The Select Agent Program does not fully meet key elements of effective oversight. In particular, the program has oversight shortcomings related to each of our five key elements: independence, performing reviews, technical expertise, transparency, and enforcement. In addition, the program does not have joint strategic planning documents to guide its oversight efforts, such as a joint strategic plan and workforce plan. It did, however, begin taking steps to develop a joint strategic plan during the summer of 2017. First, regarding independence, the Select Agent Program is not structurally distinct and separate from all of the laboratories it oversees because the two components of the Select Agent Program are located in CDC and APHIS, both of which also have high-containment laboratories registered with the program. Many experts at our meeting raised concerns that the Select Agent Program cannot be entirely independent in its oversight of CDC and APHIS laboratories because the Select Agent Program is composed of divisions of those agencies. To help reduce conflicts of interest, the program has taken steps such as having APHIS lead inspections of CDC laboratories. However, it has generally done so in response to concerns raised by others. The program itself has not formally assessed all potential risks posed by its current structure and the effectiveness of its mechanisms to address those risks. The Office of Management and Budget’s Circular A-123 requires federal agencies to integrate risk management activities into their program management to help ensure they are effectively managing risks that could affect the achievement of agency objectives. In addition, federal internal control standards state that management should identify, analyze, and respond to risks related to achieving defined objectives. Without (1) regularly assessing the potential risks posed by the program’s current structure and the effectiveness of its mechanisms to address them and (2) taking actions as necessary to ensure any identified risks are addressed, the program may not be aware of or effectively mitigate impairments to its independence that could affect its ability to achieve its objectives. Second, regarding the ability to perform reviews, we found that the Select Agent Program performs several types of reviews to ensure compliance with regulatory and program requirements. However, the program may not target the highest-risk activities in its inspections, in part because it has not formally assessed which activities pose the highest risk to biological safety and security. For example, many experts at our meeting and laboratory representatives we interviewed raised concerns about the amount of time inspectors spend assessing compliance with inventory controls (e.g., by counting and examining vials containing select agents) and reviewing inventory records during the inspection process, which takes time away from inspecting other aspects of biological safety and security. Experts at our meeting said that these activities do little to reduce the risk of theft of select agents (a security concern) because samples could be clandestinely removed from vials and replicated without being detected by the inventory controls currently in place. Further, other laboratory representatives told us that activities to assess compliance with certain program requirements, such as time-consuming reviews of records, did little to reduce risk and were unnecessarily burdensome to both researchers and inspectors. These inspection activities are generally intended to address biological security concerns; however, recent high- profile incidents at registered laboratories have concerned biological safety rather than security. To improve the inspection process and identify trends and associations between inspection findings and risk, a 2015 internal review of the CDC component of the Select Agent Program recommended that the CDC and APHIS components of the program work together to analyze inspection and investigation data. According to program officials, they have not yet addressed the recommendation because they do not currently have adequate tools to do so, but the program is transitioning to a new database that will enhance their ability to identify trends and associations and thereby guide improvements to the inspection process. However, the program did not provide a plan for when or how the program will carry out these analyses to improve the inspection process. Federal internal control standards state that management should identify, analyze, and respond to risks related to achieving defined objectives. Without developing and implementing a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities, the Select Agent Program will not have assurance that it is effectively balancing the potential safety and security gains from its oversight efforts against the use of program resources and the effect on laboratories’ research. We also found that the Select Agent Program did not fully meet the other three key elements of effective oversight: technical expertise, transparency, and enforcement. For example, although the program has taken steps to hire additional staff and enhance the technical expertise of its staff, workforce and training gaps remain. In addition, although the program has increased transparency about registered laboratories and violations of the select agent regulations to the public and registered laboratories since 2016, the information it shares is limited and there is no consensus about what additional information could be shared, given security concerns. Lastly, although the program has authority to enforce compliance with program requirements, it is still working to address past concerns about the need for greater consistency and clarity in actions it takes in exercising this authority. In addition to not fully meeting the five key elements of effective oversight, we found that the Select Agent Program does not have joint strategic planning documents to guide its shared oversight efforts across CDC and APHIS. For example, the program does not have a joint mission statement to collectively define what the program seeks to accomplish through its oversight. It also does not yet have a strategic plan. Agencies can use strategic plans to set goals and identify performance measures for gauging progress towards those goals. Strategic plans can also outline how agencies plan to collaborate with each other to help achieve goals and objectives. The program began taking steps to develop a joint strategic plan during the course of our review and, in August 2017, began soliciting bids from contractors for the plan’s development. The statement of work for the contract stipulates that the contractor shall develop guiding principles for the Select Agent Program along with a mission statement and strategic goals and objectives, among other requirements. However, it does not have any requirements related to development of a joint workforce plan. We have found in the past that agencies’ strategic workforce planning should be clearly linked to the agency’s mission and long-term goals developed during the strategic planning process. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program to better manage fragmentation by improving how it leverages resources to ensure all workforce and training needs are met. Leveraging resources is especially important given fiscal constraints. In our report, we recommended that CDC and APHIS take several steps to address these findings. First, we made five recommendations to improve independence, including that CDC and APHIS regularly assess the potential risks posed by the program’s structure and the effectiveness of its mechanisms to address those risks, and take actions as necessary to ensure any identified risks are addressed so that impairments to independence do not affect its ability to achieve its objectives. Second, to improve the ability to perform reviews, we recommended that the directors of the Select Agent Program work together to develop and implement a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities. We also made several other recommendations, including recommending that the directors of the Select Agent Program develop a joint workforce plan that assesses workforce and training needs for the program as a whole. Selected countries and regulatory sectors employ approaches to promote effective oversight that sometimes differ from those of the Select Agent Program by, for example, having regulatory bodies that are structurally independent from the entities they oversee or taking a risk-based approach to performing reviews. To illustrate, with regard to independence, Great Britain’s Health and Safety Executive, whose mission is to protect worker and public health and safety and which oversees laboratories that work with pathogens, is an independent government agency. According to officials from the Health and Safety Executive and laboratory representatives, one strength of this approach is that it avoids potential organizational conflicts of interest because none of the laboratories it oversees are part of the same agency. Some other regulatory sectors in the United States, including the Nuclear Regulatory Commission (NRC), are also structurally independent from regulated facilities as a mechanism to ensure independence. Prior to the creation of NRC in 1974, the U.S. Atomic Energy Commission was responsible for both promotion and oversight of the nuclear industry. The Energy Reorganization Act of 1974 established NRC as a separate, independent entity. According to a Senate committee report, this was a response to growing criticism that there was a basic conflict between the U.S. Atomic Energy Commission’s regulation of the nuclear power industry and its development and promotion of new technology for the industry. Related to the ability to perform reviews, regulators in Great Britain and Canada apply a risk-based approach by targeting laboratories with a documented history of performance issues or those conducting higher- risk activities. In both Great Britain and Canada, the organizations that oversee laboratories generally focus their oversight on (1) biological safety, and (2) regulation of all potentially hazardous pathogens in laboratories. In contrast, the Select Agent Program originated from security-related concerns and regulates only those pathogens identified on the U.S. select agent list and no other pathogens that may be handled in high-containment but are not select agents, such as West Nile virus. Other differences we found in approaches include relying on scientists and other laboratory personnel to have requisite technical expertise on the pathogens and activities in their laboratories, sharing incident information on their public websites, and having prosecutorial authority when incidents occur. In conclusion, CDC and APHIS share a critical role in ensuring that important research on select agents can be conducted in high- containment laboratories in a safe and secure manner. The Select Agent Program has made a number of improvements over the past few years, such as hiring additional staff and improving training to enhance expertise. Nevertheless, the program does not fully meet all key elements of effective oversight and more is needed to develop joint strategic plans to collectively guide its shared oversight efforts. In our prior work, we have found that existing federal oversight of high-containment laboratories is fragmented and largely self-policing, among other things. Our October 2017 report, in combination with these past findings, continues to raise questions about whether the current government framework and oversight are adequate. Vice Chairman Griffith, Ranking Member DeGette, and Members of the Subcommittee, this concludes our prepared statement. We would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this statement, please contact Mary Denigan-Macauley, Ph.D., Acting Director, Health Care, at (202) 512-7114 or deniganmacauleym@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this statement include Sushil Sharma, Ph.D., Dr.PH (Assistant Director); Amy Bowser; Caitlin Dardenne, Ph.D.; John Neumann; Cynthia Norris; Timothy M. Persons, Ph.D.; and Lesley Rinner. Staff who made key contributions to the report(s) cited in the statement are identified in the source products. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Safety lapses have occurred at laboratories in the United States that conduct research on select agents—such as Ebola virus or anthrax bacteria—that may cause serious or lethal infection in humans, animals, or plants, raising concerns about whether oversight is effective. This statement summarizes information contained in GAO's October 2017 report, titled High-Containment Laboratories: Coordinated Actions Needed to Enhance the Select Agent Program's Oversight of Hazardous Pathogens ( GAO-18-145 ). The Federal Select Agent Program—jointly managed by the Departments of Health and Human Services (HHS) and Agriculture (USDA)—oversees laboratories' handling of certain hazardous pathogens known as select agents. However, the program does not fully meet all key elements of effective oversight. For example, the program is not structurally independent from all laboratories it oversees and has not assessed risks posed by its current structure or the effectiveness of mechanisms it has to reduce organizational conflicts of interest. Without conducting such assessments and taking actions as needed to address risks, the program may not effectively mitigate impairments to its independence. In addition, some experts and laboratory representatives GAO interviewed raised concerns that the program's reviews may not target the highest-risk activities, in part because it has not formally assessed which activities pose the highest risk. Without assessing the risk of activities it oversees and targeting its resources appropriately, the program cannot ensure it is balancing its resources against their impact. Moreover, the program does not have strategic planning documents, such as a joint strategic plan and workforce plan, to guide its oversight. Although it began taking steps to develop a joint strategic plan, the program is not developing workforce plans as part of this effort. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program leverage resources to ensure all workforce and training needs are met. Selected countries and regulatory sectors GAO reviewed employ other approaches to promote effective oversight. For example, in Great Britain, an independent government agency focused on health and safety oversees laboratories that work with pathogens. In addition, in both Great Britain and Canada, regulators (1) focus their oversight on biological safety, because safety incidents provided the impetus for laboratory oversight in these countries and (2) regulate all potentially hazardous pathogens and activities in laboratories. GAO's recommendations in GAO-18-145 included that the Federal Select Agent Program (1) assess risks posed by its current structure and address risks as needed; (2) assess the risk of activities it oversees and target reviews to the highest-risk activities; and (3) develop a joint workforce plan. HHS and USDA agreed with GAO's recommendations and outlined actions they are taking, or plan to take, to address them, which GAO will continue to monitor.