HHS’ ability to use the Special Reserve Fund for the procurement of countermeasures is predicated on a six-step process involving coordination with DHS and approval by the Director of the Office of Management and Budget (OMB). As provided in the BioShield Act, the process requires: 1. the DHS Secretary, in consultation with the HHS Secretary and the heads of other agencies as appropriate, to determine that a material threat exists and issue a “material threat determination;” 2. the HHS Secretary to determine countermeasures that are necessary to protect the public health; 3. the HHS Secretary to determine that a particular countermeasure is appropriate for procurement for the Strategic National Stockpile using the Special Reserve Fund and the quantities to be procured; 4. the DHS and HHS Secretaries to jointly recommend to the Director of OMB that the Special Reserve Fund should be used for the designated countermeasure acquisitions; 5. the director of OMB to approve the use of the Special Reserve Fund; 6. both Secretaries to notify designated congressional committees of the procurement. The BioShield Act also provides HHS the ability to use four new contracting authorities for the acquisition of countermeasures. In general, these authorities expanded upon existing provisions in the Federal Acquisition Regulation (FAR). The four authorities are: Simplified acquisition procedures which, in general, increased HHS contract threshold amounts from $100,000 to $25 million. However, the BioShield Act does not place a threshold limit on countermeasures that are procured using the Special Reserve Fund if the HHS Secretary determines there is a pressing need for the specific countermeasure. Procedures other than full and open competition can be used to award contracts when the requirement is only available from one responsible source or a limited number of responsible sources. In addition, in order to conduct procurements on a basis other than full and open competition using simplified acquisition procedures, the HHS Secretary must determine that the mission of the BioShield Program under the Act would be seriously impaired without such a limitation. Increased micropurchase threshold from $2,500 to $15,000. Personal services contracts may be used for experts or consultants who have scientific or other professional qualifications when the HHS Secretary determines such contracts are necessary to respond to pressing countermeasure research and development needs. In 2006, the Pandemic and All-Hazards Preparedness Act (PAHPA), among other things, established the Biomedical Advanced Research and Development Authority (BARDA), within HHS, to provide a coordinated, systematic approach to the development and purchases of countermeasures, including vaccines, drugs, therapies, and diagnostic tools. Later, in 2009, Congress transferred the following amounts from the Special Reserve Fund to HHS accounts: $275 million to be used for the advanced research and development of countermeasures and $137 million for influenza pandemic preparation. HHS has used its Special Reserve Fund (purchasing) authority and one of its contracting authorities to procure countermeasures for the Strategic National Stockpile. Since 2004, HHS awarded nine contracts using Special Reserve Fund monies to procure various countermeasures, such as anthrax and botulism antitoxins, vaccines for anthrax and smallpox, and post-exposure treatments for radiation poisoning in children and adults. Of the nine contracts awarded using monies from the Fund, HHS terminated one contract, in 2006, because the contractor was unable to meet a major contractual milestone. To date, the remaining eight contracts are valued at almost $2 billion. See table 1. In addition, HHS officials told us there are currently two requests for proposal solicitations for an anthrax vaccine and a smallpox therapeutic. Of the four contracting authorities provided under the BioShield Act, HHS has only used the simplified acquisition procedure authority. From 2004 through 2005, HHS’s National Institutes of Health (NIH) used this authority to award five other contracts, including ones for research to develop a botulism antitoxin and improved treatments for radiation poisoning. Awarded with NIH funding, these contracts have a total value of almost $30 million when options and other later modifications are included. See table 2. HHS officials told us that they have not used this authority since 2005. HHS officials also told us that no other BioShield contracting authorities have been used to date, although the officials noted that these authorities may be needed for use in the future. In response to BioShield requirements, HHS has established internal controls on its Special Reserve Fund (purchasing) and contracting authorities, but lacks adequate documentation of the risks of using the new contracting authorities. Language in the BioShield Act sets up a broad framework of controls over the procurement of countermeasures, including those with Special Reserve Funds, by requiring HHS to coordinate with DHS and obtain approval by OMB before the Fund may be used. In addition to the language in the Act, HHS officials told us that the internal controls for procuring countermeasures using the Fund are documented in a variety of internal policy and procedure documents and interagency agreements, which provide guidance on roles and responsibilities for how the controls are to be implemented. These documents include: an HHS policy document that establishes an enterprise governance board to oversee requirements and priority-setting regarding emergency medical countermeasures for the civilian population. The document also outlines the authorities, organizational structure, and guidelines for the board; an HHS budget execution document that delineates responsibilities and describes the processes for requesting contract actions, purchases, and interagency agreements; a BARDA standard operating procedure document that provides contracting and other BARDA officials with guidance on source selection procedures and outlines specific responsibilities in carrying out those procedures; a BARDA acquisition plan which details the pre- and post-award approval processes for procurements using the Fund; an interagency agreement between HHS and DHS dated September 25, 2006, that outlines the terms and conditions for when the Fund can be used; and an OMB Circular on transferring budget authority from one agency to another. HHS has also established internal controls for the contracting authorities that were specified in the BioShield Act. On October 18, 2005, HHS issued a memorandum that provided guidance on the use of the following contracting authorities: the increased simplified acquisition threshold and its use with the Special Reserve Fund, the increased micropurchase threshold, and the use of personal services contracts. HHS’s memo is structured around the five elements of internal control: the control environment, risk assessment, control activities, information and communications, and monitoring. Federal internal control standards state that management needs to comprehensively identify risks, analyze them for possible effect, and determine how risks should be managed. Federal internal control standards also state that controls need to be clearly documented, readily available for examination, and distributed in a form and time frame that permits people to perform their duties efficiently. Risk assessment statements we reviewed in the memo are generally not assessments of the risks involved in using particular authorities. Some of the risk statements identify some risks and one mentions possible negative consequences that could occur without proper controls in place, but the statements lack an analysis of those risks. For example, the risk assessment statement for using the increased micropurchase threshold states that “control procedures are necessary to prevent noncompliance with specific requirements of the Act, including exceeding statutory limitation on number of contracts and selections based on improper criteria.” And, the risk assessment statement on increased simplified acquisition procedures does not mention or assess risk. It simply states that “control procedures are necessary to prevent noncompliance with specific requirements of the Act.” In particular, the risk statement on simplified acquisition procedures in the memo does not discuss a key risk associated with using simplified acquisition procedures—namely, that an agency is prohibited from obtaining cost or pricing data for acquisitions at or below the simplified acquisition threshold. According to a senior BARDA procurement official, while using simplified acquisition procedures can expedite the procurement process, the agency will not have cost and pricing data, which may be needed to determine that the price of a contract—especially those valued in the tens of millions or hundreds of millions—is fair and reasonable. In a subsequent meeting, he stated that he is aware of these trade-offs based on his own experience and knowledge of the FAR. He also confirmed that an explanation assessing the trade-offs and risks involved when using the new contracting authorities is not contained in other HHS documents. Instead, this official acknowledged that HHS’s written guidance on the controls for the contracting authorities does not document known risks and trade-offs of using the authorities. As a result, implementation of these controls depends on the experience and knowledge of current personnel. Moreover, the consistent application of these controls is not likely to be sustained over time as employees leave their positions and new ones take their place. Not having adequately documented and appropriately communicated risk assessments, which institutionalize agency policies, may potentially result in future employees not knowing or understanding the risks or tradeoffs involved in using the various contracting authorities. Since the enactment of the BioShield Act in 2004, HHS has awarded almost $2 billion in contracts to either procure medical countermeasures or to facilitate their development. Although HHS has established internal controls for its new purchasing and contracting authorities, the risk assessment statements related to the agency’s internal controls for the contracting authorities are not sufficiently specific. In particular, the failure to mention and lack of analysis of specific risks in the risk statements associated with using the increased micropurchase threshold and increased simplified acquisition procedures is not consistent with requirements under federal internal control standards. With employee turnover, the lack of adequately documented risk assessment statements could create a situation in which employees do not know the risks or trade-offs involved in using the various authorities. The effectiveness of the internal controls now in place is dependent on the knowledge of individuals currently working at the agency. Without appropriately documented risk assessments that institutionalize agency policies, HHS will be unable to ensure that sound, informed, and consistent decisions will be made in the face of employee turnover. We recommend that the Secretary of Health and Human Services include comprehensive risk assessment statements in written guidance on the internal controls for the BioShield contracting authorities for which the agency was required to establish controls. HHS provided us with written comments on a draft of this report. The comments appear in appendix I. HHS agreed with our recommendation and said that it will revise its internal control guidance on risk assessments for using BioShield contracting authorities. We believe that this is a positive step toward helping ensure that sound, informed, and consistent risk assessments will be made in BioShield acquisitions. HHS also provided observations on the Special Reserve Fund and risk assessments, which appear in appendix I. We are sending copies of this report to the Secretary of Health and Human Services. The report is also available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or NeedhamJK1@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. In addition to the contact named above, Carol Dawn Petersen, Assistant Director; Angela D. Thomas, Kelly Bradley, Robert S. Swierczek, Marie P. Ahearn, and Kenneth E. Patton made key contributions to this report.

Summary: The Project BioShield Act of 2004 (BioShield Act) increased the federal government's ability to procure needed countermeasures to address threats from chemical, biological, radiological, and nuclear agents. Under the BioShield Act, the Department of Health and Human Services (HHS) was provided with new contracting authorities (increased simplified acquisition and micropurchase thresholds, and expanded abilities to use procedures other than full and open competition and personal services contracts) and was authorized to use about $5.6 billion in a Special Reserve Fund to procure countermeasures. Based on the BioShield Act's mandate, GAO reviewed (1) how HHS has used its purchasing and contracting authorities, and (2) the extent to which HHS has internal controls in place to manage and help ensure the appropriate use of its new authorities. To do this work, GAO reviewed contract files and other HHS documents, including internal control guidance, which GAO compared with federal statutes and federal internal control standards. Since 2004, HHS has awarded nine contracts using its Special Reserve Fund (Fund) purchasing authority under the BioShield Act to procure countermeasures that address anthrax, botulism, smallpox, and radiation poisoning. HHS may procure countermeasures that are approved by the Food and Drug Administration and ones that are unapproved, but are within 8 years of approval. Of the nine contracts, one was terminated for convenience and the remaining eight are valued at almost $2 billion. HHS officials told GAO that additional contracts are likely to be awarded in the near future as the Fund provides funding through fiscal year 2013. In addition, HHS has used one of its new contracting authorities, simplified acquisition procedures, although it has not used this authority since 2005. HHS has established internal controls on its new purchasing and contracting authorities. In addition to the language in the BioShield Act, which sets up a broad framework of controls over the use of the Special Reserve Fund, the internal controls for this purchasing authority are documented in a variety of internal policy and procedure documents and interagency agreements, which provide guidance on roles and responsibilities for how the controls are to be implemented. In response to BioShield Act requirements, HHS also established internal controls for three of the contracting authorities: the increased simplified acquisition threshold and its use with Special Reserve Funds, the increased micropurchase threshold, and the use of personal services contracts. Federal internal control standards state that, among other things, management needs to comprehensively identify risks, analyze them for possible effect, and determine how risks should be managed. Although some of the risk statements in a memo HHS issued identify some risks and one mentions possible negative consequences that could occur without proper controls in place, the risk statements for using the increased micropurchase threshold and increased simplified acquisition procedures lack analysis of specific risks. In particular, the memo does not discuss a key risk associated with using simplified acquisition procedures--namely, that an agency is prohibited from obtaining cost or pricing data for acquisitions at or below the simplified acquisition threshold. Without this data, the agency may not be able to determine if the price of a contract is fair and reasonable. Moreover, not having adequately documented and appropriately communicated risk assessments potentially results in future employees not knowing or understanding the risks or trade-offs involved in using the authorities. With employee turnover, HHS' reliance on the knowledge of current personnel to appropriately implement key controls will not enable future employees to make sound, informed, and consistent decisions.