and individuals made by an employee who believes he or she has witnessed certain wrongdoing, such as gross mismanagement Reprisal Complaint: Following a disclosure, a complaint that an employee has experienced reprisal as a result of the disclosure, such as demotion or discharge. For contractor and grantee employees at NASA, whistleblower protections have changed over time. For example, by statute, in 2007, NASA contractor employees were protected against reprisal if they disclosed information relating to a substantial violation of law related to a contract. However, in 2008, amendments to the whistleblower statute provided protections only to those contractor employees at NASA who reported “a substantial and specific danger to public health or safety.” In 2013, the statute was amended again to include disclosures of gross mismanagement of a NASA contract or grant, a gross waste of Administration funds, and abuse of authority relating to a NASA contract or grant, or a violation of law, rule, or regulation related to a NASA contract or grant. In 2014, the statute was further amended with the only significant change to protect grantee and subgrantee employees. See table 1 for detailed description of the 2008, 2013, and 2014 amendments of the statute. Under the current statute, the NASA Office of Inspector General and Administrator have different responsibilities. Since the 2014 amendments, contractor, subcontractor, grantee, and subgrantee employees are protected from reprisal if they disclose to certain persons or bodies information they reasonably believe is evidence of gross mismanagement of a federal contract or grant, a gross waste of federal funds, an abuse of authority relating to a federal contract or grant, a substantial and specific danger to public health or safety, or a violation of law, rule, or regulation related to a federal contract or grant. Additionally, contractor employees may make whistleblower disclosures to several entities, including a management official at the contractor. Figure 1 depicts the disclosure process and the complaint process. NASA OIG Role: Upon receiving a reprisal complaint, the OIG must evaluate whether a reprisal complaint is covered under the statute. In addition to the steps described in figure 1 for investigating complaints, there are instances when the OIG does not investigate. The OIG might not investigate for a variety of reasons, such as in cases where the complaint is already under investigation by another authority such as another OIG, or otherwise does not allege a violation of the law, such as if whistleblower disclosure does not constitute gross fraud, waste, abuse or mismanagement. If the OIG determines the case is not covered under the statute, it may then notify the complainant that no further action will be taken on the reprisal complaint. Administrator Role: Upon receipt of the NASA OIG investigation report, the NASA Administrator (the head of agency) has 30 days to determine whether the contractor made a prohibited reprisal and issue an order denying or granting relief. According to NASA officials, during the 30-day period after the agency head receives the OIG report, the agency practice has been to ask the OIG for any additional investigative work and also afford the complainant and the contractor an opportunity to submit a written response to the OIG report. Any person adversely affected or aggrieved by the administrator’s order may, within 60 days of issuance, obtain a limited review by the U.S. circuit court of appeals. Agency Procurement Official Role: Under the NFS regulations, NASA contracting officers are also responsible for inserting an NFS whistleblower clause into applicable contracts that requires contractors communicate to their employees their rights under the statute. The NFS whistleblower clause lays out the responsibility of contractors to communicate to their employees their rights under the statute, in writing and in their predominant native language. All contracts over the simplified acquisition threshold awarded on or after July 29, 2014, require a whistleblower clause. The statute also requires NASA to make best efforts to include a clause providing for the applicability of the 2013 amendments in contracts awarded before July 1, 2013—the effective date of the 2013 amendments—that have undergone major contract modifications. The terms “best efforts” and “major modifications” are not defined in the statute. Unlike provisions affecting contractors, the statute does not require NASA to ensure that grantees or subgrantees notify employees in writing of their rights under the statute. From 2008 to June 2017, NASA OIG addressed whistleblower reprisal complaints within required time frames, according to OIG officials. At the time we initiated this review, the OIG’s guidance for handling reprisal complaints had been updated to reflect most statutory changes; however, it did not include guidance regarding subgrantees. During the course of our review, the OIG updated the investigation guidance in October 2017 to include subgrantee employees. NASA OIG completed 6 reprisal investigations within required time frames. The OIG received 277 whistleblower disclosures leading to 48 reprisal complaints from 2008 through June 2017, and handled those complaints within required time frames, according OIG officials. For the 6 of those reprisal complaints that were investigated, the OIG used extensions. OIG officials said that extensions may be necessary for a number of reasons, including that the complaint may be highly technical in nature, requiring the OIG to find subject matter expertise to better understand the nature of the whistleblower complaint and whether it constitutes gross fraud, waste, abuse, or mismanagement. When the OIG receives a reprisal complaint, complainants are asked to fill out a whistleblower complaint form and an investigation is initiated. See figure 2 below for the process by which the OIG conducts its investigations. In addition, there were 5 complaints currently under investigation and 37 complaints during this time frame that the NASA OIG did not investigate because the OIG deemed them to be frivolous, determined they were not covered under the statute, or the complaint was handled in another forum, such as the court system or by another OIG. Complaints were deemed frivolous for several reasons, including if the complainant did not want to disclose his or her identity and proceed with the claim, or the whistleblower disclosure happened after the reprisal. OIG officials told us that when cases are disposed of without an investigation, the OIG notifies the complainant of the decision in writing. Figure 3 shows the disposition of the 48 reprisal complaints received from 2008 through June 2017. The OIG has developed guidance for conducting investigations, which includes a chapter on contractor and grantee whistleblower reprisal complaints. Although most changes to the statute (such as to whom reprisal may be reported) had been incorporated into the investigation guidance, the initial guidance provided to us by the OIG did not include a 2014 statutory requirement to extend protections to subgrantees. During the course of our review, in October 2017, the OIG updated its guidance for investigating reprisal complaints to include subgrantee employees. Because subgrantees are now protected by statute, including them in the investigation policy will help ensure they are consistently extended protections through OIG investigations. In addition to its guidance, OIG officials said they have developed training specific to whistleblower investigations for new investigators, conducted internal training for investigators, and external training for contractor employees. Additionally, the OIG Investigators’ Central Field Office conducts periodic training for investigators that includes any updates to whistleblower protections. With regard to external training, the OIG officials said that investigators at some of the NASA centers—with the largest contract activity—have conducted on-site training for some contractors. This training is conducted as part of general fraud awareness training. The Administrator failed to meet the required review time frame and issue an order of final determination of reprisal for 5 completed investigations received from the OIG from 2008 through June 2017. In all 5 cases, the Administrator took longer than the 30 days to issue an order. In one of those 5 complaints, an official from the Office of General Counsel was unable to provide us with the issued order and said he did not believe one was completed, and could not provide an explanation as to why an order was not completed. For the 5 reprisal complaints, figure 4 shows the number of days from when the Administrator received an OIG report of findings to the time when an order of final determination was documented. In addition to the 5 complaints mentioned above, there was another OIG investigation of a reprisal complaint that did not require response from the administrator within 30 days, but was finalized within our review time frame, for a total of 6 completed OIG investigations of reprisal complaints. For 3 of the 6 complaints, the OIG found that reprisal had occurred and reported those findings to the administrator for final determination of reprisal. The Administrator determined that none of these 3 complaints qualified for protection under the law. For 2 of these complaints, the Administrator found that they did not qualify for protections because they fell under the 2008 version of the statute and failed to allege a violation specific to public health and safety. In 2017, a court affirmed the Administrator’s position. For the third complaint, the Administrator determined reprisal could not be substantiated due to the complainant not meeting the standards of evidence under the statute. Further, we found that NASA does not have a standard process in place for the Administrator to review cases that qualify for protections under the statute and issue an order of final determination. According to an official from the Office of General Counsel, the agency has no standard process to ensure the contractors are afforded due process, among other things. The official from Office of General Counsel said the Administrator may need to conduct an additional investigation in some cases. He said that each case is different and would have to be handled on a case by case basis. In addition, the official said the Administrator may need to conduct hearings, independent of the OIG. Moreover, the official from Office of General Counsel highlighted concern that the Administrator’s office does not have the resources to conduct additional investigative work, which he said is a key contributor for the office’s inability to meet the 30-day timeline to issue an order of final determination. Despite acknowledging these challenges, the Administrator does not have a formal process or criteria to monitor and evaluate the way the office handles issuing an order of final determination of reprisal to ensure that it meets the statutory time requirements. Because the Administrator took longer than 30 days to respond to all reprisal complaints, including one where the Office of General Counsel failed to provide evidence that the Administrator responded at all, there may be the unintended consequence of disincentivizing future whistleblowers from making disclosures who fear their complaint will not be handled timely. Internal controls require that management should establish and operate monitoring activities to monitor the internal control system, evaluate the results, and take appropriate action to address issues on a timely basis. Without monitoring, evaluating, and taking appropriate corrective action based on the way the Administrator or his or her designee makes a final determination of reprisal, there is no assurance that whistleblower reprisal complaints will be handled within required time frames in the future. In almost all of the contracts we reviewed, NASA had met its obligation to ensure its contractors are communicating whistleblower protections to their employees through a whistleblower contract clause. We also found that NASA has put in place guidance to its contracting workforce on the protections, and guidance on when to include the whistleblower clause in contracts. However, we found that some NASA officials have interpreted this guidance differently. Further, NASA’s guidance does not reflect an agency-wide policy on when to include the whistleblower clause when modifying a contract. In most cases, NASA included a clause regarding whistleblower reprisal protections in applicable contracts to ensure contractors communicate rights to its employees. But we found that the clause was not included in all relevant contracts in our review. Based on our review of a generalizable sample of contracts, we estimate that 98 percent of contracts would be expected to include a whistleblower clause at the time new contracts were awarded in applicable contracts in 2016, and 2 percent would not. Within our sample, 4 contracts did not have a whistleblower reprisal clause. After we shared our contract file review findings with NASA officials, they modified 3 of the 4 contracts to include the missing required whistleblower clause. For the remaining contract, the contractor performance was complete, the contract had been closed, and no further action will be taken. According to NASA procurement officials, human error, combined with its former contract writing system, could explain why the contracts in our sample did not have the required clause. They explained that the former contracting writing system relied on templates and did not automatically include the NFS clause into all contracts. Under this system, contracting officers used templates that included a list of all potential or applicable NFS and FAR clauses, which are incorporated through a manual process. Officials said that if a clause were included in the templates, it is unlikely that it would be removed because doing so would require supervisory approval. NASA procurement officials told us that the agency launched a new contract writing system in June 2017. They said that under the new contract writing system, contracting officers use a logic system that prepopulates each contract with required clauses. They said that the new automated system will likely lead to fewer human errors because inserting the clause will not be a manual process. Because the new system is still being implemented, we were unable to evaluate whether the risk of human error has been reduced or eliminated to ensure applicable contract awards have the clause. Under the previous and current systems, NASA contracts are to undergo various levels of review prior to award—including attorney review—at the centers or headquarters based on risk level and dollar thresholds. For example, contracts awarded by JSC valued at over $50 million are to be reviewed by headquarters. NASA procurement officials stated that they conduct procurement management reviews, and centers conduct annual self-assessments; however, at one center, officials pointed out that these reviews have not previously included whether a whistleblower clause is included in new contracts or major modifications. They said this is because reviews typically focus on known issues or program risk, and inclusion of the whistleblower clause has not been previously identified as an issue or risk. Contractors we spoke with were generally aware of their responsibilities to communicate reprisal protections to their employees because their contracts with NASA included the required NFS whistleblower clause. In response to our review, NASA procurement officials said they plan to include a review of the inclusion of NFS whistleblower clause in future compliance reviews as an area of emphasis and will instruct centers to include whether the clause is included in applicable contracts as part of the centers’ self-assessment process. Three elements of NASA’s whistleblower reprisal protection guidance—its procurement notice, NFS clause, and definition of major modification— contribute to potential confusion or inconsistent application of whistleblower reprisal protections. First, in July 2014, NASA notified its contracting officials of the changes to the NFS required by the 2013 amendments to section 2409 Title 10 of the U.S. code through a procurement notice 04-80, but this notice has been interpreted differently by officials in NASA Headquarters, a NASA center, and the OIG. Procurement notices are drafted by NASA Headquarters, reviewed and approved by NASA general counsel and NASA’s Office of Procurement. The NASA centers, acting through their procurement offices and, as needed their legal counsel, review and implement the notices. After the procurement notice was issued, some NASA officials interpreted it differently. For example, in one instance, a NASA center Chief Counsel’s office attorney advised a center procurement official that reprisal protections found in the 2013 amendments extend to contractors’ employees working on contracts awarded before the effective date of the amendments. This is true, he said, regardless of whether the contract contains any clause explicitly making the 2013 amendments applicable. However, both the OIG and the Administrator’s counsel have expressed a different understanding of the statute conveyed in the notice, stating that a clause making the 2013 amendments applicable must be in a contract in order for the complainant to be protected under the statute. Later, the attorney from the center Chief Counsel’s office revised his understanding of the statute and concluded the procurement notice was not accurate as written. Second, NASA personnel have different understandings about whether the NFS clause is sufficient for contractor employees to be covered by the statute. The NFS clause instructs contractors to inform their employees in writing of contractor whistleblower employee rights; but, unlike the FAR clause that is used to implement similar legislation for other agencies, the NFS clause does not state that employees working on the contract are subject to the whistleblower rights and remedies. The attorney from a NASA center said that the NFS clause is enough to ensure contractor employees are given rights under the statute. However, OIG officials have said that without including that element of the clause, employees working under NASA contracts awarded prior to the effective date of the 2013 amendments may not be covered by those amendments. See table 2 for description of the clauses and their differences. Third, the lack of agency-wide guidance for when to include the clause in major modifications leads to different implementation of the requirement. The 2013 amendments require that NASA makes best efforts to include a whistleblower clause in contracts undergoing a major modification. NASA’s July 2014 procurement notice also encourages contracting officers to include the NFS whistleblower clause when issuing major modifications to contracts awarded before July 29, 2014. However, it does not specify what a major modification is under this statute, and the statute itself does not define “major.” According to NASA procurement officials at headquarters and at two NASA centers, it is at the discretion of the NASA Centers’ offices of procurement and contracting officers to decide if a clause is inserted into modifications, and whether they are considered major. Procurement officials and the contracting officers we spoke with told us that there is no definition of major modifications in the law, regulation, or NASA Headquarters or Center policies or guidance. NASA procurement officials said this is because it could be different for each contract and the contracting officer makes the determination based upon the facts related to the situation. Nevertheless, without communicating the factors to consider when determining whether a modification is major and whether that contract should or should not include the clause, NASA and the Centers’ procurement officials are at risk of potential inconsistent incorporation of the clause among applicable contracts. One attorney in NASA’s General Counsel’s Office said there may be costs associated with asking a contractor to insert new clauses—such as the whistleblower clause—into an existing contract during a major modification because it would require a bilateral negotiation between the contractor and the agency. However, one contractor we spoke with said that there would be no cost to adding the clause and that doing so would not be an issue because the whistleblower clause is consistent with the internal whistleblower policies and practices of the institution. Further, he said that the institution he represents would be hesitant to argue against inclusion of the NFS clause in its contracts with NASA. Internal control standards require that an entity should internally communicate necessary quality information in order to meet requirements of the mission. These 3 areas of potential confusion related to NASA’s current guidance could result in different application of the law, unless they are clarified. Although whistleblower protections are now extended to grantee employees by statute, NASA does not have a mechanism in place to communicate the protections to grantees or subgrantee employees. Unlike the requirement for NASA to ensure contractors communicate whistleblower reprisal rights to their employees in writing and in the employees’ predominant language, the statute does not prescribe a similar requirement for NASA to ensure that grantees communicate whistleblower reprisal rights to their employees. During the grant application process, NASA requires grantees to attest that they will not require grantee employees to sign confidentiality agreements that would prohibit them from reporting fraud, waste, and abuse. NASA officials said that grant awards do not include a mechanism, such as a term or condition, to encourage NASA grantees to notify their employees of their whistleblower reprisal protections. In the 10 NASA grants from fiscal year 2016 that we reviewed, there was no requirement included for grantees to communicate these protections to employees. However, we found that all 10 grants included a statement that each award was subject to all applicable laws and regulations of the United States in effect on the date of award, including the Uniform Guidance. For federal grants in general, the Uniform Guidance provides a government- wide framework for grants management. Within this guidance, there is a reference to the whistleblower protections in the statute; however, it does not explicitly describe the statute’s requirements. The grant advocacy group and representatives of three NASA grantees we spoke with were aware that some protections exist and noted that many grantees have their own whistleblower policies, but were not aware of the specific protections provided by the statute, which indicates that opportunities exist for improving communications between NASA and its grantees about these protections. Further, representatives of the grant advocacy group noted that the whistleblower protections for grantee employees were not specifically mentioned at recent annual meetings where grantees and federal officials discuss issues that affect grantees. Internal controls require that management externally communicate the necessary quality information to achieve the entity’s objectives. Without additional communication about the protections provided by the statute, grantees may not fully understand or appreciate the significance of the rights afforded to their employees, and grantee employees may not be aware of their whistleblower reprisal protections, which could hinder their willingness to report instances of fraud, waste, and abuse. Because contractor and grantee employee whistleblowers risk reprisal after disclosing potential fraud, waste, abuse and mismanagement, ensuring they are protected from retaliation or adverse consequences is critical. Without monitoring and evaluating the timeliness of reviewing and responding to reprisal complaints, the Administrator may not be prepared to determine reprisal on future cases within the statutorily required 30 days. Additionally, although NASA has developed guidance related to contractor protections, this guidance has led to inconsistent interpretation of the law and could potentially lead to inconsistent application of how contractor protections for employees are conveyed. More clear guidance would help contracting officers determine when to incorporate the NFS clause into major modifications to ensure consistency throughout the agency. Finally, because unlike contracts, there is no similar clause for grants, NASA is in the position to help ensure grantees know their employees’ rights against reprisal if they observe and disclose fraud, waste, abuse or mismanagement. However, NASA has not effectively communicated to grantees information about these provisions and as a result grantees and their employees may not be fully aware of these protections. Consequently, if they witness fraud, waste, abuse or mismanagement, they may not be willing to disclose those for fear of reprisal. We are making three recommendations to NASA: The Administrator should monitor, evaluate, and make appropriate corrective actions, such as a documented process, to ensure it reviews reprisal complaints in a timely manner. (Recommendation 1) The Administrator should review NASA’s guidance or develop other guidance, including defining major modification, to clarify when whistleblower protections are conveyed. (Recommendation 2) The Administrator should communicate whistleblower protections to grantees and subgrantees and their employees. (Recommendation 3) We provided a draft of this product to NASA for review and comment. NASA provided written comments on a draft of this report. In its written comments, reprinted in appendix II, NASA concurred with all three recommendations. In its response to our recommendations NASA agreed to develop and document a process to ensure it reviews reprisal complaints in a timely manner to ensure all parties’ due process rights are protected, review existing procurement policy and clarify guidance as appropriate, and update NASA grant guidance to communicate whistleblower protections to grantees, sub-grantees and their employees. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees and members. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or oakleys@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. To assess the extent to which National Aeronautics and Space Administration’s (NASA) Office of Inspector General (OIG) has investigated contractor and grantee whistleblower reprisal complaints and developed guidance for the investigations, we reviewed data provided by the NASA OIG on the total number of whistleblower allegations of fraud, waste, abuse, misconduct, or mismanagement and reprisal claims. We also reviewed the number of contractor and grantee employee whistleblower allegations and reprisal complaints provided by the OIG and the outcomes or decisions reached by the OIG of a reprisal complaint from fiscal years 2008 through 2017. We assessed the reliability of these data by asking the NASA OIG to describe the source(s) of information used and steps taken to identify the numbers provided, and limitations and caveats that would affect GAO’s use of the data—such as the data being self-reported by the OIG and Office of General Counsel. Based on these steps, we determined the data to be sufficient for our purposes of determining how the complaints were addressed. Additionally, we reviewed relevant documentation to assess the extent to which the NASA OIG was conducting investigations and communicating findings to the NASA Administrator within required time frames. To determine the extent NASA OIG developed guidance, we interviewed or obtained written answers from OIG officials about their processes and practices for investigating whistleblower reprisal complaints. We reviewed the guidance and training and other materials that NASA OIG uses to implement whistleblower protection investigations. We also visited Johnson Space Center (JSC)—selected because it had the highest number of reprisal cases from 2008 through 2017—to discuss policies and procedures specific to that center with OIG investigators and the OIG program manager for whistleblower protections. Because they are also a part of the Investigators’ Central Field Office, we also spoke with investigators at Marshall Space Flight Center and Kennedy Space Center. To assess the extent to which NASA’s Administrator meets the statutory timeliness requirements to review reprisal complaints, we reviewed the timeliness of the Administrator’s final determination to ensure that NASA was meeting statutory requirements. Specifically, we reviewed relevant documentation to assess the extent to which the Administrator was making final determination of reprisal in 30 days—the required review period specified by statute. We reviewed the Administrator’s documentation on the final disposition of reprisal investigations and compared the date of the Administrator’s final decision to the date of receipt of the reprisal investigations from the NASA OIG. We also conducted interviews with the Office of General Counsel, who spoke on behalf of the Administrator. To assess the extent to which NASA communicated the applicable whistleblower reprisal protections externally with contractors, we reviewed a generalizable sample of NASA contracts to determine the extent a required whistleblower clause was included. We used the Federal Procurement Data System-Next Generation (FPDS-NG) to generate a sample of contract actions over $300,000 that were awarded by NASA in fiscal year 2016. We selected contracts that were not only over the simplified acquisition threshold (generally $150,000), but were over $300,000 to account for possible exceptions and to ensure that we were sampling contracts that would be required to include a whistleblower reprisal clause. From the 270 contracts identified, for purposes of examining the inclusion of NASA Federal Acquisition Regulation Supplement (NFS) clause 1852.203-71 (or other potentially applicable clauses) in NASA contracts, a legal requirement, we selected a generalizable random sample of 100 contracts. The sample is projectable to NASA fiscal year 2016 contracts; however, we did not make a case by case legal determination for contracts not in our sample. We randomly selected 10 contracts from each center that awarded new contracts in 2016, and for those centers that did not have 10 contracts, we selected all contracts. The remaining contracts were then pulled from the NASA Shared Services Center (NSSC) because that center does a majority of NASA’s contracting. We asked for contracts awarded in fiscal year 2016 to ensure we were sampling contracts that are required to have the clause and would be reasonably accessible by NASA. We excluded interagency contracts and task or delivery orders awarded using blanket purchase agreements to ensure we sampled base contracts awarded by NASA, not other agencies. We estimated the percentage of NASA contracts expected to include whistleblower clause(s) as the weighted average of results from the 10 contracting centers. Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that could have been drawn. Because each sample could have provided different estimates, we express the uncertainty associated with any particular estimate as a 95 percent confidence interval. This is the interval that, with repeated sampling, would be expected to contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that this confidence interval contains the true percentage of contracts expected to include whistleblower clause(s); however, to assess legal compliance we would have to make a case by case determination, which we did not do. We conducted data reliability checks on the FPDS-NG dataset by comparing it to contract documentation obtained from contract files and determined it was sufficiently reliable for our purposes. Additionally, we conducted interviews with NASA procurement officials and contracting officers at multiple locations including NASA Headquarters, NSSC and JSC to discuss any additional measures NASA takes to communicate whistleblower protections to its contractors and their contractor employees. To further assess internal communication, we reviewed relevant documentation, including guidance, and conducted interviews with procurement officials, NASA’s Office of General Counsel, and Chief Counsels at JSC, NSSC, and Marshall Space Flight Center. To assess the extent to which NASA communicated the applicable whistleblower reprisal protections with grantees, we reviewed a non- generalizable sample of grants awarded by NASA in fiscal year 2016 to determine whether NASA grants included a mechanism notifying grantees of their employees’ whistleblower rights and reprisal protections. We used FPDS-NG to identify a non-generalizable random sample of 10 grants awarded by NASA in fiscal year 2016 for review to determine whether any of the selected grants included a mechanism to communicate whistleblower reprisal protections to grantee employees. We conducted data reliability checks on the FPDS-NG data by comparing it to grant documentation obtained from grant awards and determined it was sufficiently reliable for our purposes. Additionally, we conducted interviews with NASA grant making officials to discuss any additional measures NASA takes to communicate whistleblower reprisal protections to its grantees and their grantee employees. Finally, in order to learn about contractor and grantee experiences during NASA’s implementation of enhanced whistleblower protections, we conducted interviews with or received written answers to questions from a selected group of NASA contractors and grantees. Using FPDS-NG data, we selected institutions with the highest and lowest contracts (including small business contracts) and grants by obligations in 2016. Using these selection criteria, we selected three contractors and three grantees to meet with based on the amount of funds obligated in 2016. We ultimately interviewed or obtained written answers from all selected contractors and grantees. Additionally, we spoke with two advocacy groups, one about grants and one about contracts. We conducted this performance audit from March 2017 to March 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Penny Berrier (Assistant Director), Mary Diop, Lorraine Ettaro, Alexandra Gebhard, Kurt Gurka, Stephanie Gustafson, Julia Kennon, Jordan Kudrna, Kate Lenane, Roxanna Sun, and Khristi Wilkins made key contributions to this report.

Summary: NASA obligated over $18 billion in contracts and more than $1 billion in grants in fiscal year 2016, and it relies on a significant number of contractor and grantee employees to accomplish its work. These employees are legally protected from reprisal—such as demotion or firing—for whistleblowing. GAO was asked to review NASA's whistleblower reprisal protections for contractor and grantee employees. This report addresses, among other things, the extent to which (1) NASA's Inspector General investigated contractor and grantee whistleblower reprisal complaints; (2) NASA's Administrator reviewed reprisal complaints in a timely manner; and (3) NASA communicated the applicable whistleblower reprisal protections to contractors. GAO reviewed NASA and its Inspector General's policies and guidance; reviewed a generalizable sample of 100 contracts from all NASA centers with contracts in fiscal year 2016; and interviewed relevant officials and contractors, grantees, and advocacy groups. From 2008 through June 2017, National Aeronautics and Space Administration (NASA) contractor and grantee employees submitted 48 reprisal complaints such as alleged firing or demotion for reporting fraud, waste, or abuse within the government. NASA's Inspector General addressed all 48 complaints, completed investigations for 6 of those complaints, and forwarded investigation reports to the NASA Administrator, who is responsible for making a final determination of whether reprisal occurred. The Administrator determined that none of the complaints qualified for protection under the law. Further, in 5 of the 6 cases forwarded by the OIG, the Administrator was required by statute to make a final determination of reprisal within 30 days. GAO found that the Administrator did not meet this required time frame for all 5 cases and had no documented response for one of them (see figure for all 5 cases). According to officials from NASA's Office of General Counsel, each case must be handled on a case by case basis to ensure due process and 30 days is insufficient time to issue an order of final determination of reprisal. However, in order to ensure that whistleblower reprisal complaints are handled within required timeframes, NASA would have to monitor and evaluate its processes for making final determinations of reprisal, but it has not yet taken this step. Consequently, NASA does not know what changes may be needed to ensure that it is meeting the statutory 30-day requirement. NASA communicates whistleblower protections to contractors through inclusion of a required contract clause. For example, GAO found that almost all—98 percent—of contracts would be expected to include a whistleblower clause as required by statute. However, certain elements of NASA whistleblower protection guidance have contributed to a different understanding of reprisal protections among officials at headquarters, a NASA center, and the Inspector General. For example, a July 2014 procurement notice and contract clause language resulted in different interpretations about when the protections apply. Federal internal control standards require that an entity should communicate necessary quality information internally to meet the objectives of its mission. Without additional clarity in its guidance on when the protections apply, NASA centers and procurement officials will be at risk of inconsistent implementation of the law. GAO is making three recommendations to NASA, including evaluating the process for reviewing reprisal complaints to ensure it is meeting the required timeframe and clarifying guidance on when protections apply to contractor employees. NASA agreed with the recommendations and plans to develop a documented process to ensure it reviews reprisal complaints in a timely manner and clarify guidance as appropriate, among other things.