According to State, more than 25,000 U.S. government personnel are assigned to 275 U.S. diplomatic posts overseas. These officials represent a number of agencies besides State, such as the Departments of Agriculture, Defense, Homeland Security, Justice, and the Treasury, and the U.S. Agency for International Development, among others. As we reported in 2005, State considers soft targets to be places where Americans and other westerners live, congregate, shop, or visit. In addition to residences and schools, soft targets can include hotels, clubs, restaurants, shopping centers, places of worship, and public recreation events. Travel routes of U.S. government employees are also considered soft targets, based on their vulnerability to terrorist attacks. For the purposes of this report, we focus primarily on U.S. diplomatic residences; we also focus on schools attended by U.S. government dependents and off-compound employee association facilities since such schools and facilities are eligible for State-funded security upgrades. As of the end of fiscal year 2014, the U.S. government leased or owned more than 15,000 residences worldwide, according to State. About 13,000 were residences leased by the U.S. government and located off embassy or consulate compounds, while slightly more than 2,000 were government-owned, most of which were also located off embassy or consulate compounds. With respect to schools, State estimates that there are nearly 250,000 school-age American children overseas, of which approximately 8,000 are U.S. government dependents. State provides assistance to almost 200 “American-sponsored” schools worldwide to help provide quality education for children of U.S. government employees. U.S. government dependents may also attend any other schools preferred by their parents. In addition, State has chartered about 130 employee associations at posts overseas. These associations maintain a variety of facilities, including, among others, retail stores, cafeterias, recreational facilities, and quarters for officials on temporary duty. Some of these facilities are located off embassy or consulate compounds. The vast majority of the facilities are either owned or leased by the U.S. government. According to State, host-country police, security, and intelligence forces are often the first line of defense in protecting U.S. government personnel against potential threats. Additionally, as required by the Omnibus Diplomatic Security and Antiterrorism Act of 1986, the Secretary of State, in consultation with the heads of other federal agencies, is responsible for developing and implementing policies and programs to protect U.S. government personnel on official duty abroad, along with their accompanying dependents. Responsibility for the security of residences and other soft targets overseas falls primarily on DS and OBO. DS is responsible for, among other things, establishing and operating security and protective procedures at posts, chairing the interagency process that sets security standards, and developing and implementing posts’ residential security programs, which includes providing funding for most residential security upgrades. At posts, DS agents known as RSOs, including deputy RSOs and assistant RSOs, are responsible for protecting personnel and property, documenting threats and residential vulnerabilities, and identifying possible mitigation efforts to address those vulnerabilities. Posts with high turnover of residences or a large number of residences may also have a residential security coordinator on the RSO’s staff to assist with supervision and management of the posts’ residential security programs. RSOs are also responsible for offering security advice and briefings to schools attended by U.S. government dependents and recommending security upgrades to school and employee association facilities. OBO tracks information on State’s real properties, including residences; provides funding for certain residential security upgrades; and funds and manages the Soft Target Program, State’s program for providing security upgrades to schools attended by U.S. government dependents and off-compound employee association facilities. State’s policies are outlined in the FAM and corresponding FAH. Sections of the FAM and FAH relevant to residential security include various subchapters detailing State’s program for residential security, the OSPB residential security standards, and security-related guidance found in the Residential Security Handbook and Physical Security Handbook. In addition, the FAM includes sections that provide guidance about schools that enroll U.S. government dependents and off-compound employee association facilities. See table 1 for further details on selected FAM and FAH policies that are pertinent to securing residences and other soft targets. In addition to these policies, State has produced other guidance documents, such as a matrix that identifies which residential security upgrades DS and OBO, respectively, are responsible for funding and an OBO-drafted cable that outlines the process for requesting security upgrades at schools and employee association facilities. State assesses risks to U.S. diplomatic residences overseas using a range of activities, but many security surveys were not completed for residences we visited. We found that State (1) records and monitors information on overseas residences in its property database, (2) establishes threat levels at overseas posts, (3) develops security standards for residences, and (4) uses these standards to conduct security surveys of residences to identify vulnerabilities. However, 17 of 68 surveys for residences we visited were not completed as required, thereby limiting State’s ability to effectively and efficiently identify and address vulnerabilities. OBO is responsible for maintaining records on all diplomatic residences overseas in its real property database (hereafter referred to as OBO’s property database). OBO’s property database contains data on residences owned and leased by the U.S. government, and includes details such as residence type and address, whether a given residence is leased or owned, the agency affiliation of the occupant, and the acquisition date, among others. DS officials told us that they rely on OBO’s database as their source for such details on residences. As we have previously reported, maintaining accurate and reliable property information has been a long-standing challenge for State. OBO has taken a number of steps to enhance its property data since we first reported on this issue, including hiring dedicated analysts to review and validate data entered at posts and processing budget requests through the property database so that funding requests from posts are linked to the accuracy of the posts’ property data. State also concurred with our June 2014 recommendation that OBO establish a routine process for validating the accuracy of the data in its property database, and we continue to follow up on State’s efforts to implement the recommendation. During this review, we found inaccuracies in the property data for 2 of the 68 residences we visited: in both cases, the residence type listed was incorrect. OBO officials told us that they reached out to the posts where the residences were located and asked them to input the correct information. DS conducts two key activities to help assess risks to residences. First, DS evaluates the security situation at each overseas post by assessing five types of threats—political violence, terrorism, crime, and two classified categories—and assigning corresponding threat levels for each threat type. The threat levels are as follows: critical: grave impact on U.S. diplomats; high: serious impact on U.S. diplomats; medium: moderate impact on U.S. diplomats; and low: minor impact on U.S. diplomats. Threat levels for each post are assessed and updated annually in the Security Environment Threat List. According to DS officials, the bureau develops the list based on questionnaires filled out by post officials, and the final threat ratings are reviewed and finalized through an iterative process involving officials at overseas posts and headquarters. These threat levels are used to determine the security measures required for residences at each post. Second, in consultation with the interagency OSPB, DS develops physical security standards for diplomatic facilities and residences. The residential security standards apply to all residences of U.S. government personnel assigned abroad under chief-of-mission authority. The OSPB standards are published in the FAH and vary by residence type. Specifically, there are separate OSPB standards for six different residence types, one of which is on-compound housing. The remaining five are for off-compound (1) apartments, (2) single family homes, (3) residential compounds, (4) Marine Security Guard residences, and (5) residences for principal officers. OSPB standards also vary by date of construction or acquisition, threat level, and whether they are mandatory. If residences do not meet all applicable mandatory standards, posts are required to request exceptions to the OSPB standards. Within the OSPB standards, we identified six key categories of security standards to protect residences from the threats of political violence, terrorism, and crime. These include (1) an anti-climb perimeter barrier, such as a wall or a fence, and access control; (2) setback from the perimeter; (3) a secure off-street parking area; (4) a secure building exterior with substantial doors and grilled windows with shatter-resistant film; (5) alarms; and (6) a safe space for taking refuge. Figure 1 portrays these six categories at a notional residence. In addition to the OSPB standards, State developed the Residential Security Handbook and Physical Security Handbook, also published in the FAH, which provide detailed supporting information designed to help officials understand how to implement and meet the OSPB standards. According to the FAM, before State can purchase or lease an overseas residence, the RSO must conduct a residential security survey of the property, document all security deficiencies that must be corrected, and approve the purchase or lease of the residence. Off-compound residences must be resurveyed every 5 years, and on-compound residences must be resurveyed every 3 years. Additionally, according to DS officials, RSOs at posts that experience a change in threat level must resurvey all post residences within 1 year of the threat-level change. While officials at the posts we visited were able to provide us with up-to- date surveys for most of the 68 residences that we evaluated, not all surveys at five of the seven posts we visited met the requirements outlined in the FAH and the FAM. Specifically, 17 surveys were not completed as required: 9 surveys were outdated, 1 survey was completed after the residence had already been leased, and 7 surveys were missing. Among the residences with surveys that did not meet requirements were those of two principal officers. At one post, we found that the consul general’s residence had not been surveyed since 2006. At another, the RSO was unable to find a survey for the ambassador’s residence. Missing or outdated surveys may limit DS and posts’ ability to identify and address residential security vulnerabilities that could have otherwise been recognized and corrected through the security survey process. As noted in the framework we developed to help federal agencies implement the Government Performance and Results Act of 1993, leading organizations reinforce results-oriented management by giving their managers extensive authority to pursue organizational goals in exchange for accountability for results. According to officials at DS headquarters, ensuring that residential security surveys are completed as required is the responsibility of individual posts. These officials added that they recently started reviewing surveys for on-compound residences. However, aside from periodic DS headquarters-led inspections that review, in part, the extent to which posts are conducting residential security surveys as required, DS has not instituted procedures to hold posts accountable for complying with the survey requirements for off-compound residences, which, as noted earlier, greatly outnumber on-compound residences. Without up-to-date security surveys of all its overseas residences, State has limited ability to effectively and efficiently identify vulnerabilities or make informed decisions about where to allocate resources for security upgrades to address such vulnerabilities. State Has Taken or Planned Actions to Enhance Residential Security Following Attacks on U.S. Facilities and Personnel State has taken steps to enhance residential security in response to previous attacks on U.S. facilities. These have included actions taken or planned to address recommendations resulting from interagency security assessments and Accountability Review Board (ARB) reports. In response to the September 2012 attacks against U.S. diplomatic facilities—including facilities in Libya, Sudan, Tunisia, Yemen, and Egypt, among others—State formed several Interagency Security Assessment Teams to assess security vulnerabilities at 19 posts that the Bureau of Diplomatic Security considered to be high-threat and high-risk. Rather than assess the facilities at the 19 posts against the Overseas Security Policy Board standards typically used to assess these facilities, the teams assessed all facilities at the 19 posts for any type of security vulnerability—physical or procedural. This assessment process resulted in a report that recommended physical security upgrades at some residences. At one post that we visited, officials noted that in response to this report they had added a closed-circuit television system at the ambassador’s residence, but had not yet installed an emergency siren system at a residential compound, which was also recommended by the report. State has also taken or planned steps to address recommendations from ARB reports stemming from previous attacks on U.S. facilities and personnel overseas. According to State, there have been four ARB reports related to the security of residences, with 10 residential security recommendations in total. We found that 8 of the 10 recommendations related to residential security have been implemented. For instance, State established an interagency working group in response to a recommendation to conduct a comprehensive review of issues related to residential security. The 2 open recommendations are both from the 2005 ARB report on the attacks on the U.S. consulate in Jeddah, Saudi Arabia. Those recommendations, which called for the construction of a new consulate compound along with residences that meet the relevant security standards, will be closed as implemented once staff transition into the new consulate compound in Jeddah. According to State documentation, the new consulate compound was originally projected for completion in March 2010. However, in May 2010, State terminated the contract because of the original contractor’s failure to perform. State awarded a new contract for the project in September 2012. State officials told us in November 2014 that they expect substantial construction of the new consulate compound to be completed in December 2015 and that the planned move-in date is March 2016. Over the last decade, State has taken steps to develop or revise several sets of OSPB residential security standards. However, we found that State has not been timely in updating these standards, nor has it always communicated changes to posts in a timely manner. Moreover, the OSPB standards and other security-related guidance for residences are confusing in nature and contain gaps and inconsistencies, thereby complicating posts’ efforts to apply the appropriate security measures and potentially leaving residences at risk. Federal internal control standards state that agencies must have timely communication and information sharing to achieve objectives; therefore, it is vital that agencies update their policies in a timely manner, particularly when lives and the security of property and information are at stake. DS manages the interagency process by which OSPB security standards are updated. According to DS officials, it should take about 75 days to make an update to the OSPB standards. Specifically, it should take up to 30 days to draft and obtain approval within DS for an update to the security standards in the FAH and up to another 15 days to obtain approval for the draft changes by other relevant stakeholders within State, such as OBO and the Office of the Legal Adviser. Obtaining approval from OSPB members should occur within an additional 30 days. Once all of the required approvals are obtained, DS sends the update to the Bureau of Administration for publishing. Since 2005, State has taken steps to update three sections of the FAH with new or revised OSPB residential security standards; however, the time it took to complete these updates significantly exceeded 75 days. Specifically, State (1) developed new residential security standards to address the threat of terrorism, (2) revised the standards for newly acquired on-compound housing, and (3) developed new standards for existing on-compound housing. In each of these cases, the update process took more than 3 years, including one instance that took more than 9 years (see fig. 2). In April 2005, the ARB resulting from the attacks on the U.S. consulate in Jeddah, Saudi Arabia, recommended developing residential security standards to address terrorism. A working group completed a final draft of the standards 4 years later in April 2009, and it took other stakeholders within State nearly 5 more years to clear the standards. As a result, the standards were not approved by OSPB and published until May 2014. Moreover, DS did not notify posts that the new standards had been completed until mid-October 2014—5 months after their publication and 3 months after they went into effect. DS officials stated that their decision to notify posts was prompted in part by our asking how posts become aware of new or revised standards. Of the three posts that we visited prior to DS’s notification regarding the new standards, one had found them in the FAH on its own in the same month that the standards went into effect, one had found the new standards in the FAH on its own but not until they had already gone into effect, and one was unaware of the new standards until we mentioned them during our visit. According to DS officials, these new standards applied immediately to off-compound residences acquired on or after July 1, 2014; all other off-compound residences have to meet the standards within 3 years—by July 2017—or receive exceptions. However, because DS did not notify posts about the new standards until October 2014, post officials effectively lost several months during which they could have been preparing to apply the new standards. Additionally, officials at one post stated that the DS notification arrived 1 day before the deadline for submitting a budget request for the following fiscal year. In order to request funding for newly required security features, they had to make major revisions to the budget request they had already developed but had very little time to do so. Likewise, officials at another post stated that they had to make significant revisions to the building plan for a new residential compound already under construction in order for it to meet the new standards. In November 2010, OSPB gave its approval for revising the standards for newly acquired on-compound housing. These standards were not finalized until September 2014. DS notified posts of their publication in October 2014. In November 2010, OSPB also gave its approval for developing new standards for existing on-compound housing. The standards did not receive approval within DS until September 2014. State published the standards in May 2015. As we reported in June 2014, two key factors can cause major delays in DS’s process for updating security standards. First, if a stakeholder suggests a change to the draft standards at any time during the review process, the proposed draft must go through the entire review process again; some stakeholders may then request additional time for reviewing proposed changes, further prolonging the process. Second, when changes are being made to an existing FAH subchapter, the FAH requires officials to review and update the entire subchapter, and according to DS officials, there is no specific exception for updates to standards aimed at ensuring security and protecting lives. As a result, even when DS needs to make urgent changes to the OSPB standards, it must review and update the entire subchapter containing the update. In an attempt to mitigate delays in the process for updating OSPB standards, State has taken some steps to help posts apply draft standards before they are officially approved, but these steps have not fully addressed the delays. While the standards for newly acquired on- compound housing were still in the OSPB approval process, State incorporated them into the Physical Security Handbook—updates to which, according to DS, require clearance only within State—so that RSOs could begin to apply them. Similarly, State incorporated the standards for existing on-compound housing into the Physical Security Handbook before DS approved them. With respect to timely communication of updated standards, DS recently began sending monthly notices to RSOs to announce recently published updates to the FAH. However, DS had not yet begun these monthly notices when the new standards addressing terrorism were finalized in May 2014. Thus, these efforts notwithstanding, delays in updating OSPB security standards and communicating the updates may leave posts unaware of the most current security measures required to address identified threats. Accordingly, we recommended in June 2014 that State take steps to ensure that updates to security and safety standards be approved through an expedited review process. State concurred with the recommendation, explaining that it had shortened the deadline for department clearance on draft policies from 30 days to 15 days. However, in two of the three cases outlined above—the revised standards for newly acquired on-compound housing and the new standards for existing on- compound housing—draft standards were submitted for department clearance after State’s decision to shorten the associated deadline to 15 days. In both cases, it took more than 4 months to secure department clearance. We continue to follow up on State’s efforts to implement our recommendation to use an expedited review process for updating security and safety standards. According to federal internal control standards, policy standards should be clear, complete, and consistent in order to facilitate good decision making in support of agency objectives. The FAH similarly directs officials who are drafting FAH and FAM directives to write “in plain language whenever possible” and to convey “a clear sense of what you want the reader to do or not do.” However, we found that relevant State residential security standards and related guidance are confusing in nature and contain gaps and inconsistencies, making it difficult for RSOs to identify and apply the appropriate security measures. Several aspects of State’s residential security standards and related guidance contribute to their confusing nature. Dispersed across the FAH and FAM. State’s residential security standards and related guidance are presented throughout various sections of the FAH and FAM. RSOs at six posts we visited and even some headquarters officials involved in developing the standards stated that they find it challenging to keep track of all the sections where relevant standards and guidance appear. We located relevant standards and guidance in nine different subchapters of the FAH and FAM. Further, one of the subchapters refers to a set of standards that predated the 1998 embassy bombings and no longer exists. DS has taken steps to mitigate this dispersion by creating tables that consolidate the relevant standards. Specifically, DS has created tables for each of the following: (1) the standards for newly acquired on-compound housing; (2) the standards for existing on-compound housing; and (3) the standards for off-compound residences, including the new May 2014 standards to address terrorism. DS officials stated in April 2015 that they had not yet provided RSOs with the table for off-compound residences but planned to do so in May 2015. In addition, DS officials told us that they plan to develop an automated template for on-compound housing to assist RSOs in identifying the relevant standards. Confusing terminology. RSOs at five posts stated that the standards and guidance are sometimes worded in a confusing manner. Specifically, while some standards are worded as mandatory measures that “must” be taken, others are worded in a way that could be interpreted as mandatory or discretionary. For example, some measures “should” or will “ideally” be taken, or are “recommended”; likewise, some standards “must be considered,” while others “should be considered.” DS officials told us that the intent of using various terms in the guidance is to give RSOs some flexibility in deciding which measures are applicable to their posts. However, a number of RSOs told us that they sometimes had difficulty deciding whether and how to apply certain standards because of their confusing wording. These RSOs said that difficulties in distinguishing the nuances between the various terms used in the standards sometimes resulted in their uncertainty as to whether the residences at their posts were fully in compliance with the standards. Unclear housing categories. While the new standards issued in May 2014 include a section outlining specific security measures for residential compounds, DS headquarters officials told us that they have had difficulty defining what differentiates this type of housing from single family homes located in gated communities, which are subject to a separate set of security measures. Officials added that in the absence of clearly defined housing categories, it is difficult for RSOs to know which standards to apply. In addition to finding State’s residential security standards and guidance to be confusing in nature, we identified multiple gaps and inconsistencies, including the examples described below. The previous version of the FAM subchapter detailing State’s program for residential security stated that when a post experiences a change in its Security Environment Threat List rating, the post must resurvey residences to determine what security upgrades, if any, are needed. However, a new version of the FAM subchapter published in August 2014 does not include this requirement. When we asked DS officials about this, they told us it was an oversight and stated that the requirement still exists. They also stated that because we brought this issue to their attention, they plan to revise the standards issued in May 2014 to include the requirement. While the new standards released in May 2014 call for pedestrian and vehicle gates at residences to have locking devices, DS officials noted that the standards as written do not explicitly require the residences to have gates. They told us they plan to modify the wording of this standard to clarify that gates are required. In addition to announcing the completion of residential security standards to address terrorism, the notification DS sent to posts in October 2014 enumerated other sets of security standards for posts to apply, including standards to address crime and standards for newly acquired on-compound housing. However, the notification did not mention the security standards in effect at the time for existing on- compound housing. Additionally, those standards for existing on- compound housing, which dated back to December 1999, were labeled in the FAH as standards for “new” on-compound housing. This could potentially have caused confusion since the September 2014 standards for newly acquired on-compound housing are also labeled as standards for “new” on-compound housing. As noted earlier, State issued new standards for existing on-compound housing in May 2015. Because State completed those standards late in our review, we were unable to fully evaluate them. We found inconsistent guidance on whether residential safe havens are required to have an emergency exit. The Residential Security Handbook states that every residential safe haven must have an emergency exit. By contrast, a definitional section of the OSPB security standards states that an emergency exit is required in residential safe havens that have grilles and are located below the fourth floor. A third variation appears in the new residential security standards to address terrorism released in May 2014; it states that residential safe havens must have an emergency exit “if feasible.” DS officials told us that they plan to update the May 2014 standards to help RSOs determine feasibility, but it is unclear whether they plan to eliminate the inconsistencies we identified. These gaps and inconsistencies exist in part because DS has not comprehensively reviewed and harmonized its various standards and security-related guidance for residences. The FAH requires OSPB to review all the OSPB standards periodically—at least once every 5 years. In practice, as we previously reported, the process by which security standards are updated is typically triggered by an event, such as an attack, rather than by a periodic and systematic evaluation of all the standards. As noted above, DS officials are planning updates to the OSPB residential security standards to remedy some of the issues we found. DS officials also stated that they are in the process of updating the Residential Security Handbook and, as part of that effort, are adding further clarifications and details to help guide RSOs. However, as discussed earlier in this report, updates to the OSPB standards have frequently taken State several years. Furthermore, the planned updates that DS officials discussed with us do not constitute a comprehensive effort to review all standards and security-related guidance for residences to identify all potential gaps, inconsistencies, and instances where clarity is lacking. Consequently, the confusing nature of the standards and guidance and the gaps and inconsistencies they contain may continue to complicate RSOs’ efforts to identify and apply the appropriate security measures, potentially leaving some residences at greater risk. At a minimum, such gaps and inconsistencies in the standards and guidance can lead to confusion and inefficiency. For example, according to RSO officials at one post we visited, DS inspectors from headquarters told them during a review of the post’s security operations that residential safe havens must have a reliable water source and grilles on all external windows, including inaccessible windows. We subsequently verified with DS headquarters that no such requirements exist for residential safe havens. Over the last 6 fiscal years, State has allocated about $170 million for security upgrades to help address vulnerabilities identified at diplomatic residences. However, 38 of the 68 residences that we reviewed did not meet all of the applicable standards, thereby potentially placing their occupants at risk. In instances when a residence does not and cannot meet the applicable security standards, posts are required to either seek other residences or request exceptions, which identify steps the posts will take to mitigate vulnerabilities. However, DS had an exception on file for only 1 of the 38 residences that we found did not meet all of the applicable standards. Without all necessary exceptions in place, State lacks information that could provide decision makers with a clearer picture of security vulnerabilities at residences and enable them to make better risk management decisions. In addition, new, more rigorous security standards will likely increase posts’ need for exceptions and lead to considerable costs for upgrades. State addresses security vulnerabilities at residences by installing various kinds of upgrades intended to help residences meet, or in some cases exceed, the applicable standards. According to State guidance, every effort should be made to have owners or landlords of leased residences complete any permanent residential security upgrades at no cost to the U.S. government. If the owners or landlords are unwilling or unable to complete the necessary upgrades, RSOs have the option either to request funding for upgrades or seek alternate residences. Security upgrades for residences are primarily funded through DS, which funds all upgrades—such as window grilles, residential safe havens, and shatter- resistant window film—other than perimeter barriers and some access control measures at certain residences. As shown in table 2, in fiscal years 2010 through 2015, DS allocated approximately $164 million for residential security upgrades. Over the same period, OBO allocated more than $6 million for residential security upgrades to perimeter barriers and some access control measures at government-owned residences and certain leased residences. In some cases, RSOs may determine that the OSPB residential security standards applicable at their posts are not stringent enough to address threat conditions. In such instances, the RSO, in consultation with the post’s Emergency Action Committee, may seek to implement security measures that go above the standards. If an owner or landlord does not agree to install a security measure that goes above the standards, the post may choose to request funding from DS. For example, DS officials told us that they approved a request for funding to install additional security measures at a post where single family homes were meeting all the applicable standards but were still experiencing break-ins. Diplomatic residences are required to meet OSPB security standards. The FAH and the FAM state that when residences do not meet and cannot be made to meet the applicable standards, and no other acceptable alternatives are available, posts are required to request exceptions to the standards from DS headquarters. According to State, exception requests are required to identify the steps posts will take to mitigate vulnerabilities, and approved exceptions serve to document State’s acceptance of any unmitigated risk that remains. DS officials clarified that posts are required to apply for exceptions for any unmet standards that are worded in terms of mandatory measures that “must” be taken. However, more than half of the residences we reviewed at the seven posts we visited did not meet all applicable mandatory security standards and lacked required exceptions to those standards. Of the 68 residences we reviewed at the seven posts, 38 did not meet all of the mandatory standards applicable to them at the time even though, according to post officials, most of the 38 received security upgrades in recent years. Moreover, 23 of the 38 residences did not meet two or more of the mandatory standards. When we discussed the unmet standards we found with RSOs and other post officials, they generally agreed with our assessments and stated in several cases that they would take steps to address the vulnerabilities. In some cases, though, post officials were unable to provide explanations for unmet standards. For instance, although 3 of the 4 off-compound principal officer residences we visited did not have grilles on all accessible windows as required—thereby creating vulnerabilities at these potentially high-profile targets—officials could not explain why grilles were missing other than to suggest that current principal officers and their predecessors may have wanted to leave certain windows without grilles for aesthetic purposes. In addition, two factors discussed earlier in this report may contribute to unmet standards. First, missing or outdated residential security surveys may hamper posts’ ability to identify and address residential security vulnerabilities that could have otherwise been recognized and corrected. Second, the difficult-to-use nature of the OSPB standards and other security-related guidance for residences can complicate RSOs’ efforts to identify and apply the appropriate security measures. Of the 38 residences we reviewed that did not meet all of the applicable mandatory standards, DS had an exception on file for only 1. In some cases, such as residences with doors lacking deadbolt locks or peepholes, DS officials told us that relatively little effort or funding would be needed to bring the residence into compliance with the standards and thereby eliminate the need for an exception. However, many of the 38 residences that did not meet all of the applicable mandatory standards had more significant vulnerabilities. For instance, as noted earlier, 3 of the 4 off-compound principal officer residences we visited did not meet the standard that all accessible windows must have grilles when such residences are located at posts rated high for political violence or crime; DS did not have exceptions for any of the 3. Likewise, 5 of the 7 off- compound apartments acquired after July 1, 2014—and therefore subject to the new May 2014 standards—did not have perimeter barriers surrounding them as required by the standards; none of the 5 had exceptions. We found that required exceptions for residences were missing for three key reasons. First, posts do not always request exceptions when they are needed. For example, of the 3 posts where off-compound principal officer residences lacked some window grilles, none had requested exceptions to this unmet standard. DS headquarters officials told us that State’s guidance for posts on how to request residential security exceptions has historically been limited and vague, which, according to them, may explain why posts do not always request exceptions when they are needed. In cases where residences acquired since July 1, 2014, did not meet all of the standards issued in May 2014, the lack of exceptions is understandable, given that the posts acquired the residences before being notified of the new standards in October 2014. In other cases, though, the residences in question had been acquired several years or even decades prior, and the standards we found that they were not meeting had also been in existence for years. Second, until recently, State guidance on exceptions did not clearly identify the roles and responsibilities of key offices involved in managing the exception process, leading to confusion within DS headquarters and potentially at posts as well. In 2007, State established FAM guidance identifying an office within DS’s Directorate for International Programs (DS/IP) as the office responsible for managing the residential security exception process. DS officials explained that, in practice, a different office within DS’s Directorate for Countermeasures (DS/C) has handled residential exception requests since the late 1980s and, because of limited staffing in DS/IP, continued to do so even after State guidance named DS/IP as the responsible office in 2007. However, State did not revise the FAM guidance to identify DS/C as the responsible office. Subsequently, in August 2014, DS provided us with a written response stating that, as of that date, it had not received any requests for residential security exceptions. We subsequently learned the written response was drafted by DS/IP, which was unaware that DS/C had been receiving and processing exception requests for residences since the late 1980s. Since that time, the two offices have clarified their roles and responsibilities with respect to residential security exceptions. Specifically, officials told us in April 2015 that DS/C is now handling all exception requests related to setback, while DS/IP is handling all other exception requests. Third, weaknesses exist in DS’s tracking of exceptions. The FAM states that State documentation should be complete to the extent necessary to facilitate decision making. However, we found weaknesses that raise questions about the completeness of DS’s documentation on exceptions. For example, a list DS provided in response to our request for data on all residential security exceptions only shows exceptions to the setback standard. As noted earlier, DS had an exception on file for 1 of the 38 residences we reviewed that did not meet all of the applicable mandatory standards. In reviewing the exception package for that residence, we noted that the post requestedand received approval forexceptions to four different standards. The exception package also lists mitigation actions the post plans to take. DS’s list mentions that an exception was granted to the setback standard, but it does not mention any of the other three standards to which DS granted exceptions or the planned mitigation actions. In addition, while the list DS provided identifies the post that requested each exception, it does not identify the specific residence for which the exception was requested. DS officials stated that in order to identify the specific residence for which a given exception was requested and approved, they would have to locate the paper copy of the exception packagea potentially time-consuming task given that, according to DS officials, the paper copies of residential exception packages are commingled with thousands of exception packages for office facilities dating back as far as 1986. Because of these weaknesses, DS’s list has limited utility in helping DS and posts understand which residences may have security vulnerabilities stemming from unmet standards. While DS is taking steps to improve its guidance and tracking for exceptions, it is unclear if the planned improvements will fully address the factors that have contributed to missing exceptions. DS officials told us that as part of their ongoing update to the Residential Security Handbook, they will be providing additional guidance for RSOs on how to submit requests for exceptions. Since that initiative is still in development, it is too early to assess its effectiveness. Additionally, DS/C officials told us that they have begun converting paper copies of exception packages they have processed to electronic form—a task they estimate will take about 5 months—and both DS/IP and DS/C have developed databases to record exception requests. As noted earlier, the FAM calls for State documentation to be complete to the extent necessary to facilitate decision making; however, neither office currently plans for its database to include all of the exceptions processed by the other office. Consequently, DS may lack a complete picture of all the residential exceptions it has processedvaluable information that could help it better understand the types of security vulnerabilities at residences and thus make better informed risk management decisions. In addition to reviewing residences against the mandatory security standards applicable to them at the time of our visit, we also reviewed them using the new May 2014 standards in order to assess the impact these standards will have on posts, DS headquarters, and future State funding requests. As discussed earlier, by July 2017, all off-compound residences will be required to meet the new standards to address terrorism. If the residences do not meet the standards and cannot be upgraded to meet them, posts will be required to apply for exceptions. DS officials indicated that the new standards are more rigorous than the previous ones and that many existing residences may be unable to meet them. Overall, 55 of the 56 off-compound residences we reviewed did not meet all of the new standards, including 49 residences that did not meet two or more. As a result of the new standards, DS officials expect the need for posts to apply for exceptions to increase. For example, officials at one post told us that they do not believe it will be possible for any of the approximately 300 apartments occupied by U.S. personnel at that post— or for other apartments available at their post—to meet the new mandatory standard of a perimeter barrier surrounding the building. In other cases, it will be possible to upgrade existing residences to meet the new standards, but the associated costs may be considerable. For instance, RSO officials at the post with about 300 apartments stated that they will need to install alarms and residential safe havens to meet the new standards, at a cost of approximately $3,000 per residence. They added that it is unlikely that current landlords will agree to pay for these upgrades. The 2014 Security Environment Threat List indicates that nearly 45 of the 275 U.S. diplomatic posts worldwide have higher threat ratings for terrorism than for political violence and crime and thus will likely have to adopt additional security measures—potentially at significant cost to the U.S. government—in order to meet the new standards to address terrorism. Furthermore, additional upgrades—and thus additional funding—will likely be needed as posts take steps to apply the new standards for existing on-compound housing, which, according to DS officials, are also more rigorous than the standards that preceded them. DS headquarters officials told us that because of our inquiries about the implications of the new standards to address terrorismsuch as the financial cost of meeting themthey had decided to conduct a survey of posts to assess the extent to which each one currently meets the new standards. According to these officials, the results of the survey will help them estimate the cost of upgrades needed to meet the new standards and will provide them with valuable information on the types of vulnerabilities that currently exist at residences. They stated that they anticipate the survey may also help them determine how much time it will take to review and process posts’ requests for exceptions. DS officials added that they plan to send the survey to posts in May 2015. State’s efforts to protect U.S. personnel and their families at schools and other soft targets include funding physical security upgrades, providing threat information and security-related advice, and conducting security surveys of various soft target facilities. However, RSOs at most of the accompanied posts we visited were unaware of some guidance and tools for securing these facilities. As a result, State may not be taking full advantage of its programs and resources for managing risks at schools and other soft targets. State has taken a variety of actions to manage risks to schools and other soft targets. These actions fall into three main categories: (1) funding security upgrades at K-12 schools with enrolled U.S. government dependents and off-compound employee association facilities, (2) sharing threat information and providing advice for mitigating threats at schools and other soft targets, and (3) conducting security surveys to identify and manage risks to schools and other soft targets. First, in 2003, State developed a multiphase initiative known as the Soft Target Program to protect U.S. personnel and their families at schools and off-compound employee association facilities. With respect to schools, the Soft Target Program funds physical security upgrades at existing K-12 schools with enrolled U.S. government dependents. Program funding was initially limited to “American-sponsored” schools that receive State assistance. Subsequently, eligibility for program funding was expanded to non-American-sponsored schools that enroll U.S. dependents or are expected to enroll such students within the next 6 months. In fiscal years 2010 through 2015, State allocated almost $28 million for security upgrades through the Soft Target Program (see table 3). State has used approximately $23.8 million of these allocations to award almost 400 grants for specific upgrades. Of these awards, approximately 97 percent ($23.1 million of $23.8 million) went to schools, with the remaining 3 percent provided for off-compound employee association facilities. According to State documentation, since the Soft Target Program began in 2003, State has provided schools with more than $100 million for physical security upgrades. American-sponsored schools received $63 million of this funding; other schools received the remaining $38 million. At the posts we visited, RSOs had worked with schools to identify physical security needs and obtain funding for upgrades such as walls, guard booths, public address systems, and window grilles. In addition to school security upgrades, we also saw Soft Target Program-funded security upgrades at employee association facilities, such as closed- circuit television systems, perimeter walls, and access control systems. Overall, RSOs and school administrators told us they were pleased with the upgrades. However, State does not operate or control the schools eligible for Soft Target Program upgrades; as a result, the extent to which eligible schools cooperate with posts on security-related issues depends on the willingness of the schools’ administrators. Second, State officials help manage risks to schools and other soft targets by sharing threat information and providing advice on how to mitigate such threats. RSO outreach to schools at the posts we visited included sharing information related to specific threats, such as apprising school administrators about the recent posting on a jihadist website calling for attacks on western-affiliated teachers and schools in the Middle East. In addition, at one post architects designing a new American- sponsored school cited security advice provided by the RSO as the impetus for them to undertake a more security-conscious redesign. RSOs at all the accompanied posts we visited stated that they also share local threat information with schools and others outside the U.S. government. Additionally, RSOs we met with told us that they communicate with security officials at British, Canadian, and other embassies in the area they cover to help deter attacks on soft targets by raising overall threat awareness. Third, RSOs conduct security surveys to help identify and manage risks to schools and other soft targets. Although State does not control schools, hotels, or hospitals overseas, RSOs at all the accompanied posts we visited had conducted security surveys of such facilities. State is currently in the process of developing security standards for off-compound employee association facilities in response to our June 2014 recommendation that State develop physical security standards for facilities not covered by existing standards. Federal internal control standards call for agencies to communicate the information necessary for conducting the agency’s operations to those within the entity responsible for carrying out these activities in a form and time frame that allows them to carry out their responsibilities. State has established guidance for RSOs regarding the security of schools and other soft targets as well as tools to assist RSOs’ security-related outreach with schools, but half of the RSOs we met with at the six accompanied posts stated that the only guidance or tools they were aware of with respect to schools and soft targets was a cable with information on the types of items that can be funded through the Soft Target Program. One post was using an outdated version of this cable. Additionally, two RSOs described the cable as lacking sufficient detail on the specific types of upgrades allowed and disallowed. Additional Soft Target Program guidance does exist in the FAM—including details on grant eligibility and the roles, responsibilities, procedures, and requirements related to project development and implementation—but the relevant FAM subchapter was not mentioned in any of the Soft Target Program cables we reviewed, and no RSOs cited that FAM subchapter as a source of guidance with which they were familiar. OBO officials stated that they believe the Soft Target Program cable provides RSOs with the necessary level of information but noted that they plan to issue an updated version of the cable with additional detail. They also stated that they see value in mentioning the associated FAM subchapter in the updated cable. With respect to tools, in 2008, State’s Office of Overseas Schools, DS, and OBO published a booklet—Security Guide for International Schools— and an accompanying CD to assist international schools in designing and implementing a security program. These are tools that RSOs can offer to all schools—including those otherwise ineligible for upgrades funded by the Soft Target Program. However, RSOs at the majority of the posts we visited were unaware of this security guide, but after we brought it to their attention, some stated that they planned to share it with schools at their posts. Because of limited awareness of the guidance and tools for securing schools and other soft targets, State may not be fully leveraging its existing programs and resources for addressing the security needs of schools and other soft targets. Thousands of U.S. diplomatic personnel and their families live in an overseas environment that presents myriad security threats and challenges. While State has taken significant measures to enhance security at its embassies and consulates since the 1998 East Africa embassy bombings, these same actions have given rise to concerns that would-be attackers may shift their focus to what they perceive as more accessible targets, such as diplomatic residences, schools, and other places frequented by U.S. personnel and their families. We found that State has taken various steps to address threats to residences and other soft targets. For instance, over the last 6 fiscal years, State allocated nearly $200 million for security upgrades for residences, schools, and off- compound employee association facilities, and it has also made efforts to modernize the physical security standards that residences must meet. However, we found vulnerabilities at many of the residences we reviewed and a number of gaps or weaknesses in State’s implementation of its risk management activities. For example, posts do not always complete residential security surveys as required, exceptions are missing for many residences that require them, and DS’s tracking of exceptions is fragmented between two offices. As a result, State lacks full awareness of the vulnerabilities that exist at residences. Similarly, State’s physical security standards and security-related guidance for residences are difficult to use, and awareness of its guidance and tools for schools and other types of soft targets is limited. Each of these issues is problematic on its own, but taken together, they raise serious questions about State’s ability to make timely and informed risk management decisions about soft targets. Until it addresses these issues, State cannot be assured that the most effective security measures are in place at a time when U.S. personnel and their families are facing ever-increasing threats to their safety and security. To enhance State’s efforts to manage risks to residences, schools, and other soft targets overseas, we recommend that the Secretary of State direct DS to take the following five actions: 1. Institute procedures to improve posts’ compliance with requirements for conducting residential security surveys. 2. Take steps to clarify existing standards and security-related guidance for residences. For example, DS could conduct a comprehensive review of its various standards and security-related guidance for residences and take steps to identify and eliminate gaps and inconsistencies. 3. Develop procedures for ensuring that all residences at posts overseas either meet applicable standards or have required exceptions on file. 4. Ensure that DS/IP and DS/C share information with each other on the exceptions they have processed to help DS establish a complete picture of all residential security exceptions on file. 5. Take steps in consultation with OBO to ensure that RSOs are aware of existing guidance and tools regarding the security of schools and other soft targets. For example, DS and OBO could modify the Soft Target Program cable to reference the associated FAM subchapter. We provided a draft of this report for review and comment to State and the U.S. Agency for International Development. We received written comments from State, which are reprinted in appendix II. State agreed with all five of our recommendations and highlighted a number of actions it is taking or plans to take to implement the recommendations. The U.S. Agency for International Development did not provide written comments on the report. We are sending copies of this report to the appropriate congressional committees, the Secretary of State, and the Administrator for the U.S. Agency for International Development. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The objectives of our report were to evaluate (1) how the Department of State (State) assesses risks to residences overseas; (2) the timeliness, clarity, and consistency of State’s security standards for residences; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets overseas. To address these objectives, we reviewed U.S. laws; relevant State security policies and procedures as found in cables, the Foreign Affairs Manual (FAM), and the Foreign Affairs Handbooks (FAH)—in particular, the Residential Security Handbook, Physical Security Handbook, Overseas Security Policy Board (OSPB) standards, and information and guidance related to State’s residential security program and Soft Target Program; the Bureau of Diplomatic Security’s (DS) threat and risk ratings, periodic assessments of post security programs, and residential security exceptions; post-specific documents pertaining to security of residences and other soft targets; classified Accountability Review Board reports and Interagency Security Assessment Team recommendations; and past GAO, State Office of Inspector General, and Congressional Research Service reports. We assessed DS’s risk management practices against its own policies and standards, best practices identified by GAO, and federal internal control standards. Additionally, we reviewed and compared residential security standards and other security-related guidance within the FAM and FAH to evaluate their clarity and consistency. We identified gaps and inconsistencies in relevant standards and security-related guidance for residences in the course of (1) conducting an analysis of the OSPB standards, the Residential Security Handbook, and the Physical Security Handbook to develop our facility review checklists and (2) discussing the guidance with knowledgeable State officials. Because it was beyond the scope of this engagement to systematically review all residential security standards and related guidance for gaps and consistencies, we cannot generalize our findings to all standards and security-related guidance for residences. We also evaluated the timeliness of updates to OSPB residential security standards. To do so, we asked State to identify all updates to the residential security standards since 2005 and to provide information about when the updates started and were completed. We then analyzed how long each update took and compared that against State officials’ expectation of how long such updates should take. In addition to reviewing the documents above, we interviewed officials in Washington, D.C., from DS; the Bureau of Overseas Buildings Operations (OBO); State’s Office of Management Policy, Rightsizing, and Innovation; and the U.S. Agency for International Development. We also traveled to 7 posts and conducted work focused on 3 other posts. Our judgmental sample of 10 posts included nine countries in four of State’s six geographic regions—Africa, the Near East, South and Central Asia, and the Western Hemisphere. Each of the 10 posts was rated by DS as having a high or critical threat level in one or more of the Security Environment Threat List categories of political violence, terrorism, and crime. Additionally, all but 1 of the 10 posts we selected were within the top 75 posts rated by DS as the highest risk worldwide; of the 10, 7 were within the top 50, and 4 were within the top 25. For security reasons, we are not naming the 10 posts in our judgmental sample. Our findings from these posts are not generalizable to all posts. Moreover, our judgmental sample of high-threat, high-risk posts cannot be generalized to other high- threat, high-risk posts. For 2 of the 3 posts in our judgmental sample that we did not visit, we reviewed residential security surveys and spoke with a Regional Security Officer (RSO) regarding residential security measures in place at the posts. For the third post we did not visit, we requested RSO input on recent security upgrades and any remaining vulnerabilities at soft target facilities at post. At the 7 posts we visited, we met with U.S. government officials from State and other agencies involved in securing residences and other soft targets—including RSOs, general services officers, financial management officers, facility managers, and members of post Emergency Action Committees and Interagency Housing Boards—to understand their respective roles related to security of residences and other soft targets and their perspectives on State’s security policies and procedures for these facilities. We also requested residential security surveys for all 68 residences in our judgmental selection. We evaluated the posts’ records of these surveys using the residential security survey requirements outlined in the FAM. Additionally, we reviewed security measures in place at 10 schools attended by U.S. government dependents and 3 off-compound employee association facilities. Of the 10 schools, 6 were “American-sponsored” schools that receive State assistance; the other 4 do not receive State assistance but enroll U.S. government dependents. At the 7 posts we visited, we also evaluated a judgmental selection of 68 residences against applicable security standards. To do so, we first asked DS officials to identify all sections of the FAH that contain residential security standards. Based on DS’s input, we reviewed all of the identified sections and developed checklists of the residential security standards applicable to each of the following residence types: on-compound housing, off-compound apartments, off-compound single family homes, off-compound residential compounds, off-compound Marine Security Guard residences, and off-compound residences for principal officers. The checklist for each residence type included the standards applicable to it as of our fall 2014 visit, and the checklists for off-compound residences also included the new May 2014 standards to address terrorism, which all off-compound residences have to meet by July 2017. As noted earlier in this report, standards also vary by date of construction or acquisition and threat level. We included these variations in each checklist so that for each residence we visited, we could apply the exact standards applicable to it based on its type, its date of construction or acquisition, and the post threat level. Our checklists included mandatory standards worded in terms of measures that “must” be taken as well as other standards, such as measures that are “recommended” or that “should” or will “ideally” be taken, among others. While we used all of these standards to review the residences we visited, the analysis presented in this report only includes mandatory standards worded in terms of measures that “must” be taken. We did not include other standards in our analysis because, as discussed earlier in this report, some of the terminology used in those standards is inconsistent, making it difficult to determine if a given residence is in compliance or not. With regard to the specific 68 residences reviewed, we evaluated the principal officer’s residence at 6 of 7 posts and the Marine Security Guard residence at 5 of 7 posts. The remaining 57 residences in our judgmental selection represented a mix of different types of residences (such as apartments and single family homes), on-compound and off-compound residences, owned and leased residences, older and newer residences, and residences occupied by State officials and non-State officials. Using the checklists that we developed, we reviewed each of the 68 residences against the mandatory standards applicable to it as of our fall 2014 visit; in addition, we reviewed each of the 56 off-compound residences against the mandatory standards in the new May 2014 standards to address terrorism. After completing all 68 checklists, we categorized the mandatory standards into six general categories, which we developed on the basis of our professional judgment as well as our review of the six general categories of security standards presented in our June 2014 reporting on the security of diplomatic work facilities overseas. Each category included one or more mandatory standards. For example, the category of secure building exteriors included mandatory standards calling for features such as lighting; substantial or grilled doors with peepholes and deadbolt locks; and grilles, locks, and shatter-resistant film on accessible windows. For the purposes of our analysis, if a residence did not meet one of more of the mandatory standards in a given category, we classified the residence as not meeting all mandatory standards in that category. We used this methodology to calculate the number of residences that did not meet all mandatory security standards applicable to them as of fall 2014 within each security standard category. We used the same methodology to calculate the number of off-compound residences that did not meet all mandatory standards within each category of the new May 2014 standards to address terrorism. To determine the reliability of the data we collected on overseas residences and funding for security upgrades to residences, schools attended by children of U.S. government personnel, and off-compound facilities of employee associations, we compared information from multiple sources, checked the data for reasonableness, and interviewed cognizant officials regarding the processes they use to collect and track the data. We evaluated the reliability of OBO’s data on overseas residential properties by comparing records for specific residences from OBO’s system with information we collected during site visits to these residences and discussions with OBO and post officials. We evaluated the reliability of the funding data we collected by comparing the data against prior GAO reporting and by interviewing DS and OBO officials familiar with State’s financial management system to ask how the data are tracked and checked for accuracy. On the basis of these checks, we determined that the data we collected on overseas residences and funding were sufficiently reliable for the purposes of this engagement. We conducted this performance audit from July 2014 to June 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Thomas Costa (Assistant Director), Joshua Akery, Amanda Bartine, John Bauckman, Tina Cheng, Aniruddha Dasgupta, David Dayton, Martin De Alteriis, Jonathan Fremont, Grace Lui, and Candice Wright made key contributions to this report.

Summary: Since the 1998 East Africa bombings, U.S. diplomatic personnel working overseas have faced increasing threats to their safety and security. State has built many new embassies and consulates since 1998 and enhanced security measures at others. Increased security at such facilities has raised concerns that residences, schools, and other places where U.S. diplomatic personnel and their families congregate may be viewed by terrorists as more attractive “soft targets.” GAO was asked to review the security of residences and other soft targets overseas. GAO evaluated (1) how State assesses risks to U.S. diplomatic residences overseas; (2) the timeliness, clarity, and consistency of residential security standards; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets. GAO reviewed agency documents; met with officials in Washington, D.C.; and conducted fieldwork at a judgmental sample of seven higher-threat, higher-risk posts in four of State's six geographic regions. This is the public version of a sensitive but unclassified report issued in June 2015. The Department of State (State) conducts a range of activities to assess risks to residences overseas. For instance, State tracks information on overseas residences in its property database, establishes threat levels at overseas posts, develops security standards for different types of residences and threat levels, and requires posts to periodically conduct residential security surveys. However, 17 of the 68 surveys for residences GAO reviewed were untimely or missing. Without up-to-date security surveys of all its overseas residences, State's ability to identify and address vulnerabilities or make informed decisions about where to allocate resources for security upgrades is limited. State has taken steps to update its residential security standards; however, these updates have not been timely, and the standards are difficult to use. According to State officials, updating residential security standards should take about 75 days, but all three updates since 2005 took more than 3 years each. State is making efforts to improve the timeliness of such updates in response to a prior GAO recommendation. In addition, while federal internal control standards state that policy standards should be clear and consistent to support good decision making, State's standards and other security-related guidance for residences have gaps and inconsistencies, complicating posts' efforts to determine and apply the appropriate security measures and potentially leaving some residences at risk. State addresses security vulnerabilities at residences by installing various upgrades intended to help residences meet security standards, but 38 of the 68 residences GAO reviewed did not meet all applicable standards. For example, 8 residences did not meet the standards for perimeter barriers. When residences do not and cannot meet all applicable security standards, posts are required to request exceptions, which identify steps the posts will take to mitigate vulnerabilities. However, State had an exception on file for only 1 of the 38 residences that did not meet all applicable standards. As a result, State lacks key information that could provide it with a clearer picture of security vulnerabilities at residences and enable it to make better risk management decisions. State manages risks to schools and other soft targets overseas in several ways, but its efforts may be constrained by limited awareness of relevant guidance and tools. In fiscal years 2010 through 2015, State awarded almost 400 grants in total for security upgrades at schools and other soft targets. While federal internal control standards call for timely communication of relevant information to staff responsible for program objectives, officials at most of the posts GAO visited were unaware of some guidance and tools for securing schools and other soft targets. As a result, State may not be fully leveraging existing programs and resources for addressing security needs at these facilities. GAO recommends that State, among other things, institute procedures to ensure residential security surveys are completed as required, clarify its standards and security-related guidance for residences, develop procedures to ensure residences either meet standards or have exceptions on file, and take steps to ensure posts are aware of existing guidance and tools regarding the security of schools and other soft targets. State concurred with all of GAO's recommendations.