet. According to DODIG’s Administrative Investigations manual, which guides how DODIG investigators conduct and perform oversight of reprisal investigations, upon completion of the oversight review process, investigators are to provide the service IGs with copies of the oversight worksheet. The manual further states that this affords a good mechanism for feedback to the services on the quality of individual cases, in addition to valuable information on trends in systemic deficiencies in investigations within their service. However, according to DODIG officials, in 2012 DODIG stopped providing the service IGs with completed oversight worksheets. Instead, these officials stated that they provide summarized feedback in the closure memorandums that they send to the service IGs once they approve a case. According to DODIG officials, the oversight investigators complete the oversight worksheet when reviewing service IG cases, but the worksheet is now used as an internal tool for review. Service IG officials stated that the primary feedback they receive is DODIG’s summarized case analysis on the closure memorandum, which discusses why it agreed with the service IG’s determination; however, the closure memorandum, unlike the worksheet, does not include the criteria against which the investigations are assessed. Further, service IG officials stated that they upload DODIG’s closure memorandums to their respective case management system, but they do not require the investigating officers to go into the case management system to review the closure memorandum. A DODIG oversight investigator noted that the feedback oversight investigators provide on the worksheet is more constructive than what they include on the closure memorandum, and a service IG official stated that what investigators need is constructive feedback, not just statements about what they did not do correctly. A senior service IG official stated that receiving copies of the oversight worksheets was beneficial to service investigators because the worksheets helped investigators understand what DODIG was looking for in its reviews of service investigations. Additionally, according to service IG officials, DODIG rarely sends cases back to them for additional work and rarely asks questions regarding cases they have sent to DODIG for review. Service IG officials indicated that this lack of case-specific feedback from DODIG is confirmation to them that they are meeting DODIG’s expectations for investigations; however, DODIG oversight investigators noted that the quality of service IG investigations could be improved. Further, through our review of cases closed in fiscal year 2013, after DODIG stopped providing copies of the oversight worksheets, we found examples where oversight investigators were providing case- specific feedback intended for the service IG investigators. For example, on some oversight worksheets the oversight investigator noted that the feedback provided on the worksheet was intended to be a teach-and-train vehicle to improve the quality and thoroughness of future reports; however, per DODIG’s new practice, it is unclear whether DODIG provided these oversight worksheets to the service IG investigators. DOD officials have noted that feedback to service IG investigators is important for various reasons. First, the DOD investigative process is decentralized and lacks continuity. Many offices at various levels of the service IGs investigate reprisal complaints. Further, in the Army and Air Force—which accounted for approximately 80 percent of the service investigative workload in fiscal years 2013 and 2014—military investigators typically rotate every 3 years, according to service IG officials. As such, these service IG military investigators may conduct few reprisal investigations and may not have the opportunity to develop experience, which according to DOD officials is essential to conducting high-quality reprisal investigations. The service IGs have taken steps to provide feedback to field-level investigators. For example, one service IG holds quarterly video-teleconferences with field-level investigators to share updates to reprisal policies and address any investigation trends. Second, according to service IG investigators, they receive some required training that is specific to conducting reprisal investigations when they are assigned to the IG, but there is no additional mandatory reprisal-specific training that investigators complete during the course of their careers. Additionally, these investigators may not have opportunities to apply lessons learned from that training immediately, and according to DOD officials there is often a gap of over a year between training and reprisal investigation assignment. According to CIGIE quality standards for investigations, organizations should establish appropriate avenues for investigators to acquire and maintain the necessary knowledge, skills, and abilities. Service IG investigators noted that in addition to offered training, case-specific feedback is a good way to learn skills for conducting reprisal investigations; however, three of six field-level investigators we interviewed stated that they had never received feedback from DODIG on their reprisal investigations. If the service IG investigators do not receive copies of the oversight worksheet, they may not have knowledge of the criteria that DODIG uses to conduct its oversight reviews and whether their investigative reports are meeting the specific CIGIE standards that DODIG has incorporated into its oversight review. For example, three of six field-level investigators we interviewed had not seen a DODIG oversight worksheet, and two of those three investigators did not know that DODIG used a worksheet to conduct oversight. DODIG’s October 2014 guide for investigating reprisal complaints includes a quality-assurance review checklist, modeled after the DODIG oversight review worksheet, that investigators can use to perform a quality-assurance review of their investigation. However, as previously discussed, service IG investigators are not subject to or consistently trained to CIGIE standards and therefore may not know how to assess their investigations according to these standards. Without receiving case-specific feedback, which relates to the CIGIE standards against which DODIG assessed the investigation and notes any deficiencies, service investigators may not be able to assess their own subsequent investigations. Further, without coordination with the service IGs to ensure that service investigators are receiving case-specific feedback from DODIG, DODIG efforts to improve investigation quality may continue to face challenges. Finally, without case-specific feedback, service IGs may not be able to identify trends in systematic deficiencies or specific CIGIE standards not being met, which otherwise might be corrected in future investigations and incorporated into their feedback to field-level investigators. DODIG and the service IGs have processes for investigators to recuse themselves from investigations, but there is no process for investigators to document whether the investigation they conducted was independent and outside of the chain of command. CIGIE standards state that in all matters relating to investigative work, the investigative organization must be free, both in fact and appearance, from impairments to independence. Impairments to independence include professional or personal relationships that might weaken the investigative work in any way, and preconceived opinions of individuals or groups that could bias the investigation, among others. In the absence of a process for investigators to certify their independence, DODIG has incorporated various questions into its oversight review in order to document the independence of the investigator and to determine whether the investigation was conducted in accordance with CIGIE standards. For example, DODIG oversight investigators indicate whether the investigator was outside the chain of command of the servicemember and responsible management official, which is statutorily required. DODIG’s oversight investigators—of which all but one has prior military experience—stated that they use their experience and knowledge of the service’s organizational structures to determine whether the investigator was outside the chain of command. Oversight investigators further determine on the current version of the oversight worksheet whether the investigator maintained professionalism and demonstrated IG impartiality during interviews. Oversight investigators stated that they can determine whether the investigator was impartial during interviews only if the case has interview transcripts, which the Administrative Investigations Manual instructs them to read if necessary; however, DODIG will accept summarized interviews and does not require that the service IGs provide verbatim transcripts for all interviews. Based on our sample, we estimate that 43 percent of cases closed in fiscal year 2013 have transcripts of interviews with the servicemember alleging reprisal and 26 percent of cases have transcripts of responsible management official interviews. In the absence of interview transcripts, oversight investigators have limited tools to determine whether the investigator demonstrated IG impartiality during interviews. DOD officials stated that their recusal policies and decentralized investigation structure, removing the investigator from the chain of command, adequately address independence and that no further documentation of independence is needed. However, during our case-file review we reviewed oversight worksheets where DODIG oversight investigators had noted potential impairments to investigator objectivity in the report of investigation. For example, on one oversight worksheet, the oversight investigator stated that the report gave the appearance of service investigator bias, and further clarified that the report should state whether the responsible management official’s actions were reasonable and supported by facts, not whether the investigator would have taken the same actions. In addition, on another oversight worksheet the DODIG investigator stated that the investigator’s narrative in the report of investigation contained comments that would bring into question whether the analysis was impartial and unbiased, further noting that there was evidence of bias. Further, one oversight worksheet stated that the investigator was not outside the chain of command, as statutorily required, but that it had no effect on the investigation. DODIG approved these cases without documenting how it reconciled these case deficiencies. We are not questioning DODIG’s judgment in these cases. We noted that the files in these cases did not address the issues identified by the oversight investigator beyond the final approval of the case. However, Standards for Internal Control in the Federal Government provides that internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. Without documenting the basis for their determinations regarding independent decision making, DODIG cannot ensure that such determinations are appropriate. One oversight investigator we interviewed stated that DODIG has received investigations from the service IGs where the investigations show clear signs of bias, even though the investigator was outside the chain of command. According to this investigator, in these instances, DODIG’s options include returning the case for additional investigation, appointing a new investigator, or preparing additional case analysis addressing the bias. Further, some service IG reviews of investigations also noted potential impairments to objectivity. For example, a service IG forwarded a completed investigation to DODIG for approval, noting that the investigators did not appear fair and impartial in a servicemember interview transcript; however, the oversight investigator stated that there was no evidence of bias by the investigating officer. Service IG officials stated that their review of field-level investigations is important because they have received investigations that contain personal opinion and statements that make it appear that the investigator was not impartial. These officials stated that, through their review, they attempt to identify and correct these statements, and that DODIG’s subsequent review of the case should also catch any instances where an investigator did not appear impartial. Service IG officials noted that, because investigators are so close to the investigation, they can become invested in the investigation and that this investment is sometimes evident in reports of investigation. Guidance for documenting independence is included in generally accepted government auditing standards (GAGAS). While these standards apply to audits, they can also provide guidance to service IGs as a best practice on how to document decisions regarding independence when conducting reprisal investigations. Documentation of independence considerations provides evidence of the judgments in forming conclusions regarding compliance with independence requirements. Further, GAGAS notes that an organization should establish policies and procedures in its system of quality control that address independence. While GAGAS states that insufficient documentation of compliance with the independence standard does not impair independence, documentation of independence in a reprisal investigation could improve the quality of DODIG’s investigations. Without a process for investigators to document that the investigation was independent and outside the chain of command, DODIG and the service IGs will be hindered in their efforts to monitor the independence of investigations. DODIG oversight investigators are responsible for assessing the independence of the investigator and the investigation. Absent direction from DODIG to the service IGs to provide certifications that the investigator was independent and outside of the chain of command, DODIG oversight investigators have few mechanisms to determine whether the investigation was independent during the oversight process. With the pending expansion of DODIG’s case management system to the service IGs, the certification process could be incorporated, for example, into the case management system. Further, such a certification process would serve as an accountability mechanism for service IG investigators, should an oversight investigator or service IG official note any potential impairments to objectivity during their reviews of investigations. Finally, certification of investigator independence could decrease the potential for bias in military reprisal investigations and better ensure that servicemembers receive the whistleblower protections provided by law. Whistleblowers play an important role in safeguarding the federal government against waste, fraud, and abuse, and their willingness to come forward can contribute to improvements in government operations. As a result, it is important that DOD have a process for investigating whistleblower reprisal complaints that affected parties have confidence is timely, effective, and impartial. One way in which such confidence can be undermined is if investigations and related communications with the servicemembers are not timely and accurate. Reducing delays in investigations and notifications when the process will take longer than 180 days would provide servicemembers with information that may affect their immediate work environment or personnel actions, which are typically halted during an active investigation, since servicemembers generally do not receive relief from reprisal until DODIG has approved a substantiated investigation. Ultimately, the absence of regular status updates, such as revised case-completion estimates when time frames shift, may discourage servicemembers from coming forward to report wrongdoing. Another area in which DODIG processes are lacking is in data collection and monitoring for oversight of investigations at the service IG level. DODIG has made progress in this regard since our February 2012 report by implementing a new case management system, but it remains under development and, as of March 2015, does not yet meet DODIG’s full reporting needs. Without additional internal guidance to staff on how to use the case management system for real-time case processing, DODIG cannot assure efficient reporting and that the data it collects are up to date and accurate. Absent these actions, along with developing an implementation plan for expansion of the case management system to the service IGs, DODIG will not have complete visibility of service IG workload and timeliness. DODIG also cannot ensure that all military whistleblower reprisal investigations adhere to quality standards. For instance, the complexity of reprisal investigations underscores the need for clear and consistent oversight review procedures and documentation requirements. DODIG took a positive step by establishing a team of investigators that is solely dedicated to the review of service IG investigations. However, without additional guidance regarding how to review service IG investigations, which would help to formalize the oversight process, DODIG cannot ensure that it treats reprisal complaints consistently and with due professional care. In addition, consistency across DODIG and service IG investigations, especially in regard to investigation stages, will be limited without guidance that clarifies the amount of investigative work an investigator is to conduct at each stage and leads to the perception that not all servicemember complaints are treated equally. Additionally, without providing case-specific feedback that includes the criteria DODIG oversight investigators use to assess service investigations, service investigators may be limited in their ability to improve the quality of subsequent investigations. Finally, DOD may not be able to enhance the perception of fairness and increase accountability without taking steps to develop and implement a process for investigators to certify their independence when conducting investigations. Absent these actions, DODIG will be limited in its ability to enhance the effectiveness of its oversight, prepare for the eventual peer review in which senior leadership would like to participate, and ensure that servicemembers receive the whistleblower protections provided by law. To improve the military whistleblower reprisal investigation process and oversight of such investigations, we recommend that the Secretary of Defense work in coordination with the Department of Defense Inspector General (DODIG) to take the following seven actions: develop an automated tool to help ensure compliance with the statutory 180-day notification requirement by providing servicemembers with accurate information regarding the status of their reprisal investigations within 180 days of receipt of an allegation of reprisal; issue additional guidance to investigators on how to use the case management system as a real-time management tool, and update and finalize the draft internal user guidance from 2012 as necessary until the case management system is complete; working in coordination with the service IGs, develop an implementation plan that addresses the needs of DODIG and the service IGs, and defines project goals, schedules, costs, stakeholder roles and responsibilities, and stakeholder communication techniques for expansion of the case management system; issue additional guidance to formalize the DODIG oversight process; direct the services to follow standardized investigation stages and issue guidance clarifying how the stages are defined; ensure that the mechanism it uses for feedback to service investigators includes the criteria against which the investigation was assessed and any deficiencies, and work with the service IG headquarters to ensure that feedback is shared with the service investigators; and develop and implement a process for investigators to document whether the investigation was independent and outside of the chain of command and direct the service IGs to provide such documentation for review during the oversight process. In commenting on a draft of this report, DODIG concurred with each of our seven recommendations. However, DODIG did not agree with the manner in which we presented the findings in the report and raised concerns that we did not include information relating to significant progress made by DODIG since our February 2012 report. DODIG’s comments are reprinted in appendix III. DODIG also provided technical comments, which we considered and incorporated where appropriate. We disagree with DODIG’s characterization of our report’s findings because we included discussion of the improvements cited by DODIG throughout our report. For example, we noted increases in staff levels, DODIG’s development of a new case management system, DODIG’s October 2014 issuance of a military whistleblower reprisal investigations guide, and policy guidance to the service IGs regarding 180-day notification requirements, among others. Further, in its comments, DODIG stated that it takes its role in leading DOD’s whistleblower protection program seriously and has invested significant resources, more so than other federal agencies, to improve the timeliness and quality of its investigations. In addition, DODIG highlighted the volume of complaints that it processes. We agree that DOD’s program is large, and believe that our current recommendations are critical to aid DODIG in attaining its goal of being the model whistleblower protection program in the federal government. Our responses to additional comments made by DODIG on our report’s findings are included at the end of appendix III. In concurring with our first recommendation that DODIG develop an automated tool to help ensure DOD compliance with the statutory 180- day notification requirement, DODIG stated it had already implemented a dashboard in its case management system that identifies investigations pending for 180 days and that it would work toward an even more automated notification process in the future. We believe that an automated tool to help ensure DOD compliance with statutory requirements is needed and that the dashboard alone does not serve this intended purpose. Based on our case file review, we found that in the estimated 53 percent of cases in which DOD sent the required 180-day notification letters for cases closed in fiscal year 2013, the notifications that DOD provided were sent after 180 days. Specifically, we estimated that DOD’s median notification time was on average 353 days after the servicemember filed the complaint, almost twice as long as the 180-day requirement. The dashboard that DODIG uses to track cases does not proactively alert DOD to send the 180-day letter. Importantly, as we stated in our report, DODIG’s case management system did not have record of at least 22 percent of service investigations both open as of September 30, 2014, and closed in fiscal years 2013 and 2014. Without knowledge of these cases, DODIG cannot ensure that the service IGs sent 180-day notification letters for cases taking over 180 days to complete. We believe that an automated tool that proactively alerts DOD to send the required 180-day notification letter for all cases taking longer than 180 day days could help to ensure DOD’s full compliance with statutory notification requirements. In concurring with our second recommendation that DODIG issue additional guidance to investigators on how to use the case management system as a real-time management tool, DODIG stated that we misrepresented DODIG’s focused effort to migrate paper-based 2013 data into a new electronic system and correct data deficiencies in order to ensure data reliability. We disagree. In our report, we note that DODIG officials told us that the case management system is to serve as a real- time complaint tracking and investigative management tool for investigators. Further, in its comments, DODIG highlights the guidance and training it has implemented related to its case management system. During our case file review, we found that personnel uploaded key case documents to the case management system after DODIG had closed the case in 77 percent of cases closed in fiscal year 2013 and made changes to case variables in 83 percent of cases in 2014. DODIG staff made these changes at least 3 months after case closure and at least a year after DODIG implemented the database in December 2012, indicating that it was not being used for real-time case tracking for cases closed in fiscal year 2013. Further, despite DODIG’s stated efforts to train investigators and ensure data consistency, we found significant instances of coding errors where DODIG personnel were coding partially completed service investigations as full investigations. Specifically, we estimate that for cases closed in fiscal year 2013, 43 percent of cases that DODIG investigators coded as fully investigated were only partially investigated. As a result, we believe that additional guidance on how to use the case management system may help ensure that DODIG has awareness of the real-time status of cases and the reliability of DODIG’s data. In concurring with our third recommendation that DODIG work in coordination with the service IGs to develop an implementation plan for the expansion of the case management system, DODIG stated that we did not acknowledge the steps it has already taken to develop an implementation plan. We disagree. As we note in the report, DODIG officials stated during our review that they were developing an implementation strategy for the expansion of the case management system, but that they did not have an implementation plan. DODIG stated that it has taken additional actions since January 2015 to plan for the expansion of the case management system, such as developing a demonstration environment to define the requirement gaps. We believe that these actions are positive steps and that they will provide a strong foundation for the development of an implementation plan, which could help position DODIG to monitor the case management system expansion and measure project success. In concurring with our fourth recommendation that DODIG issue additional guidance to formalize the DODIG oversight process, DODIG stated that its investigations manual already provides formal guidance to DODIG investigators for conducting oversight reviews of service IG military reprisal investigations and that within the next 90 days it will develop additional guidance on conducting oversight reviews, such as how to evaluate and document deficiencies, including those that did not affect the overall outcome of the investigation. We disagree that DODIG’s investigations manual already provides formal oversight guidance. We reviewed the 5-page chapter in DODIG’s manual on oversight of service IG investigations, and we found that it does not detail the steps and documentation requirements of an oversight review, is not specific to military whistleblower reprisal investigations, and does not state what deficiencies are substantive and would affect the outcome of an investigation. We believe that DODIG’s stated plan to develop additional guidance, including how to evaluate and document deficiencies, could better ensure the consistency of DODIG’s oversight reviews and that all reprisal complaints receive due professional care. In concurring with our fifth recommendation that DODIG direct the services to follow standardized investigation stages and issue guidance clarifying how the stages are defined, DODIG stated that its October 2014 military whistleblower reprisal investigations guide describes DODIG’s intake process and that its Directive 7050.06, which was reissued in April 2015, establishes a timeline for completing the intake process in 30 days. We disagree that the guidance provides the needed instructions for investigators. We acknowledged in the report that DOD’s issuance of updated guidance is a positive step; however, DODIG describes its guide as a best practice for conducting military reprisal intakes and investigations and does not explicitly direct the services to follow DODIG’s preferred stages. In addition, it does not discuss the service IGs’ use of preliminary inquiries to dismiss cases after only a partial investigation, a practice DODIG stated it ended 3 years ago. We believe that standardized investigative stages may better ensure consistent program implementation and that all servicemember complaints are treated equally. In concurring with our sixth recommendation that DODIG ensure that feedback to service investigators includes the criteria against which the investigation was assessed and any deficiencies, and that feedback is shared with the service investigators, DODIG stated that within the next 60 days it will resume its prior practice of sending oversight worksheets to the service IGs. Those worksheets will include the criteria against which the service’s intake or investigation was reviewed as well as clear explanations of deficiencies and whether they affected the outcome of the case. DODIG also stated that it will work with the services to develop a mechanism by which results will be shared with service investigators. We believe that the steps DODIG noted in its response could improve the quality of future service IG investigations and better ensure that investigative reports meet the CIGIE standards that DODIG has incorporated into its oversight review. In concurring with our seventh recommendation that DODIG develop and implement a process for investigators to document whether the investigation was independent and outside of the chain of command, DODIG stated that within the next 60 days it will develop and implement such a process. Specifically, it stated that the process will require service investigators to attest in writing that they are outside the immediate chain of command of both the servicemember alleging reprisal and the alleged responsible management officials. Although such an attestation is a positive step, we believe that the service investigators should also attest to whether the investigation was independent. DODIG oversight worksheets we reviewed noted impairments to investigator objectivity in reports of investigation even though the service investigator was outside of the chain of command. We believe that an attestation that the investigation is both independent and outside of the chain of command could help serve as an accountability mechanism for service IG investigators and decrease the potential for bias in military whistleblower reprisal investigations. We are sending copies of this report to the Secretary of Defense; the Department of Defense Inspector General (DODIG); the Inspectors General (IG) of the Air Force, the Army, the Marine Corps, and the Navy; and appropriate congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To address our objectives, we used two primary sources of data, including (1) closed military whistleblower reprisal case data from the Department of Defense Office of Inspector General’s (DODIG) case management system and (2) a randomly selected sample of DODIG’s closed military whistleblower reprisal case files. DODIG provided us with information for all military whistleblower reprisal cases closed from October 1, 2011, through September 30, 2014, and all cases open as of October 1, 2014. We were unable to report the fiscal year 2012 data because DODIG transitioned to a new case management system in December 2012, and data from fiscal year 2012 were not reliable as a result of the data migration, according to DODIG officials. In addition, DODIG officials told us that they verified and corrected data as necessary for all cases closed in fiscal years 2013 and 2014 because the case management system was new and investigators had not been consistently recording information. We assessed the reliability of DODIG’s fiscal years 2013 and 2014 data—by reviewing related documentation, interviewing knowledgeable officials, and comparing selected fields, such as open and closed dates, with case file records from our sample—and concluded that the data were sufficiently reliable for reporting the average lengths of investigations. Further, we used the data for cases closed in fiscal year 2013 to select the sample for our case-file review, discussed below. We chose cases from this period for the file review because of DODIG’s case management system transition in December 2012 and statements from DODIG officials that data from cases closed in the old case management system were not as complete as data from cases closed in the new case management system. We also chose this period because the National Defense Authorization Act for Fiscal Year 2014, effective December 26, 2013, expanded the amount of time a servicemember has to report a reprisal allegation from 60 days to 365 days. We selected a stratified random sample of 135 cases from the 538 cases closed in fiscal year 2013. We stratified the population into six strata by combining three categories of case status and two categories of investigation status (see table 5 below). We calculated the sample sizes to achieve a desired precision of plus or minus 10 percentage points or fewer for a percentage estimate of the total population (N=538) at the 95 percent confidence level. We then adjusted the sample sizes to achieve a desired precision of plus or minus 10 percentage points or fewer for a percentage estimate at the 95 percent confidence level for DODIG Oversight cases (N=344, strata 3 and 4) and Fully Investigated cases (N=203, strata 1, 3, and 5). During the course of our review, we removed 11 out-of-scope cases, which reduced the original sample size from 135 to 124, because we found that 2 of the cases were open, 1 of the cases was classified and had limited documentation to review, and 8 cases were investigations of improper mental health examinations and not reprisal. This reduced sample of 124 cases is generalizable to the estimated population of in- scope cases. We generalized the results of our sample to the estimated population of 498 cases DODIG closed in fiscal year 2013. All estimates of percentages presented in this report have a margin of error of plus or minus 10 percentage points or fewer, unless otherwise noted. Further, all estimates of medians and averages presented in this report have a relative error of plus or minus 20 percent of the estimate, unless otherwise noted. To determine the extent to which the Department of Defense (DOD) has met statutory notification requirements and internal timeliness requirements for completing military whistleblower reprisal investigations, we calculated the timeliness of cases using case data from DODIG’s case management system for military whistleblower reprisal cases closed in fiscal years 2013 and 2014 and compared the average timeliness to the regulatory 180-day requirement. We removed one closed case from the timeliness calculations because the record produced a negative case processing time because the closed date preceded the open date. In addition, for all cases that were open as of September 30, 2014, we analyzed how long the cases had been open, according to the fiscal year in which the complaints were received. To determine the extent to which DOD met the statutory requirement to notify servicemembers in cases lasting longer than 180 days about delays in the investigation in fiscal year 2013, we reviewed the 124 case files in our sample for evidence that DOD had sent the required letter in cases lasting longer than 180 days. For cases where there was evidence that DOD had sent the required letter, we recorded the reasons provided for the delay as well as the estimated completion date. We calculated the median estimated time frame in the letters and compared this to the median completion date for these cases to determine the accuracy of DOD’s estimated time frames. In order to assess the reliability of DODIG’s data, we used case file documentation to determine the open and close dates of the 124 cases in our sample and calculated total case time for each case. We then compared the total case time we recorded for the sample cases to the total case time for those cases in DODIG’s data and we found a mean difference of 2 days. We further assessed the data through discussions with officials responsible for the data and concluded that the data were sufficiently reliable for reporting the average lengths of investigations. Further, we reviewed relevant documents including 10 U.S.C. § 1034, as amended, and its implementing directive on military whistleblower protections, DOD Directive 7050.06, Military Whistleblower Protection (July 23, 2007). After we sent our draft report for comment, DODIG issued an updated Directive on April 17, 2015, which we also reviewed. Finally, we interviewed officials about methods for tracking investigations and processes for sending required notifications to servicemembers that allege reprisal. We also collected relevant documentation, such as standard operating procedures and investigative guidance from DODIG, and the service Inspectors General (IG) for the Air Force, the Army, the Marine Corps and the Navy. We also spoke with officials from DODIG’s Information Systems directorate to determine which variables to request from DODIG’s case management system. To determine the extent to which DODIG’s whistleblower case management system supports oversight of the military whistleblower reprisal program, we obtained and analyzed closed case data from each of the service IGs for cases closed from fiscal year 2012 through fiscal year 2014. We assessed the reliability of service IG data from fiscal years 2013 and 2014—by reviewing related documentation and interviewing knowledgeable officials—and concluded that the data were sufficiently reliable for our purposes. We compared selected variables for all cases by matching DODIG’s data to the service IG data to identify duplicate cases and missing information, and to determine whether DODIG has visibility of all ongoing and closed military whistleblower reprisal cases. We selected the variables present in both DODIG’s and the service IGs’ data to compare for matching cases in consultation with DODIG and service officials, and those variables include servicemember name, case identifiers, open date, and closed date. Further, we interviewed DODIG officials responsible for the development of the case management system and the proposed expansion of the case management system to the service IGs and collected supporting documentation. We also reviewed DOD memorandums regarding the case management system expansion and cost information for the next phase of case management system development and compared these documents to relevant program management criteria. In addition, we interviewed officials from DODIG’s Administrative Investigations component as well as its Whistleblower Reprisal Investigations and Investigations of Senior Officials directorates, and service IG officials regarding the case management system expansion. To determine the extent to which DOD has processes to ensure oversight of military whistleblower reprisal investigations conducted by the service IGs, we used our stratified random sample of 124 case files retained by DODIG for military whistleblower reprisal cases that DODIG closed from October 1, 2012, through September 30, 2013. Based on our review of whistleblower reprisal investigation policies and procedures and quality standards for investigations established by the Council of the Inspectors General on Integrity and Efficiency (CIGIE), we created a data-collection instrument to identify the key characteristics of whistleblower reprisal cases, determine the reliability of various fields in the case management system, and assess the completeness and quality of files. We also developed a standard approach to electronically review files, using DODIG’s new case management system, to ensure we reviewed all cases consistently. For example, for all cases, we reviewed the original complaint followed by the report of investigation and interview transcripts, among other things. We refined this data-collection instrument and our approach by first reviewing 12 pilot case files selected by DODIG that were not part of the 135 originally identified in the sample. Specifically, the pilot consisted of cases that DODIG approved in the first three quarters of fiscal year 2014, including 3 cases investigated by DODIG, 3 cases investigated by the Army, 2 cases investigated by the Air Force, 2 cases investigated by the Navy, and 2 cases investigated by the Marine Corps. Of those 12 cases, 11 were fully investigated and 6 were substantiated. After the pilot, our methodology for reviewing the randomly sampled cases required each case to be reviewed first by one analyst and then reviewed by a second analyst who noted any disagreement with the first analyst’s assessment. Analysts discussed the areas of disagreement and resolved any disagreement by identifying and reviewing supporting documentation in the case files. Further, two GAO investigators with professional investigative experience reviewed a portion of the sample and concurred with the analysts’ assessment of the cases, in accordance with CIGIE guidelines for quality-assurance reviews. We did not question DODIG’s judgment in these cases. To assess case-file completeness, we reviewed DODIG’s process, 10 U.S.C. § 1034, directive, and other guidance and consulted with DODIG officials and identified 13 elements to include in our case-file review. These 13 elements support the conclusions reached in the case, indicate compliance with the law or directive, or manage the internal communication not specifically outlined by law or directive. The 13 elements we included for our case file review are the following: 1. notification to DODIG from the service IG that received the complaint, 2. evidence supporting the recommended outcome, 4. report of investigation or other written product, 6. interview with servicemember, 7. interview with responsible management official, 8. DODIG oversight worksheet, 9. correspondence between DODIG and the servicemember regarding investigations taking longer than 180 days, 10. correspondence between DODIG and the Secretary of Defense regarding investigations taking longer than 180 days, 11. record of corrective action taken, 12. correspondence between DODIG and the service IGs regarding the final case outcome, and 13. correspondence between DOD and the servicemember regarding the final outcome of the case. Some of these elements included specific documents. For example, the DODIG oversight worksheet (item 8 above) was a specific document. Other elements could be reflected in multiple documents. For example, the evidence supporting the recommended outcome (item 2 above) could be in a larger report, be in a summary, or be its own document. We determined the completeness of each case file selected in our sample individually since not all 13 elements were necessary in every case. For example, some of the 13 elements would only need to be present in a file if an investigation was conducted by a service IG or was a full investigation. We adjusted the required number of elements based on the specific circumstances of each case and calculated completeness based on that adjusted baseline. We categorized the case files by the average number of elements missing for each type of case, dismissed DODIG intakes, service IG preliminary inquiries, service IG full investigations, and DODIG full investigations. We also interviewed investigators and supervisors on DODIG’s oversight team and officials at each of the service headquarters IGs. In addition, we interviewed six field-level investigators from the Army, the Navy, and the Air Force IGs regarding required training, available guidance, and investigative processes, including assessing independence. We used data provided by each of the services for cases closed in fiscal year 2014 to select investigators for interviews. We used a simple random sampling technique to select investigators for interviews. We selected 12 investigators from the 216 investigations closed by the Army, 10 investigators from the 35 investigations closed by the Navy, and 10 investigators from the 110 investigations closed by the Air Force. Since field-level service IG investigators typically rotate every 2 to 3 years, we were able to contact and speak with two investigators from each service IG. In addition, we reviewed training materials, guidance, and requirements for investigators from DODIG and each of the service IGs as well as their processes for assessing investigator independence. We also attended training sessions related to conducting military whistleblower reprisal investigations at DODIG and the Army IG as well as 2 DODIG Administrative Investigations training symposia, which contained sessions on whistleblower reprisal investigations, and interviewed an official from CIGIE’s Advanced Training Institute. Additionally, we compared DOD’s independence processes to CIGIE quality standards for investigations and Generally Accepted Government Auditing Standards (GAGAS). We conducted this performance audit from April 2014 to May 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. This appendix provides information on the characteristics of military whistleblower reprisal cases based on our case file review of 124 cases closed from October 1, 2012, through September 30, 2013, as well as data from the Department of Defense Office of Inspector General’s (DODIG) case management system for cases closed in fiscal years 2013 and 2014. Generally, the service affiliations of the servicemembers that alleged reprisal did not match the overall proportions in the military population. See figure 3 for a comparison of the servicemember population proportion by service compared to the proportion of reprisal cases closed. Through our file review of cases closed in fiscal year 2013, we estimate that the majority of servicemembers filed reprisal complaints with a service Inspector General (IG) (70 percent). Servicemembers also filed reprisal complaints with the DODIG Hotline (23 percent) and through Members of Congress (6 percent). According to Department of Defense (DOD) Directive 7050.06, a servicemember who makes or prepares to make a protected communication is a whistleblower. Based on our review of case files closed in 2013, we estimate that the primary reasons for making a protected communication are to report allegations of a violation of law or regulation (49 percent), abuse of authority (39 percent), or a general communication to the IG (23 percent). Other reasons for making a protected communication included funds or resource waste (14 percent), public health or safety danger (11 percent,) and sexual assault (8 percent), among others. DOD officials told us that regulations cover virtually every aspect of military life, including how to conduct personnel ratings, so servicemembers often cite violations of regulations in their complaints. About 40 percent of cases in our sample included a protected communication regarding a personnel regulation violation. Figure 4 shows the reasons servicemembers made protected communications by frequency. Further, based on our case file review, we estimate that the primary authorized recipients of protected communications for cases closed in fiscal year 2013 were the chain of command (62 percent), Inspectors General (53 percent), and Members of Congress (18 percent). DOD officials told us that the inclusion of the chain of command in the list of authorized protected communication recipients has resulted in an increase in the number of servicemembers that qualify as whistleblowers because reporting issues to the chain of command is a standard military procedure. Figure 5 shows the authorized recipients to whom servicemembers made protected communications by frequency. A whistleblower reprisal complaint must also include an allegation that an action was taken in reprisal against a servicemember. DOD Directive 7050.06 defines reprisal as taking or threatening to take an unfavorable personnel action, or withholding or threatening to withhold a favorable personnel action, for making or preparing to make a protected communication. Based on our file review of cases closed in fiscal year 2013, we estimate that the most common forms of reprisal alleged by servicemembers were that they received a poor performance evaluation (44 percent), disciplinary action (39 percent), or an unfavorable assignment or reassignment (27 percent). Figure 6 shows the frequency of the various types of personnel actions. DODIG evaluates cases and generally closes them based on the answers to four questions, which investigators use to determine whether a case has all of the elements of reprisal. Specifically: (1) Did the servicemember make or prepare to make a protected communication, or was the servicemember perceived as having made or prepared to make a protected communication? (2) Was an unfavorable personnel action taken or threatened against the servicemember, or was a favorable personnel action withheld or threatened to be withheld following the protected communication? (3) Did the responsible management official have knowledge of the servicemember’s protected communication or perceive the servicemember as making or preparing to make a protected communication? (4) Would the same personnel action have been taken, withheld, or threatened absent the protected communication? Based on our review of randomly selected case files closed in fiscal year 2013, we estimate that the most common reason for closing a case was that DODIG determined that the responsible management official would have taken the personnel action absent the protected communication (question 4—37 percent), which means that the servicemember’s protected communication did not have an effect on the responsible official’s decision to take the personnel action. DODIG also closed cases because the servicemember did not make a protected communication (question 1—4 percent), there was no personnel action (question 2—9 percent), or the responsible management official who took the personnel action had no knowledge that the servicemember made or prepared to make a protected communication (question 3—3 percent). Additional reasons DODIG closed cases included timeliness—the servicemember did not file a reprisal complaint within 60 days of gaining knowledge of the personnel action—nonresponsive servicemembers, and withdrawals, See figure 7 for DODIG’s reasons for closing among other reasons.military reprisal cases by frequency. Further, based on our case-file review of cases closed in fiscal year 2013, we estimate that the service IGs closed the majority of cases in fiscal year 2013 (70 percent) after conducting a preliminary inquiry and prior to a full investigation. Our analysis of DODIG data on military whistleblower reprisal cases closed in fiscal year 2014 shows that DODIG substantiated 9 percent of the cases that were fully investigated by DODIG investigators. In addition, our analysis shows that the service IGs substantiated 6 percent of cases that proceeded past the intake phase. DODIG officials stated that they calculate substantiation rates by the number of cases substantiated out of the number of cases fully investigated; however, as discussed in the report, we are unable to report on the total number of cases fully investigated by the service IGs because DODIG’s data were not reliable for this purpose. As such, we report the service IGs’ substantiation rates out of the number of cases that proceeded to further investigation after meeting the general intake requirements—a personnel action following a protected communication. See table 6 for fiscal year 2013 and 2014 substantiation rates. The following are GAO’s comments on the Department of Defense Inspector General’s (DODIG) letter dated May 1, 2015, in addition to our evaluation of agency comments on page 50. 1. We disagree with DODIG’s statement comparing the timeliness of its intake process because we were not able to compare the timeliness of cases by case type in our 2012 report with this report due to DODIG data limitations. Specifically, in our 2012 report, we found that DODIG’s data were not reliable for the purposes of reporting investigation lengths and therefore used sample data to report the timeliness of cases DODIG closed between January 1, 2009 and March 31, 2011. We reported on the number of cases closed before full investigation and cases that were full investigations, which we determined by reviewing the case file documentation. In this report, we found DODIG’s timeliness data reliable for our purposes of reporting the average lengths of investigations; however, we were not able, using DODIG’s data, to distinguish between the number of cases that were fully investigated by the service IGs and the number of cases that the services closed with some investigative work, but prior to a full investigation. DODIG’s data were not reliable for these purposes due to DODIG coding errors. 2. We disagree with DODIG’s statement that it met statutory notification requirements in the majority of closed cases because it did not always meet those requirements. Specifically, in 2012, we found that DOD had stopped providing any notifications to servicemembers. In 2015, we found that DOD notified servicemembers about the status of investigations that took longer than 180 days in an estimated 53 percent of the cases that required notification. In those instances where the letters were provided to servicemembers, we estimated that DOD’s median notification time was on average 353 days after the servicemember filed the complaint, almost twice as long as the 180-day requirement. We acknowledge that DOD’s decision to reestablish the practice of sending 180-day notification letters is a positive step; however, we continue to believe that notifying servicemembers about half of the time is not in accordance with statutory requirements and that DOD should send the letters within 180 days of receipt of an allegation of reprisal, not on average of 353 days after receipt. 3. We disagree with DODIG’s statements regarding our characterization of its case management system, because we concluded that DODIG does not have complete oversight of all service reprisal investigations. Specifically, a large amount of detailed information about the cases, such as investigative events, resides in the services’ case management systems. Further, we found that DODIG’s system did not have record of at least 22 percent of service investigations both open as of September 30, 2014, and closed in fiscal years 2013 and 2014. DODIG is responsible for the oversight of these cases. In addition, we believe that DODIG’s agile development of the case management system—and the large gaps between development phases—may be the cause of some of the issues we found. DODIG officials told us that the length between phases of development was longer than originally intended by DODIG, and the system still needs to refine some of its capabilities, such as aggregating and extracting data for reporting purposes. DODIG intended to complete the system in February 2014 and still has not done so over a year later. Further, we found that DODIG made changes to its data in March and April of 2014, after it was notified of our audit. We believe that DODIG should have been making sure its data were reliable on an ongoing basis. DODIG also stated that we did not address its approaches for ensuring data reliability; however, we did include a discussion of some of these approaches in our report, such as its dashboards to identify errors, and its quarterly quality assurance processes, on pages 24 and 37. Finally, DODIG listed system capabilities, such as the ability to track overall case age, which we incorporated into the report and about which we noted limitations where relevant. 4. We disagree with DODIG’s statements regarding feedback it provides to service IG investigators because DODIG’s Council of the Inspectors General on Integrity and Efficiency (CIGIE) trainings do not reach all field-level investigators, as we stated in our report. In addition, the sample case-closure memorandum that DODIG provided to us did not contain such criteria. Further, in our report, we define the criteria against which DODIG oversight investigators assess service IG investigator independence. However, we found that in the absence of interview transcripts, which were present for servicemember interviews in only 43 percent of cases closed in fiscal year 2013, oversight investigators have limited tools to determine whether the investigator demonstrated IG impartiality during interviews. 5. We disagree with DODIG’s comment that we did not include information related to DODIG’s progress since 2012 because we addressed DODIG’s stated improvements on the following pages in our report: (1) DODIG’s staffing increases, p. 19; (2) new case management system, p. 21; (3) data clean-up to ensure data reliability, p. 25; (4) issuance of policy guidance to the service IGs regarding the 180-day notification requirements, p.11; (5) Administrative Investigations manual, pp. 42; (6) issuance of October 2014 military whistleblower reprisal investigations guide, p. 38; and (7) reissuance of DOD Directive 7050.06. The directive was issued on April 17, 2015, after we sent our draft report to DOD for agency comments, and we incorporated it into our final report as necessary, p. 52. However, the directive dated July 2007 was in place during the scope of our review and, as such, we used it for criteria where applicable. In addition to the contact named above, Lori Atkinson (Assistant Director), James Ashley, Tracy Barnes, Gary Bianchi, Molly Callaghan, Sara Cradic, Cynthia Grant, Robert Graves, Christopher Hayes, Erica Reyes, Mike Silver, Amie Steele, and Erik Wilkins-McKee made significant contributions to this report. Whistleblower Protection: Additional Actions Needed to Improve DOJ’s Handling of FBI Retaliation Complaints. GAO-15-112. Washington, D.C.: January 23, 2015. Whistleblower Protection Program: Opportunities Exist for OSHA and DOT to Strengthen Collaborative Mechanisms. GAO-14-286. Washington, D.C.: March 19, 2014. Whistleblower Protection: Actions Needed to Improve DOD’s Military Whistleblower Reprisal Program. GAO-12-362. Washington, D.C.: February 22, 2012. Tax Whistleblowers: Incomplete Data Hinders IRS’s Ability to Manage Claim Processing Time and Enhance External Communication. GAO-11-683. Washington, D.C.: August 10, 2011. Criminal Cartel Enforcement: Stakeholder Views on Impact of 2004 Antitrust Reform Are Mixed, but Support Whistleblower Protection. GAO-11-619. Washington, D.C.: July 25, 2011. Whistleblower Protection: Sustained Management Attention Needed to Address Long-Standing Program Weaknesses. GAO-10-722. Washington, D.C.: August 17, 2010. Defense Contracting Integrity: Opportunities Exist to Improve DOD’s Oversight of Contractor Ethics Programs. GAO-09-591. Washington, D.C.: September 22, 2009. Whistleblower Protection Program: Better Data and Improved Oversight Would Help Ensure Program Quality and Consistency. GAO-09-106. Washington, D.C.: January 27, 2009. Justice and Law Enforcement: Office of Special Counsel Needs to Follow Structured Life Cycle Management Practices for Its Case Tracking System. GAO-07-318R. Washington, D.C.: February 16, 2007. U.S. Office of Special Counsel: Strategy for Reducing Persistent Backlog of Cases Should Be Provided to Congress. GAO-04-36. Washington, D.C.: March 8, 2004. The Federal Workforce: Observations on Protections From Discrimination and Reprisal for Whistleblowing. GAO-01-715T. Washington, D.C.: May 9, 2001. Whistleblower Protection: VA Did Little Until Recently to Inform Employees About Their Rights. GAO/GGD-00-70. Washington, D.C.: April 14, 2000.

Summary: Whistleblowers play an important role in safeguarding the federal government against waste, fraud, and abuse. However, reporting wrongdoing outside the chain of command conflicts with military guidance, which emphasizes using the chain of command to resolve problems. Whistleblowers who make a report risk reprisal from their unit, such as being demoted or separated. DODIG is responsible for conducting and overseeing military whistleblower reprisal investigations. GAO was asked to examine DOD's oversight of military whistleblower reprisal investigations. This report examines the extent to which (1) DOD met statutory notification and internal timeliness requirements for completing military whistleblower reprisal investigations, (2) DODIG's whistleblower case management system supports oversight of reprisal investigations, and (3) DOD has processes to ensure oversight of service IG-conducted reprisal investigations. GAO analyzed DODIG and service IG data for cases closed in fiscal years 2013 and 2014 and cases open as of September 30, 2014, and reviewed a generalizable random sample of 124 military reprisal cases closed in fiscal year 2013. The Department of Defense (DOD) did not meet statutory military whistleblower reprisal 180-day notification requirements in about half of reprisal investigations closed in fiscal year 2013, and DOD's average investigation time for closed cases in fiscal years 2013 and 2014 was 526 days, almost three times DOD's internal 180-day requirement. In 2012, GAO made recommendations to improve investigation timeliness, and DOD has taken some actions to address those recommendations. However, based on a random sample of 124 cases, GAO estimated that there was no evidence that DOD sent the required notification letters in about 47 percent of the cases that DOD took longer than 180 days to close in fiscal year 2013. For cases in which DOD sent the required letter, GAO estimated that the median notification time was about 353 days after the servicemember filed the complaint, and on average the letters significantly underestimated the expected investigation completion date. DOD does not have a tool, such as an automated alert, to help ensure compliance with the statutory notification requirement to provide letters by 180 days informing servicemembers about delays in investigations. Without a tool for DOD to ensure that servicemembers receive reliable, accurate, and timely information about their investigations, servicemembers may be discouraged from reporting wrongdoing. DOD's Office of Inspector General's (DODIG) newly developed case management system, which it established to improve monitoring, is separate from the service IGs' systems, limiting DODIG's ability to provide oversight of all military reprisal investigations. GAO found that DODIG's system did not have a record of at least 22 percent of service-conducted reprisal investigations that were closed in fiscal years 2013 and 2014 and investigations open as of September 30, 2014. DODIG officials stated that they plan to expand DODIG's case management system to the service IGs by the end of fiscal year 2016 to improve DODIG's visibility over investigations. However, DODIG does not have an implementation plan for the expansion, and service IG officials stated that they have unique requirements that they would like to have incorporated into the system prior to expansion. Expanding the case management system to the service IGs without developing an implementation plan that, among other things, addresses the needs of both DODIG and the service IGs, puts DOD at risk of creating a system that will not strengthen its oversight of reprisal investigations. DOD does not have formalized processes to help ensure effective oversight of military whistleblower reprisal investigations conducted by service IGs. DODIG established an oversight investigator team to review service IG investigations, but it has provided oversight investigators with limited guidance on how to review or document service IG investigations. Specifically, GAO estimated that for about 45 percent of service investigations closed in fiscal year 2013, the oversight worksheets were missing narrative to demonstrate that the oversight investigator had thoroughly documented all case deficiencies or inconsistencies. GAO also found that these files did not include documentation of DOD's analysis of the effect of noted deficiencies on the investigation's outcome because DOD has provided limited instruction on how to review service IG cases. Without additional guidance on oversight review procedures and documentation requirements to formalize the oversight process, it will be difficult for DOD to ensure that reprisal complaints are investigated and documented consistently. GAO recommends that DOD develop a tool to help ensure compliance with the statutory notification requirement, develop an implementation plan for expanding DODIG's case management system, and issue guidance governing the oversight process, among other things. DOD concurred, but raised issues with GAO's presentation of its findings. GAO disagrees and addresses these issues in this report.