This section provides information on select agent regulations and program roles, responsibilities, and requirements; and the history of the Select Agent Program. The Select Agent Program is fragmented because oversight responsibility is, by law, split between CDC and APHIS. The two agencies have delineated roles and responsibilities to regulate laboratories—including conducting inspections and other activities—that possess, use, or transfer biological select agents. CDC’s Division of Select Agents and Toxins is responsible for the oversight and regulation of select agents that could pose a threat to public health and safety, such as the Ebola virus. APHIS’s Agriculture Select Agent Services is responsible for the oversight and regulation of select agents that could pose a threat to animal or plant health or animal or plant products, such as the virus that causes foot-and- mouth disease. Some select agents, such as Bacillus anthracis (the bacterium that causes anthrax), are regulated by both agencies because they pose a threat to both human and animal health; these agents are known as overlap agents. As part of their oversight, CDC and APHIS maintain a list of select agents that they are required to review and republish at least every 2 years. Generally, laboratories (including those at federal agencies and private institutions) and individuals who possess, use, or transfer these select agents must register with CDC or APHIS and renew their registration every 3 years. Most laboratories registered with the Select Agent Program are registered with CDC (238 of 276). (See fig. 1 for information about the laboratories registered with the program.) In fiscal year 2016, CDC’s budget to manage its component of the Select Agent Program was about $21 million and APHIS’s was about $5.5 million. Select agent regulations govern the possession, use, and transfer of designated select agents. To apply for a certificate of registration, the laboratory must submit an application package to either CDC or APHIS, and laboratory personnel must submit to a security risk assessment conducted by the Federal Bureau of Investigation (FBI). The Select Agent Program conducts an on-site inspection before issuing a new certificate of registration or renewing an existing registration; both are valid for a maximum of 3 years. Once approved, a laboratory’s certification of registration may be amended to reflect changes in circumstances, such as replacement of the responsible official or other personnel changes, changes in ownership or control of the laboratory, changes in the activities involving any select agents, or the addition or removal of any select agents. As a condition of registration, the select agent regulations require each laboratory to designate an individual to be its responsible official, who is responsible for ensuring compliance with the regulations. In addition, the regulations require laboratories to develop various written plans, as well as provide training and maintain records of training and other activities. For example, the regulations require that laboratories registered with the program develop and implement a written security plan sufficient to safeguard each select agent against unauthorized access, theft, loss, or release; develop and implement a written biological safety plan that is commensurate with the risk of the select agent, given its intended use; provide training on biological safety and security for individuals with access to select agents; and maintain records on the activities covered by the select agent regulations. Several historical security incidents involving hazardous pathogens resulted in a series of laws and other regulatory activity that served to establish and amend the Select Agent Program. First, Congress passed section 511 of the Antiterrorism and Effective Death Penalty Act of 1996 after an individual in the United States unlawfully obtained Yersinia pestis, the bacterium that causes plague, by mail order. Section 511 directed the Secretary of HHS to promulgate regulations identifying a list of biological agents that have the potential to pose a severe threat to public health and safety, providing procedures governing the transfer of those agents, and establishing safeguards to prevent unauthorized access to those agents for purposes of terrorism or other criminal activities. The HHS Secretary delegated the authority to regulate select agents to CDC, thus establishing the Select Agent Program in its initial form. In carrying out this authority, CDC required laboratories transferring select agents to be registered with the program. After the terrorist events of September 11, 2001, and the subsequent anthrax attacks in October 2001, Congress passed the USA PATRIOT Act of 2001 and the Public Health Security and Bioterrorism Preparedness and Response Act of 2002. These acts significantly expanded the Select Agent Program by restricting access to select agents and increasing safeguards and security measures for select agents. The 2002 act also expanded the program to include not only the regulation of the transfer but also the use and possession of select agents, and it granted comparable authority to USDA for select agents that pose a threat to animal or plant health, or animal or plant products. The Secretary of Agriculture delegated the authority to regulate select agents that affect animal or plant health to APHIS. The act also required HHS and USDA to coordinate on overlap agents and required the Secretaries of both departments to establish, maintain, and biennially review and republish the select agent list, making revisions as appropriate to protect the public. On July 2, 2010, the President signed Executive Order 13546, “Optimizing the Security of Biological Select Agents and Toxins in the United States.” The executive order directed HHS and USDA, as a part of their ongoing review, to tier the select agents on the list, consider shortening the list, and establish physical security standards for select agents with the highest risk of misuse; HHS and USDA did so in final rules published October 5, 2012. About half of the laboratories registered with the program as of December 2016 were registered to work with tier 1 agents (142 of 276). The Select Agent Program does not fully meet key elements of effective oversight. In particular, the program has oversight shortcomings related to each of the five key elements: independence, performing reviews, technical expertise, transparency, and enforcement. In addition, the program does not have joint strategic planning documents to guide its oversight efforts, such as a joint strategic plan and workforce plan; it did, however, begin taking steps to develop a joint strategic plan over the course of our review. The Select Agent Program does not fully meet our key elements of effective oversight. Specifically, the program is not independent from all laboratories it oversees, and it has not formally assessed the potential risks posed by its current organizational structure. In addition, the program regularly performs reviews of laboratories’ compliance with regulatory and program requirements, but these reviews may not target the activities that pose the highest risk to biological safety and security. Moreover, even though the program has taken steps to hire additional staff and enhance the technical expertise of its staff, workforce and training gaps remain. The program has increased transparency since 2016, but the information it shares is limited and there is no consensus about what additional information could be shared, given security concerns. Lastly, the Select Agent Program has authority to enforce compliance with program requirements, but is still working to address past concerns about the need for greater consistency and clarity in actions it takes in exercising this authority. Independence The organization conducting oversight should be structurally distinct and separate from the entities it oversees. According to our key elements of effective oversight, to be independent, the organization conducting oversight should be structurally distinct and separate from the entities it oversees. The Select Agent Program is not structurally distinct and separate from all of the laboratories it oversees but has taken some steps to reduce conflicts of interest potentially posed by its current structure within CDC and APHIS. The two components of the Select Agent Program are located in CDC and APHIS, both of which also have high-containment laboratories registered with the program. Many experts at our meeting raised concerns that the Select Agent Program cannot be entirely independent in its oversight of CDC and APHIS laboratories because the Select Agent Program is composed of divisions of those agencies. In particular, one expert stated that to be independent, the agencies cannot regulate themselves, and others said that the agencies’ oversight of their own laboratories may present a conflict of interest. However, laboratories owned by CDC and APHIS are not generally located within the same agency divisions and thus are not in the same chain of command as the Select Agent Program. The one exception is an APHIS-owned complex of laboratories in the same division as the APHIS component of the program, but that complex is registered with CDC, which means that CDC leads its inspections and oversight. Senior program officials, many laboratory representatives, and some experts cited a number of benefits to the Select Agent Program’s current structure within CDC and APHIS, including the ability for inspectors to have access to experts and other support from their respective divisions. For example, program officials said that the Select Agent Program had reached out to CDC scientists for assistance in developing guidance documents for the program. In addition, inspectors sometimes obtain technical assistance from experts in CDC and APHIS, such as in cases where the inspectors are not familiar with certain techniques or equipment being used in a registered laboratory. However, program officials also said that they have tried to limit the extent that they rely on CDC and APHIS scientists from outside the program, so as not to raise concerns about conflicts of interest. Senior program officials from CDC and APHIS also said that the Select Agent Program’s current locations within the two agencies allow for access to additional support as needed, including additional funds and administrative services. Senior program officials from CDC further stated that being located in an office focused on preparedness and response is advantageous because the Select Agent Program can quickly pivot into incident response mode, allowing for rapid response and assessment of incidents that occur in registered laboratories. They noted that this location proved advantageous during an incident in 2015, for example, when the program responded to the discovery that a DOD laboratory had inadvertently sent live Bacillus anthracis, the bacterium that causes anthrax, to nearly 200 laboratories. The location of the program has also raised some concerns in the past, which the Select Agent Program has taken some steps to address. In response to past concerns about conflicts of interest and separation of duties raised by HHS OIG, APHIS, and us, both CDC and APHIS made structural changes to increase the Select Agent Program’s independence within their respective agencies. In particular, in 2003, in response to concerns from HHS OIG and us, CDC moved its component of the Select Agent Program into the agency’s Office of Public Health Preparedness and Response because that office did not have any laboratories registered with the program. (See fig. 2 for HHS’s organizational chart, including a depiction of where CDC’s Select Agent Program component currently sits in relation to other agency divisions.) According to CDC officials, the director of the CDC component of the Select Agent Program has access to senior leadership at CDC as needed. Similarly, since 2013, APHIS has also made some organizational changes, including realigning supervisory responsibilities for the program and creating a direct line of communication from the director of the APHIS component of the Select Agent Program to the APHIS administrator. Previously, the program reported to a director whose division had a suite of laboratories that the program inspects. Now it is managed through APHIS’s National Import Export Services, which has different senior-level managers that report directly to the Office of the Administrator rather than the managers who oversee registered laboratories. According to agency officials, these changes increased the level of independence between the Select Agent Program and APHIS-owned laboratories but did not fully address the appearance of a lack of independence within APHIS, since the agency’s organizational chart still places the APHIS component of the Select Agent Program under Veterinary Services. (See fig. 3 for USDA’s organizational chart, including a depiction of where APHIS’s Select Agent Program component currently sits in relation to other agency divisions). The APHIS director of the Select Agent Program and the Associate Administrator of APHIS meet regularly to discuss incidents involving select agents, enforcement actions, and operation of the Select Agent Program, among other issues, according to agency officials, but this reporting structure is not documented. According to federal standards for internal control, management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives and should develop and maintain documentation of its internal control system. Until APHIS formally documents the reporting structure for its component of the Select Agent Program from the APHIS director of the program to the administrator of APHIS, it will continue to appear to have conflicts of interest in its oversight of APHIS-owned laboratories. In addition to these structural changes, the program has put mechanisms in place to reduce organizational conflicts of interest, but the agencies do not always follow a key mechanism. In particular, CDC and APHIS signed a memorandum of understanding in 2012 that stated that APHIS would provide the lead inspector for all inspections of registered laboratories owned by CDC. However, in practice, CDC inspectors still participate in inspection activities because of their expertise in human agents. In March 2015, the memorandum was amended to state that CDC would lead inspections of all USDA-owned laboratories. However, since the memorandum was amended, the APHIS component of the Select Agent Program has led at least three inspections of USDA- owned or operated laboratories. In particular, APHIS led an inspection of a laboratory owned by another USDA agency, the Agricultural Research Service, in November 2015; one run by the Agricultural Research Service and APHIS scientists in May 2015; and one owned by APHIS in December 2015. APHIS officials we interviewed said that they had overlooked this amendment to the memorandum of understanding and the program does not have a process in place to help ensure the memorandum is followed. According to federal standards for internal control, management should design control activities to achieve objectives and respond to risk. Such internal control activities help ensure that management directives such as those outlined in the memorandum of understanding are carried out, and should be effective and efficient in accomplishing the program’s control objectives. One example of a control activity would be establishing a process to ensure APHIS and CDC comply with the memorandum to help ensure APHIS does not inspect its own laboratories. Without establishing control activities to help ensure that each component of the program carries out its inspection responsibilities as outlined in the program’s memorandum of understanding, the Select Agent Program cannot have reasonable assurance that its key mechanism to reduce conflicts of interest is implemented. Although the Select Agent Program has taken steps to help reduce conflicts of interest, it has generally done so in response to concerns raised by others. The program itself has not formally assessed all potential risks posed by its current structure and the effectiveness of its mechanisms to address those risks. For example, the program did not identify all of the areas noted above that may present conflicts of interest and has not considered whether there may be additional areas of concern. An expert in our meeting identified benefits of an independent, third-party review of the Select Agent Program. For example, we and other audit organizations are subject to an external peer review at least once every 3 years that includes a review of documentation related to independence, among other issues. According to senior program officials we interviewed, the program as a whole has not engaged in comprehensive risk management activities but they would be willing to do so in the future. OMB’s Circular A-123 requires federal agencies to integrate risk management activities into their program management to help ensure they are effectively managing risks that could affect the achievement of agency objectives. According to the circular, once initial risks are identified, it is important for agencies to regularly re-examine risks to identify new risks or changes to existing risks. In addition, federal internal control standards state that management should identify, analyze, and respond to risks related to achieving defined objectives. Without (1) regularly assessing the potential risks posed by the program’s current structure and the effectiveness of its mechanisms to address them, such as by commissioning external reviews, and (2) taking actions as necessary to ensure any identified risks are addressed, the program may not be aware of or effectively mitigate impairments to its independence that could affect its ability to achieve its objectives. Ability to perform reviews The organization should have the access and working knowledge necessary to review compliance with requirements. According to our key elements of effective oversight, the organization conducting oversight should have the ability to perform reviews, including access to facilities and working knowledge necessary to review compliance with requirements. The Select Agent Program performs several types of reviews to ensure compliance with regulatory and program requirements, including registration inspections for laboratories seeking certification to use select agents, renewal inspections for laboratories seeking to renew their registration, and verification inspections. (See fig. 4 for additional information on these inspections). The program has the ability to access any registered laboratory for inspection, including without prior notification. Inspections typically include review of registration and other documents—such as biological safety and security plans and inventory and personnel training records— as well as physical inspections of laboratory workspace and interviews with laboratory representatives, among other inspection activities. During inspections, Select Agent Program inspectors go through checklists that are based on the select agent regulations, the Biosafety in Microbiological and Biomedical Laboratories manual, and guidelines from NIH. The inspections cover a variety of topics—such as facility design and operation, incident response, security, training, records management, and biological safety—and may last anywhere from 1 day with 1 or 2 inspectors for simpler laboratories, to a couple of weeks with up to 10 inspectors for larger and more complex laboratories. Most laboratory representatives we spoke with said that the inspectors generally had the working knowledge necessary to review compliance and that the inspections and resulting reports were in-depth and generally fair and accurate. However, the program may not target the highest-risk activities in its inspections, in part because it has not formally assessed which activities pose the highest risk to biological safety and security. According to Select Agent Program officials, the program’s policy is to conduct at least one verification inspection of all registered laboratories—regardless of their past history or performance—between each 3-year renewal inspection, and the program may consider additional inspections at laboratories that pose a higher risk. Specifically, the program scores laboratories’ risk based on a number of factors, such as past inspection findings. However, a 2017 HHS OIG report found that the CDC component of the Select Agent Program had evaluated some, but not all, variables that could inform the risk a laboratory poses to health and safety and concluded that CDC may wish to enhance its risk assessment by considering additional factors, such as whether a laboratory has previously reported losses or releases of a select agent, to better inform a laboratory’s level of risk over time. In addition, some experts at our meeting and laboratory representatives we interviewed raised concerns that the program’s inspections do not target resources to the highest-risk activities. For example, some experts said that the program has historically not put enough emphasis on verifying that certain laboratory procedures are safe and effective, which some said may have contributed to high-profile incidents in 2014 and 2015 in which select agents were inadvertently released from high-containment laboratories. However, according to the Select Agent Program, the program does not validate or verify laboratory procedures as it is the responsibility of the laboratories themselves to do so. Further, many experts at our meeting and laboratory representatives we interviewed raised concerns about the amount of time inspectors spend assessing compliance with inventory controls (e.g., by counting and examining vials containing select agents) and reviewing inventory records during the inspection process, which takes time away from inspecting other aspects of biological safety and security. Experts at our meeting said that these activities do little to reduce the risk of theft of select agents because samples could be clandestinely removed from vials and replicated without being detected by the inventory controls currently in place. Finally, other laboratory representatives told us that activities to assess compliance with certain program requirements did little to reduce risk and were unnecessarily burdensome, such as time- consuming reviews of records so that nicknames such as “Rob” match up to registered names, such as “Robert.” These inspection activities are generally intended to address biological security concerns, such as theft; however, recent high-profile incidents at registered laboratories have been related to biological safety rather than security, and no thefts have been reported since 2003, when notification requirements were first implemented, according to program officials and documents. Experts at our meeting generally agreed that the Select Agent Program has historically put more focus on security than on biological safety in its reviews, given that the program was established in response to terrorist incidents. For example, some experts said that the program has not focused enough on ensuring the health and safety of researchers and reducing the potential for their exposure to select agents, which some noted are more likely to occur than thefts due to security issues. Many experts questioned if the focus on security continues to be appropriate, in light of recent biological safety incidents. According to senior APHIS officials we interviewed, the Select Agent Program has been mandated to focus on security and if they move the program’s focus too far from security to biological safety, they may lose the goals established when the program was formed. They also noted that, according to the select agent regulations, laboratories are responsible for developing and implementing a written biological safety plan, and therefore a balance should be maintained between the laboratories’ execution of these plans and the level of oversight from the Select Agent Program. In addition, these officials stated that, during inspections, it is much easier for inspectors to ensure laboratories are meeting security requirements than carrying out their biological safety plans. For example, inspectors can easily check to make sure laboratories have required security barriers in place, such as locks on doors, but it is harder to measure whether laboratories are carrying out laboratory procedures safely. They also noted that the program does not want to be prescriptive with respect to biological safety so that laboratories can implement those biological safety practices that are most appropriate for their facility. A 2015 internal review of the CDC component of the Select Agent Program acknowledged uncertainties and gaps in understanding how best to balance laboratories’ ability to conduct critical research using select agents with the program’s need to ensure the safety and security of the public and laboratory workers. The resulting report recommended that the CDC and APHIS components of the program work together to analyze inspection and investigation data to identify trends and associations between inspection findings and risk and to improve the inspection process. According to program officials we interviewed, the Select Agent Program has not yet addressed the recommendation because the program does not currently have adequate tools to do so. They noted that the program is transitioning to a new database that will enhance their ability to analyze program data to identify such trends and associations and thereby guide improvements to the inspection process. However, the program did not provide a plan for when or how the program will carry out these analyses or use the information to improve the inspection process. Federal internal control standards state that management should identify, analyze, and respond to risks related to achieving defined objectives. In addition, the Project Management Institute’s Standard for Program Management calls for program scheduling planning as a leading practice to ensure organizational activities are completed. Without developing and implementing a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities, the Select Agent Program will not have assurance that it is effectively balancing the potential safety and security gains from its oversight efforts against the use of program resources and the effect on laboratories’ research. According to our key elements of effective oversight, the organization conducting oversight should have sufficient staff with the expertise to perform sound safety and security assessments. CDC and APHIS have hired additional staff for the program and improved training to enhance expertise, but workforce and training gaps remain. Technical expertise The organization should have sufficient staff with the expertise to perform sound safety and security assessments. The CDC and APHIS components of the Select Agent Program increased the number of full-time federal inspectors in 2016 and 2017, but have faced challenges in hiring and retaining sufficient staff with the requisite expertise to perform the necessary work in a timely manner. According to agency reports, agency officials, and laboratory representatives, Select Agent Program inspectors are subject to a large workload with an intensive travel schedule. Inspectors perform a variety of tasks, including conducting on-site inspections of laboratories, developing written reports of inspection results, processing requests for amendments to laboratory registrations, and communicating program requirements to laboratory representatives. According to agency reports and inspectors we spoke with, inspectors often travel 30 percent to 50 percent or more of their time in performing their duties. This intensive workload and travel schedule has led to delays in both the issuing of inspection reports and processing of registration amendments. According to a 2017 CDC report, the time to process CDC’s inspection reports in 2016 ranged from 4 to 224 business days, with about 27 percent of reports exceeding the Select Agent Program’s 30-day target for issuance. Workload issues were cited as one of the key reasons for delays. A 2016 APHIS internal report also identified delays in issuing inspection reports. According to the 2016 report, the time to process APHIS’s inspection reports in 2014 averaged 36 days, but some reports were issued more than 100 days from the date the inspection concluded. Similarly, the processing time for amendments to registrations, which the program has not routinely tracked in the past, generally varies from a couple of weeks or months to approve simpler amendments (such as personnel changes) to a year or more to approve major changes to facilities (such as adding new laboratory space), according to laboratory representatives. Delays in issuing inspection reports or processing amendments may hamper the implementation of corrective measures to address safety issues identified in inspections or impede laboratories’ research on select agents, according to agency reports and laboratory representatives. For example, representatives from one laboratory told us that they lost grant funding because it took over a year for the Select Agent Program to review and approve an amendment to its registration to allow the proposed research to be conducted. Workload issues have also created problems with retention, according to agency documents and program officials we interviewed, and have sometimes resulted in staff from the APHIS component of the Select Agent Program being assigned responsibilities outside their areas of expertise. For example, at the time of our review, an APHIS security specialist was given the additional responsibility of conducting reviews not related to his area of expertise, such as inspecting ventilation systems, which are critical to ensuring select agents are not released into the environment. According to the 2016 internal APHIS report, the APHIS component of the program has historically struggled with resource deficiencies and has had to implement strategies to fulfill its legal mandates and meet basic goals and objectives within its limited resources. Both the CDC and APHIS components of the Select Agent Program have individually taken steps to identify and address gaps in their workforce but have not coordinated these actions to manage fragmentation across the program. CDC developed a formal workforce plan for its component of the Select Agent Program in 2016, identified and secured the necessary resources to implement the plan, and is working to fill needed positions. As of August 2017, the CDC component of the program had 7 vacancies out of its 51 total inspector positions. APHIS also identified additional needed positions, through development of its 5-year business plan, and has used money from an APHIS contingency fund to fill them. APHIS hired additional inspectors in 2016 and 2017 and now has 11 inspector positions, up from 7 in 2015. APHIS also added several other new positions in the first half of 2017, including a scientific officer, a security manager, and a program analyst, among others. However, according to program officials we interviewed, even with the additional recently hired inspectors, the program may not have adequate staff to handle surges in workload. For example, if there is a need to respond to critical incidents similar to those that occurred at CDC and DOD in 2014 and 2015, the program may find it challenging to respond to those incidents in addition to meeting its annual inspection schedule. Moreover, according to the 2016 APHIS internal review and CDC and APHIS officials we interviewed, the complexity of laboratories that work with select agents, the select agent regulations, and inspections have continued to increase, which may continue to contribute to workload issues in the future. Program officials we interviewed said they are hopeful that the new database the program is implementing will allow the program to gain efficiencies in amendment processing and other areas, which may reduce workload issues in the future. Training to Improve or Maintain Expertise Most laboratory representatives we interviewed said that, in their experience, Select Agent Program inspectors generally had appropriate expertise to perform reviews. According to agency documents, the vast majority of the program’s inspectors have advanced degrees, including many inspectors from CDC with doctoral degrees in microbiology or related fields and many inspectors from APHIS with doctoral degrees in veterinary medicine. However, CDC and APHIS internal reviews from 2015 and 2016, respectively, as well as some laboratory representatives we interviewed, identified some shortcomings and inconsistencies in inspectors’ expertise and approach related to their regulatory responsibilities. In particular, the reports found that inspectors had inconsistent knowledge about the select agent regulations, variabilities in skill level, and divergent approaches to inspections, both within and across the two components of the Select Agent Program. In addition, several laboratory representatives said that some inspectors imposed requirements on laboratories that the inspectors considered to be best practices rather than requirements of the select agent regulations or items on inspection checklists. Both CDC and APHIS officials in the program identified gaps in the training available to maintain their expertise. CDC inspectors we interviewed told us they need additional training opportunities to keep up with scientific changes in the field, such as advances in laboratory techniques and equipment. APHIS officials we interviewed also identified areas where they need additional training, including in facilities and engineering aspects of laboratories; decontamination; and new laboratory techniques, technologies, and equipment. In addition, some APHIS inspectors we interviewed said that they sometimes do not have the necessary knowledge to effectively perform all aspects of inspections and, in some cases, depend on inspectors from CDC to address gaps in expertise. Relying on CDC inspectors when APHIS is inspecting CDC- owned laboratories raises conflict of interest concerns. Furthermore, according to inspectors from both CDC and APHIS, they are rarely able to attend external conferences or other external training because of their intensive workload and travel schedules and because they must compete for training funds with CDC or APHIS scientists who are not assigned to the program. Priority is given to those scientists presenting information at conferences, which Select Agent Program staff rarely do because their inspection work is not the type of information shared at conferences, according to program officials. In response to these concerns, both the CDC and APHIS components of the Select Agent Program have individually taken steps to improve training for program staff, including inspectors, but have not always coordinated steps to manage fragmentation across the program. For example, in 2016, APHIS increased training opportunities for two inspectors to better enable them to inspect BSL-4 laboratories. In addition, CDC developed a training strategy that identified various areas in its training program that needed improvement, including the need to provide funding support for existing training activities and enhanced professional development opportunities. According to CDC’s training strategy, the complexity of the inspector position and evolving science on select agents demand ongoing training and professional development opportunities for staff. Among other recommendations, the strategy identified the need for three additional full- time-equivalent positions in the training area—in addition to the one the CDC component of the program currently has; as of August 2017, CDC was in the process of hiring one additional training specialist. APHIS has not developed a similar formal training strategy, but during the course of our review, APHIS sought and received approval and funds to hire a full-time training coordinator, which it was in the process of filling as of July 2017. Because APHIS has not had a training coordinator dedicated to the Select Agent Program in the past, the APHIS component of the program has generally relied on CDC to address training needs, although APHIS does provide its own training to its inspectors and has coordinated with CDC to develop some training, according to APHIS officials. A senior APHIS official noted that having its own training coordinator moving forward will help ensure APHIS’s training needs are met, as animal inspection needs have not explicitly been addressed in the past when CDC has taken the lead on training. Transparency The organization should provide access to key information, as applicable, to those most affected by operations. According to our key elements of effective oversight, the organization conducting oversight should provide access to key information, as applicable, to those most affected by operations. Past White House and other reports, as well as experts at our meeting, also emphasized the importance of transparency, including the sharing of information on incidents and lessons learned, in the Select Agent Program. However, the program limits the information it shares about registered laboratories and violations of the select agent regulations, mainly because of security concerns. For example, the program does not disclose to the public or other laboratories the locations of laboratories registered with the program, the agents that laboratories work with, or details on violations of select agent regulations. The Select Agent Program has recently increased the transparency of high-level laboratory and program information it shares with the public and registered laboratories, partly in response to recent federal reports. For example, in 2016, the Select Agent Program issued its first annual public report on the program. The report provided a variety of information, such as background information on the program, statistics about registered laboratories, and aggregated information on the potential losses and releases reported to the program. In 2015, the program developed a mechanism for laboratories to request interpretation of the select agent regulations from the program and has since published several regulatory interpretations on its website. In addition, starting in summer 2016, the Select Agent Program worked with a nongovernmental organization, the American Biological Safety Association International, to develop an online forum for registered laboratories to share information with one another, which laboratory representatives told us has been very helpful. The Select Agent Program also held a workshop for responsible officials from registered laboratories in December 2016 to disseminate program information; the workshop also provided the opportunity for attendees to interact. Many laboratory representatives told us that this was very helpful, and some noted that they had not had an opportunity to communicate and share lessons learned with responsible officials from other registered laboratories in the past. Even so, some experts, agency officials, and laboratory representatives we interviewed said there needs to be more transparency to the public about select agent research and incidents in order to increase public trust concerning the activities conducted at high-containment laboratories. For example, several laboratory representatives noted that the media has incorrectly described their laboratories as conducting “bioterror” research, when the research they conduct is to mitigate the consequences of a bioterrorist attack—for example, by developing vaccines and other measures to help diagnose, prevent, or treat exposure to or infection with select agents. On the other hand, many laboratory representatives told us that the program was already sharing an appropriate amount of information with the public. According to officials from HHS and USDA, this issue has been examined and discussed extensively within their departments, partly in response to recent federal reports. CDC officials pointed out that laboratories themselves could share additional information about their select agent research and any incidents. For example, the U.S. Army Medical Research Institute for Infectious Diseases and the National Biodefense Analysis and Countermeasures Center, both at Fort Detrick in Maryland, and the Galveston National Laboratory in Galveston, Texas, voluntarily share information about their select agent research and incidents with the public via their websites. In addition, many laboratory representatives we interviewed said the program needs to be more transparent for registered laboratories. In particular, some said that it would be helpful for the program to share more information among laboratories about select agent research and incidents to enhance the sharing of lessons learned to improve biological safety and security. According to experts at our meeting, it is important for information, such as lessons learned from incidents, to be shared among laboratories so that they can learn from one another’s experiences to improve their own operations. Some laboratory representatives also said that it would be helpful for the Select Agent Program to provide additional guidance in certain areas, such as regarding the use and storage of toxins. Federal internal control standards state that management should internally and externally communicate the necessary quality information to achieve the entity’s objectives. However, there is no consensus about what additional information should be shared with laboratories. Without determining what additional information about laboratories’ use of select agents, incidents, and violations of the select agent regulations is appropriate for the Select Agent Program to share with registered laboratories, the program may be missing opportunities to provide key information that ultimately could help improve biological safety and security. According to our key elements of effective oversight, the organization conducting oversight should have clear and sufficient authority to require entities to achieve compliance with requirements. The Select Agent Program has the authority to and takes a range of enforcement actions for violations of the select agent regulations and is working to address concerns about the clarity and consistency of enforcement actions. When the Select Agent Program identifies a possible violation of the select agent regulations, the program may take several types of compliance or enforcement actions, as follows: Administrative actions: The Select Agent Program can propose a corrective action plan; suspend or revoke a registered laboratory’s registration; or deny a laboratory’s application to possess, use, or transfer select agents. Referrals to HHS OIG or APHIS’s Investigative and Enforcement Services: The Select Agent Program may refer violations to HHS OIG or APHIS’s Investigative and Enforcement Services, both of which can levy civil money penalties, issue a Notice of Violation letter, or close the case. Referral to the FBI: The Select Agent Program can refer possible violations involving criminal negligence, criminal intent, or suspicious activity or person to the FBI for further investigation. Criminal enforcement may include imprisonment for up to 5 years, a fine, or both. The Select Agent Program has taken enforcement actions against laboratories but did not always do so consistently or according to any available criteria. The Select Agent Program has taken a range of enforcement actions for violations of the select agent regulations— including suspending or revoking registrations or proposing corrective action plans—as well as referring violations to HHS OIG or APHIS’s Investigative and Enforcement Services for further investigation. Following investigation, HHS OIG and APHIS’s Investigative and Enforcement Services have taken other enforcement actions, including levying civil money penalties and issuing Notice of Violation letters. However, we previously found in 2016 that the Select Agent Program did not consistently refer laboratories to investigative entities for violations of the select agent regulations or enforce regulations related to incidents involving incomplete inactivation, and we found that this appears to be true beyond incidents involving incomplete inactivation as well. For example, from 2003 through 2016, the program suspended or revoked 10 laboratories’ registrations in response to violations of the select agent regulations, only 1 of which was a federal laboratory, and neither HHS OIG nor APHIS’s Investigative and Enforcement Services have levied a civil money penalty against a federal laboratory. Moreover, we previously found that the program referred various laboratories to HHS OIG for incidents involving incomplete inactivation but did not refer HHS laboratories for two incidents in 2014. We recommended in 2016 that the Select Agent Program develop and implement consistent criteria and documentation requirements for referring laboratories to investigative entities and enforcing regulations. The Select Agent Program is taking steps to address such past concerns about the need for greater consistency and clarity in enforcement actions and implement our recommendation. In particular, in September 2017, the program finalized a document that provides guidance on when to refer laboratories for violations and options for enforcement. This document categorizes regulatory departures along a spectrum of severity with associated enforcement options, so that inspectors and laboratories have a clear understanding of what to expect during and as a result of inspections, regardless of which Select Agent Program component conducts them. In addition, the CDC component of the program worked with HHS OIG to develop criteria to guide referrals to OIG, which CDC finalized and implemented in June 2017. APHIS is not developing a similar document at this time because APHIS officials believe the guidance on when to refer laboratories for violations and options for enforcement actions described above provides sufficient guidance on referrals for the Select Agent Program. The program’s development of guidance with criteria is a positive step and the program continues to develop associated documentation requirements for referring violations to investigative entities and enforcing regulations, according to a senior program official. As of August 2017, the Select Agent Program does not have joint strategic planning documents to guide its shared oversight efforts across CDC and APHIS. For example, the program does not have a joint mission statement to collectively define what the program seeks to accomplish through its oversight. It also does not yet have a strategic plan, although it is taking steps to develop one. Agencies can use strategic plans to set goals and identify performance measures for gauging progress towards those goals. Strategic plans can also outline how agencies plan to collaborate with each other to help achieve goals and objectives, as well as describe the strategies and resources required to achieve the goals and objectives. Mission statements for the two components of the Federal Select Agent Program The Centers for Disease Control and Prevention’s (CDC) Division of Select Agents and Toxins reduces the risks for thefts, losses, and releases of biological agents by ensuring regulated laboratories or importers are safe and select agents are secure through its monitoring of facilities and enforcement of regulations. The Animal and Plant Health Inspection Service’s (APHIS) Agriculture Select Agent Services is a team of Agriculture Health Professionals dedicated to providing superior customer service to safeguard the health of domestic animals, plants, and their products from agricultural biological agents and toxins. Each component of the program has conducted some strategic planning—each has an individual mission statement, some strategic planning documents, and performance measures—but the components differ in what they seek to achieve and how they measure the effectiveness of their efforts. For example, according to CDC officials, in the past, the CDC component has developed yearly strategic goals, such as to improve regulatory oversight through inspections and the biological safety and security of laboratories. In contrast, APHIS developed a 5-year business plan for its component of the Select Agent Program in 2014, which it updated in July 2017. In addition, it identified a number of annual goals in 2015, 2016, and 2017, such as developing additional BSL-4 training and filling vacancies in existing and new positions. CDC’s and APHIS’s performance measures also differ. For example, CDC has a range of performance measures, such as tracking the number of laboratory-acquired infections and the timeliness of inspection reports, whereas APHIS’s performance measures address the number of thefts, losses, and releases involving select agents and the processing of amendments. The Select Agent Program also does not have a joint workforce plan that collectively identifies workforce and training needs to ensure the program as a whole has the appropriate workforce with sufficient expertise to carry out its responsibilities and that resources are being leveraged appropriately across the two components of the program. According to our past work, strategic workforce planning is an essential tool to help agencies align their workforces with their current and emerging missions and develop long-term strategies for acquiring, developing, and retaining staff. Moreover, the Select Agent Program has not collectively determined its training needs. The APHIS component of the program has generally relied on CDC to help meet its ongoing training needs, as noted, but we found through our review of CDC’s training strategy that it did not specifically address APHIS’s training needs. According to program officials, joint training provided in the past has not always explicitly addressed animal inspection needs, as noted. Program officials noted that the program has taken some steps to coordinate training, such as holding joint inspector training and webinars. Senior program officials told us that, even without joint strategic planning documents, the CDC and APHIS components of the Select Agent Program manage fragmentation by collaborating on many aspects of the program, such as through maintaining frequent communication at the director level. They also said that the program had not developed a joint mission statement or strategic planning tools in the past because they prioritized other efforts in recent years, including responding to incidents that occurred in 2014 and 2015, addressing recommendations from recent reports, and developing a new database for the Select Agent Program. In addition, each component of the program has generally focused on its own agency’s needs when conducting workforce planning. One senior CDC official said that the Select Agent Program had always been in “reactive mode” and noted that the program could improve its oversight if it took a more strategic view. During the course of our review, senior program officials told us that they were taking steps to develop a joint strategic plan for the Select Agent Program and, in August 2017, the program began soliciting bids from contractors for the plan’s development. The statement of work for the contract states that the contractor shall develop guiding principles for the Select Agent Program along with a mission statement, strategic goals and objectives, and performance measures, among other requirements. However, the statement of work for the contract does not have any requirements related to development of a joint workforce plan. We have found in the past that agencies’ strategic workforce planning should be clearly linked to the agency’s mission and long-term goals developed during the strategic planning process. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program to better manage fragmentation by improving how it leverages resources to ensure all workforce and training needs are met; this assessment should be done in conjunction with the development of the strategic plan. Leveraging of resources is especially important given fiscal constraints and the uneven level of resources across the two components of the program. Selected countries and regulatory sectors employ approaches to promote effective oversight that, in some cases, differ from those of the Select Agent Program. For example, other countries and sectors have regulatory bodies that are structurally independent from the entities they oversee, take a risk-based approach to performing reviews, rely on scientists and other laboratory personnel to have requisite technical expertise on the pathogens and activities in their laboratories, share incident information on their public websites, and have prosecutorial authority when incidents occur. Some countries and sectors we reviewed have regulatory bodies that are structurally independent from the entities they oversee. For example, Great Britain’s Health and Safety Executive, whose mission is to protect worker and public health and safety and who oversees laboratories that work with pathogens, is an independent central government agency, according to officials. It has a chief executive accountable to the UK government’s Department of Work and Pensions and a public-private board composed of representatives from a range of industries, including trade unions. Officials noted that this structure, an independent agency with direct access to a departmental head, allows the Health and Safety Executive to have control over defining its own budget and staffing needs. According to officials from the Health and Safety Executive and laboratory representatives we interviewed, one strength of this approach is that it avoids potential organizational conflicts of interest because none of the laboratories that the Health and Safety Executive oversees are part of the same agency. Great Britain’s Health and Safety Executive The Health and Safety Executive is an independent regulator in Great Britain whose mission is to prevent death, injury, and illness in the workplace. It was originally established following a government review of the health and safety system in the country in 1974. One division within the Health and Safety Executive—the Chemical, Explosives and Microbiological Hazards Division—regulates sectors that have the potential for low- probability, high-consequence incidents, including work in high-containment laboratories. It began overseeing laboratories following a smallpox outbreak in 1978. Great Britain reviewed the regulations for animal pathogens and rewrote them to make them more aligned with the human pathogen and genetically modified organism frameworks after a 2007 safety incident in which a Great Britain laboratory inadvertently released foot and mouth disease into the environment. The Health and Safety Executive is responsible for safety oversight of pathogens that present a risk to human health as well as animal pathogens. A separate entity, the National Counter Terrorism Security Office, is responsible for security oversight of a subset of pathogens that pose biological security concerns, similar to the United States’ select agents. The Health and Safety Executive and the National Counter Terrorism Security Office work closely together in providing oversight, according to officials. As of July 2017, Great Britain had a total of 434 registered high-containment laboratories across the government, academic, and private sectors. Some other regulatory sectors in the United States are also structurally independent from regulated facilities as a mechanism to ensure independence. For example, prior to the creation of NRC in 1974, the U.S. Atomic Energy Commission was responsible for both promotion and oversight of the nuclear industry. The Energy Reorganization Act of 1974 established NRC as a separate, independent entity. According to a relevant Senate committee report, this was a response to growing criticism that there was a basic conflict between the U.S. Atomic Energy Commission’s regulation of the nuclear power industry and its development and promotion of new technology for the industry. Independence is one of NRC’s “Principles of Good Regulation” that the commission seeks to follow in carrying out its regulatory activities. NRC’s Office of Nuclear Reactor Regulation uses performance metrics associated with these principles—including measures of the objectivity and independence of its inspectors—to annually evaluate the effectiveness of its Reactor Oversight Process in meeting its pre- established goals and intended outcomes. This office reports the results of this analysis to NRC in an annual report on the self-assessment of the Reactor Oversight Process. Other countries and sectors we reviewed have adopted risk-based approaches to reviewing compliance with regulatory requirements. In particular, regulators in some countries, including Great Britain and Canada, apply a risk-based approach to target their reviews to laboratories with a documented history of performance issues or those conducting higher-risk activities. Great Britain’s Health and Safety Executive prioritizes which laboratories to inspect during the year by assessing the level of risk a specific laboratory or program may have on worker or public health and safety or the environment, according to officials. This assessment takes into consideration factors such as which pathogens pose a greater risk, how these pathogens are used in the laboratory, and the potential consequences of an incident. For example, officials noted that a laboratory complex that works with many pathogens that may pose a significant risk to the country—such as animal pathogens that affect livestock and the food supply—may be subject to more oversight and additional inspections from regulators, based on the associated risk assessment, than a diagnostic laboratory that may destroy samples after testing. The Public Health Agency of Canada is responsible for promoting and protecting the health of Canadians through various public health initiatives. It was established in 2004, partly in response to an outbreak of severe acute respiratory syndrome (SARS) in 2003, when it became evident that Canada had no legal requirements for domestic laboratories to report information such as whether they were working with SARS samples, and therefore officials could not determine the potential scope of the problem. The agency sits under Canada’s Minister of Health and its Centre for Biosecurity is responsible for administering and enforcing Canada’s Human Pathogens and Toxins Act to oversee the safe and secure handling of human pathogens and toxins. The act came into full force in December 2015, following an extensive consultation process with stakeholders. The Centre for Biosecurity has authority to license and oversee laboratory activities involving human pathogens and toxins, some animal pathogens, and a subset of human pathogens that have additional biological security concerns. Oversight responsibility for the other animal pathogens rests with the Canadian Food Inspection Agency. As of June 2017, Canada had a total of 63 licensed high-containment laboratories across the government, academic, and private sectors. Similarly, officials from the Public Health Agency of Canada’s Centre for Biosecurity, whose mission is to protect the health and safety of the public against the risks posed by human pathogens and toxins, stated that their division for the oversight of laboratories that work with pathogens also has a risk-based licensing and inspection scheme. Under this scheme, the stringency of licensing and inspection requirements largely depends on the pathogen’s risk level. In addition, the Public Health Agency of Canada places different requirements on activities carried out in laboratories depending on their sector (e.g., public health or research) because it determined that activities in certain sectors present a higher risk than others, with the research sector having the highest associated risks. As such, the Public Health Agency of Canada places additional requirements on research scientists conducting certain activities with pathogens than it does with respect to personnel conducting activities in other types of laboratories. For example, the agency requires research scientists to develop and submit documentation that demonstrates a reasonable plan to manage risk and promote compliance with requirements. Officials noted that this approach helps the agency to understand where best to focus its efforts to achieve the desired risk mitigation results. According to officials from both Great Britain and Canada, this risk-based approach helps the oversight bodies in both countries focus their limited resources on laboratories they have identified as having the highest risks. In addition, Great Britain’s Health and Safety Executive and the Public Health Agency of Canada apply a risk-based approach in determining the focus of their inspections. For example, according to agency officials in Great Britain and Canada, because they have not found stringent inventory requirements to be effective in reducing biological safety risks in the laboratory, neither country places as much focus, time, or resources on inventory management as the Select Agent Program does. For example, neither country spends time during every inspection counting and examining vials and comparing them to inventory logs, according to officials. Instead, Great Britain’s Health and Safety Executive’s approach is to sample laboratories’ biological safety measures and assess whether they have mechanisms in place to mitigate the consequences of incidents should they occur. Similarly, in Canada, the Canadian Biosafety Standard requires that laboratories working with pathogens in high-containment have an inventory tracking system that is based on the risks internally identified by the laboratory, in order to allow for timely identification of missing vials if necessary. In addition to having less prescriptive inventory requirements than the Select Agent Program, both Great Britain’s Health and Safety Executive and the Public Health Agency of Canada generally focus their oversight on (1) biological safety, and (2) regulation of all potentially hazardous pathogens in laboratories. In contrast, the Select Agent Program originated from security-related concerns and regulates only those pathogens identified on the U.S. select agent list and no other pathogens, such as West Nile virus, that may be handled in high- containment but are not select agents. In both Great Britain and Canada, specific biological safety incidents provided the impetus for establishing oversight for laboratories that work with pathogens and, as a result, their regulatory agencies generally focus on biological safety. Both Great Britain and Canada have additional oversight requirements, such as security clearances for personnel, for a limited number of pathogens for which they have heightened security concerns, similar to the security requirements for working with select agents in the U.S. For example, in Great Britain, the Health and Safety Executive focuses on only biological safety in its oversight of high-containment laboratories and works with the National Counter Terrorism Security Office for oversight of pathogens with biological security concerns. In addition, to ensure compliance with biological safety regulations, officials we interviewed in Great Britain and Canada told us it was beneficial for their programs to have oversight over all hazardous pathogens that present biological safety risks to laboratory workers and the public, regardless of their containment level and their potential to pose biological security concerns. For example, the Public Health Agency of Canada regulates any pathogens with characteristics that require handling in laboratories equivalent to U.S. BSL-2, -3, or -4, which currently covers thousands of pathogens, according to officials, as opposed to the 66 agents on the U.S.’s select agent list. NRC also considers risk in its oversight of nuclear reactors, fuel cycle facilities, and radioactive materials. In particular, for facilities that work with nuclear materials, NRC conducts inspections of a fraction of these facilities each year because, according to officials, there is a lower risk associated with nuclear materials than there is with nuclear power plants. There are no resident inspectors at these facilities; instead, the frequency of inspections for nuclear materials is based on the risk associated with, among other things, the specific material and each facility’s past performance. Sites with past issues will receive more attention, while sites with a history of good performance will generally be subject to the minimum frequency of inspections applicable to that type of site. In contrast, as part of its Reactor Oversight Process, NRC places at least two resident inspectors at each of the country’s commercial nuclear power plants because they pose a higher risk. For nuclear power plants, potential incidents can have high-consequences and far-reaching effects, such as the effects of the 2011 nuclear accident at the Fukushima Daiichi reactor in Japan. To ensure that each nuclear power plant is complying with federal safety requirements, these inspectors oversee a variety of activities on a daily basis, including by visiting control rooms, reviewing logbooks, performing visual assessments, and observing tests and repairs. Other countries have adopted various approaches to help ensure they have access to individuals with the appropriate expertise to perform sound safety and security assessments. According to officials in Great Britain, regulators at the Health and Safety Executive have access to external expert advisory committees to advise on issues related to new or emerging pathogens, diseases, or other scientific issues that inspectors may encounter during inspections or when developing policy. Health and Safety Executive officials noted that they generally go to the committees with questions of science and not regulation, as the inspectors are expected to be experts in biological safety and Great Britain regulations. Both France and Germany also have expert advisory committees that regulators can consult on scientific and technical issues, according to officials from these countries. Merging Oversight of Human and Animal Pathogens in Great Britain and Canada Great Britain merged the inspection and oversight responsibilities for human and animal pathogens into one oversight body, the Health and Safety Executive, in 2008, following the 2007 accidental release of foot and mouth disease into the environment. Oversight of animal pathogens was originally under the United Kingdom’s Department for Environment, Food, and Rural Affairs (DEFRA). When oversight of animal pathogens was first transferred to the Health and Safety Executive, DEFRA initially retained the licensing of sites with animal pathogens. In 2015, DEFRA transferred all oversight responsibilities, including licensing, to the Health and Safety Executive, but retained responsibilities for policy matters. According to agency officials and laboratory representatives in Great Britain, this change had a number of benefits, including creating a single agency contact for laboratories that work with regulated pathogens, strengthening the oversight of animal pathogens, and improving the logistics and ease of the system. Similarly, in 2013, Canada transferred the oversight responsibility for a subset of animal pathogens from the Canadian Food Inspection Agency (CFIA) to the Public Health Agency of Canada to strengthen and harmonize its biological safety oversight framework and reduce the regulatory and administrative burden on researchers and laboratory officials. CFIA continues to issue permits for other animal pathogens, such as emerging animal diseases, which, according to officials, only make up a small number of pathogens. Officials from the Public Health Agency of Canada noted that they address the issue of technical expertise in part by placing substantial responsibility on the scientists and other personnel in each laboratory to understand and address the risks associated with their specific work, such as the equipment and procedures used in that laboratory. Officials from the Public Health Agency of Canada noted that personnel working in licensed laboratories are the ones most at risk if a safety lapse or other incident occurs, so the agency expects the responsible individuals at the laboratories to reinforce the requirements and help ensure everyone works safely and is in compliance with requirements. Under this approach, the main responsibility is with the laboratory officials to understand and manage the risks inherent in the work being performed at their facility, while the role of the inspector is to verify that they have taken appropriate steps to identify and address the risks. According to officials in the Netherlands, regulators place responsibility for laboratory biological safety on biological safety officers at each of the laboratories by accrediting them for the oversight of biological safety. Regulators conduct the accreditation process, which includes a review of personnel credentials, before individuals can be accredited. A 2-day course on the laws—such as details of biological safety requirements, case studies, review of transportation rules, and incident examples—is offered to each new accredited biological safety officer. Biological safety officers usually first seek accreditation for the equivalent of U.S. BSL-1 or -2 laboratories and must request additional reviews to receive accreditation for higher levels after acquiring the requisite knowledge and applied laboratory experience for the levels for which they are requesting accreditation. Officials from the Netherlands noted that it is important to have biological safety officers in laboratories as these individuals are versed in biological safety and can convey to researchers what they should be doing to ensure safety, as the regulator cannot be on-site every day. Some countries and regulatory sectors have approaches that provide transparency to entities and the public in a number of ways. For example, in Great Britain, the Health and Safety Executive shares information on licensing, enforcement actions, and prosecutions, among other information, through its website and the public register. Health and Safety Executive officials noted that the agency also issues information to licensed laboratories when there are safety alerts, lessons learned, or key decisions that it feels are pertinent to the regulated community. However, officials limit the sharing of any information that is sensitive or has security concerns, such as the names of individuals cleared to work with pathogens, which poses additional security concerns. Regulators in the Netherlands stated that they are also authorized to share a great deal of information related to some regulated pathogens, such as laboratory risk assessments, with the public and individuals who request the information. Similarly, in Switzerland, the public can request some information about laboratory licenses and the types of activities that occur at laboratories, but regulators do not share information on laboratory exposures because, according to a Swiss official, the public is not generally affected by them so the officials do not feel a need to share such information. NRC shares safety-related information on nuclear facilities with the public, including by posting the locations of nuclear facilities, inspection reports, and policies on its website. According to NRC officials, NRC believes transparency is important because, otherwise, secrecy can lead to distrust and negatively affect NRC’s relationship with industry and the public. In addition, NRC has written policies available on its website that detail what information it shares with registered facilities and the public, as well as guidance for NRC staff on what they can and cannot share. NRC officials stated that NRC strives for a balance between openness and security and that, because the nuclear sector’s needs and the public’s concerns are constantly changing, it is important to reassess policies as the necessity arises. For example, after the September 11, 2001, terrorist attacks, NRC decided to remove some information from the public sphere in response to concerns that such information could be misused and exploited for future terrorist attacks. The Federal Aviation Administration also shares information with the public through its Aviation Safety Information Analysis and Sharing System, which collects information from multiple databases, including voluntarily reported near-miss data and accident information. This system is intended to promote an open exchange of safety information to continuously improve aviation safety, and it allows users to perform integrated queries, search safety data, and review incident investigations conducted by the National Transportation Safety Board. For example, analysts from the Federal Aviation Administration analyzed data from the Aviation Safety Information Analysis and Sharing System to determine which weather-related factors posed the biggest threats to pilots and aircraft. In addition, the Federal Aviation Administration provides public access to a library of lessons learned from historically significant, policy- shaping accidents to share key knowledge across the industry to improve aviation safety through the application of such lessons and to understand how the current safety regime has been influenced by past accidents. For example, the library discusses how two similar high-terrain crashes in the 1990s led to a requirement in 2000 to install a warning system in aircraft to reduce the incidence of such terrain accidents. Countries and regulatory sectors we reviewed employ a range of mechanisms to take enforcement actions against entities or to encourage incident reporting. For example, Great Britain, Canada, France, and Switzerland all have the ability to pursue criminal prosecution in response to serious violations of their laws or regulations governing high- containment laboratories, in addition to the ability to suspend work or shut down laboratories. In Canada, penalties for the most serious violations can include up to 10 years in prison. Officials from the Public Health Agency of Canada and representatives from laboratories we spoke with noted that laboratory personnel are still encouraged to report incidents in laboratories, such as laboratory-acquired infections, regardless of the potentially heavy penalties, because certain information that is voluntarily provided during the course of an incident cannot then be used in any subsequent criminal proceedings against that individual. In addition, experts from our meeting noted that the nonpunitive nature of airline reporting systems also encourages people to report incidents, which in turn provides valuable information to regulators, pilots, airlines, and the public that has been used to improve airline safety, as noted. In their joint management of the Select Agent Program, CDC and APHIS share a critical role in ensuring that important research on select agents can be conducted in high-containment laboratories in a safe and secure manner. This role is especially important given the significant risks that pathogens handled in high-containment laboratories may pose to laboratory workers and the public. The Select Agent Program has made a number of improvements over the past few years, such as hiring additional staff and sharing more information with the public and registered laboratories. Nevertheless, the program does not fully meet all key elements of effective oversight. For example, the program is not independent in that it is not structurally distinct and separate from all of the laboratories it oversees. Both CDC and APHIS have individually made structural changes and put mechanisms in place to reduce conflicts of interest, but the APHIS component of the program has not documented the reporting process it developed to reduce conflicts of interest. Until APHIS formally documents the reporting structure for its component of the program from the APHIS director of the program to the administrator of APHIS, it will continue to appear to have conflicts of interest in its oversight of APHIS-owned laboratories. Moreover, APHIS has, on at least three occasions, inspected its own or other USDA laboratories, which is not in keeping with the memorandum of understanding it signed with the CDC component of the program. Without establishing control activities to help ensure that each component of the program carries out its inspection responsibilities as outlined in the program’s memorandum of understanding, the Select Agent Program cannot have reasonable assurance that its key mechanism to reduce conflicts of interest is implemented. In addition, the program has not formally assessed all potential risks posed by its current structure and the effectiveness of its mechanisms to address those risks. For example, the program did not identify some areas that may present conflicts of interest, such as APHIS carrying out inspections of its own laboratories, and has not considered whether there may be additional areas of concern. Without (1) regularly assessing the potential risks posed by the program’s current structure and the effectiveness of its mechanisms to address them, such as by commissioning external reviews, and (2) taking actions as necessary to ensure any identified risks are addressed, the program may not be aware of or effectively mitigate impairments to its independence that could affect its ability to achieve its objectives. Further, regarding the ability to perform reviews, the program may not be targeting the highest-risk laboratory activities in its inspections and other oversight efforts. Without developing and implementing a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities, the program will not have assurance that it is effectively balancing the potential safety and security gains from its oversight efforts against the use of program resources and the effect on laboratories’ research. Moreover, the program is not fully transparent because it shares only limited information about lessons learned and other matters with registered laboratories, and there is no consensus about what additional information should be shared. Without determining what additional information about laboratories’ use of select agents, incidents, and violations of the select agent regulations is appropriate for the Select Agent Program to share with registered laboratories, the program may be missing opportunities to provide key information that ultimately could help improve biological safety and security. In addition, the program has not had clarity and consistency in its enforcement actions and is taking steps to address our past recommendation. Further, regarding technical expertise, the two components of the Select Agent Program have individually hired additional staff for the program and improved training to enhance expertise, but workforce and training gaps remain. Although the program has begun to take steps towards development of a joint strategic plan to collectively guide oversight efforts, it does not have a joint workforce plan. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program to better manage fragmentation by improving how it leverages resources to ensure all workforce and training needs are met; this assessment should be done in conjunction with the development of the strategic plan. Leveraging of resources is especially important given fiscal constraints and the uneven level of resources across the two components of the program. We are making 11 recommendations to the agencies that manage the Select Agent Program, including 6 to APHIS and 5 to CDC: To improve independence, the Administrator of APHIS should formally document the reporting structure for the APHIS component of the Select Agent Program from the APHIS director of the program to the Administrator of APHIS. (Recommendation 1) To improve independence, the CDC director of the Select Agent Program should work with APHIS to establish control activities to help ensure that each component of the program carries out its inspection responsibilities as outlined in the program’s memorandum of understanding. (Recommendation 2) To improve independence, the APHIS director of the Select Agent Program should work with CDC to establish control activities to help ensure that each component of the program carries out its inspection responsibilities as outlined in the program’s memorandum of understanding. (Recommendation 3) To improve independence, the CDC director of the Select Agent Program should regularly assess the potential risks posed by the program’s structure and the effectiveness of its mechanisms to address those risks, such as by commissioning external reviews, and take actions as necessary to ensure that any identified risks are addressed so that impairments to independence do not affect its ability to achieve its objectives. (Recommendation 4) To improve independence, the APHIS director of the Select Agent Program should regularly assess the potential risks posed by the program’s structure and the effectiveness of its mechanisms to address those risks, such as by commissioning external reviews, and take actions as necessary to ensure any identified risks are addressed so that impairments to independence do not affect its ability to achieve its objectives. (Recommendation 5) To improve the ability to perform reviews, the CDC director of the Select Agent Program should work with APHIS to develop and implement a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities. (Recommendation 6) To improve the ability to perform reviews, the APHIS director of the Select Agent Program should work with CDC to develop and implement a plan to identify which laboratory activities carry the highest biological safety and security risks and to respond to those risks by aligning inspections and other oversight efforts to target those activities. (Recommendation 7) To improve transparency, the CDC director of the Select Agent Program should work with APHIS to determine what additional information about laboratories’ use of select agents, incidents, and violations of the select agent regulations is appropriate for the program to share with registered laboratories. (Recommendation 8) To improve transparency, the APHIS director of the Select Agent Program should work with CDC to determine what additional information about laboratories’ use of select agents, incidents, and violations of the select agent regulations is appropriate for the program to share with registered laboratories. (Recommendation 9) To improve technical expertise and overcome fragmentation, the CDC director of the Select Agent Program should work with APHIS to develop a joint workforce plan that assesses workforce and training needs for the program as a whole. This assessment should be done in conjunction with the development of the strategic plan. (Recommendation 10) To improve technical expertise and overcome fragmentation, the APHIS director of the Select Agent Program should work with CDC to develop a joint workforce plan that assesses workforce and training needs for the program as a whole. This assessment should be done in conjunction with the development of the strategic plan. (Recommendation 11) We provided a draft of this report for review and comment to DOD, HHS, the Department of Homeland Security, NRC, the Department of Transportation, and USDA. We also provided copies to officials from Great Britain, Canada, and the Netherlands, as well as experts who participated in our expert meeting at the National Academy of Sciences. HHS and USDA—the agencies to whose components our recommendations are directed—both provided written comments agreeing with all of our recommendations. These comments are reprinted in appendixes III and IV, respectively. In their comments, HHS and USDA provided additional information about steps they are taking, or planning to take, to improve their oversight of select agents and to address our recommendations. For example, HHS and USDA stated that the Select Agent Program will explore options to improve independence, including reexamining previous reviews and assessing the need for additional reviews to ensure potential risks posed by the program’s structure are adequately assessed and addressed. In addition, to improve the ability to perform reviews, HHS and USDA stated that the Select Agent Program is transitioning to a new secure information system that will allow the program to develop analytical tools and procedures to analyze risk- related data to improve the inspection process. Further, to enhance transparency, HHS and USDA said the program is exploring ways to disseminate information regarding common deficiencies identified during inspections. Finally, to improve technical expertise and overcome fragmentation, HHS and USDA said that the program has initiated contract support for development of a joint strategic plan that will include the assessment of workforce and training needs. HHS and USDA also provided technical comments, as did the Department of Homeland Security; officials from Great Britain, Canada, and the Netherlands; and a number of experts who participated in our expert meeting at the National Academy of Sciences. We incorporated these comments as appropriate. DOD, NRC, and the Department of Transportation did not comment on this report. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees; the Secretaries of Agriculture, Defense, Health and Human Services, Homeland Security, and Transportation; the Chairman of NRC; the Director of CDC; the Administrator of APHIS; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Timothy M. Persons, Chief Scientist, at (202) 512-6412 or personst@gao.gov or John Neumann, Director, Natural Resources and Environment, at (202) 512-3841 or neumannj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. This appendix describes the steps we took to confirm the applicability of five elements of effective oversight we have used in the past for our evaluation of the Federal Select Agent Program (Select Agent Program). We have used these key elements in the past for assessing the effectiveness of oversight in other areas where low probability adverse events can have significant and far-reaching effects. These elements are as follows: Independence: The organization conducting oversight should be structurally distinct and separate from the entities it oversees. Ability to perform reviews: The organization should have the access and working knowledge necessary to review compliance with requirements. Technical expertise: The organization should have sufficient staff with the expertise to perform sound safety and security assessments. Transparency: The organization should provide access to key information, as applicable, to those most affected by operations. Enforcement authority: The organization should have clear and sufficient authority to require that entities achieve compliance with requirements. We took several steps to confirm the applicability of these elements for our examination of the Select Agent Program. First, we discussed the applicability of the criteria with senior officials from both components of the Select Agent Program, within the Centers for Disease Control and Prevention (CDC) and the Animal and Plant Health Inspection Service (APHIS). Second, we discussed the elements with representatives from the American Society of Microbiology and American Biological Safety Association International, which were selected because of their focus on microbiology and biological safety, respectively. Finally, we discussed the elements with experts during our National Academy of Sciences meeting (see app. II for information on this meeting). The officials, representatives, and experts generally agreed that the five elements were appropriate for our examination of the Select Agent Program. We compared information from federal documents about the Select Agent Program’s oversight, interviews with laboratory representatives and agency officials, and our expert meeting against the five elements of effective oversight. Security Systems, University of Maryland Andrew Cottam, Ph.D., Head of the Microbiology and Biotechnology Unit, Health and Safety Executive, United Kingdom John Eakin, Principal Investigator, Air Data Research David Franz, DVM and Ph.D., Former Commander, United States Army Medical Research Institute for Infectious Diseases Gigi Kwik Gronvall, Ph.D., Senior Associate, Johns Hopkins Center for Health Marianne Heisz, Ph.D., Director, Office of Biosafety Programs and Planning, Public Health Agency of Canada Ruthanne Huising, Ph.D., Associate Professor, McGill University Gavin Huntley-Fenner, Ph.D., Principal Consultant, Huntley-Fenner Advisors Joseph Kanabrocki, Ph.D. and NRCM(SM), Associate Vice-President for Research Safety, Professor of Microbiology, University of Chicago Paul Keim, Ph.D., Regents Professor and Cowden Chair, Northern Arizona James LeDuc, Ph.D., Director, Galveston National Laboratory, University of Texas Medical Branch Carol Linden, Ph.D., Director, Office of Regulatory Science and Innovation, Food Allison MacFarlane, Ph.D., Professor and Director, Center for International Science and Technology Policy, George Washington University Brian O’Shea, Ph.D., Senior Biological Safety Officer, Battelle Memorial Institute Karlene Roberts, Ph.D., Professor Emeritus, Haas School of Business, University Jonathan Rosen, Principal Industrial Hygiene Safety and Health Consultant, AJ Rosen and Associates, LLC The comments of these experts generally represented the views of the experts themselves and not the agency, university, or company with which they are affiliated. The meeting with these experts was held at NAS in January 2017. To identify experts to participate in the meeting, we worked iteratively with NAS staff to identify and review biographical information and relevant qualifications of experts, as well as factors such as representation from academia, industry, and federal government and expertise in a range of areas. The Board on Life Sciences of NAS solicited nominations for the expert panel from its extensive contacts in laboratory safety, biological security, and other regulatory sectors, such as occupational safety and health, airline safety, food safety, and chemical safety. These contacts included current and former committee members, current and former members of the Board on Life Sciences, and select members of NAS. NAS received responses from approximately 45 nominees. From this initial list, NAS selected experts based on their knowledge and expertise in the above-mentioned areas as well as their ability to attend the meeting on the chosen dates and obtained our approval of its selections. In order to facilitate discussion among participants, NAS did not include any federal employees or contractors of the Select Agent Program. The final list of 18 experts was then evaluated for any conflicts of interest. A conflict of interest was considered to be any current or financial or other interest that might conflict with the service of an individual because it (1) could impair objectivity and (2) could create an unfair competitive advantage for any person or organization. The 18 experts were determined to be free of conflicts of interest, and the group as a whole was judged to have no inappropriate biases. We developed the session topics for the 2-day meeting based on our researchable objectives and issues that we identified in our audit work, including our analysis of agency documents and interviews with agency officials and representatives from registered laboratories. The meeting was recorded and transcribed to ensure that we accurately captured the experts’ statements, and we reviewed and analyzed the transcripts as a source of evidence. Although the expert meeting was not designed to reach formal consensus on the issues, a number of themes emerged from the group’s discussion to which there was general agreement. In addition to the individuals named above, Mary Denigan-Macauley (Assistant Director), Sushil Sharma (Assistant Director), Amy Bowser, William Carrigg, Marcia Crosse, Caitlin Dardenne, Shana Deitch, Karen Doran, Jack Melling, Cynthia Norris, Lesley Rinner, Sara Sullivan, Walter Vance, and Elizabeth Wood made key contributions to this report.

Summary: Safety lapses continue to occur at some of the 276 laboratories in the United States that conduct research on select agents—such as Ebola virus or anthrax bacteria—that may cause serious or lethal infection in humans, animals, or plants, raising concerns about whether oversight is effective. GAO was asked to review the federal oversight approach for select agents and approaches from other countries or regulatory sectors. This report (1) evaluates the extent to which the Select Agent Program has elements of effective oversight and strategic planning documents to guide it, and (2) identifies approaches selected countries and regulatory sectors have used to promote effective oversight. GAO convened a meeting of experts with the help of the National Academy of Sciences to discuss oversight of select agents. GAO also reviewed relevant laws, regulations, and guidance, and interviewed officials from the Select Agent Program and laboratories it oversees. GAO also reviewed documents and interviewed officials from two countries and other U.S. sectors selected because they have alternate oversight approaches. The Federal Select Agent Program (Select Agent Program)—jointly managed by the Departments of Health and Human Services (HHS) and Agriculture (USDA)—oversees laboratories' handling of certain hazardous pathogens known as select agents, but the program does not fully meet all key elements of effective oversight, as illustrated in the following examples: GAO's past work identified independence as a key element of effective oversight. However, the Select Agent Program is not structurally independent from all laboratories it oversees, and it has not assessed risks posed by its current structure or the effectiveness of mechanisms it has to reduce organizational conflicts of interest. Without conducting such assessments and taking actions as needed to address risks, the program may not effectively mitigate impairments to its independence. Another key element of effective oversight is the ability to perform reviews. Some experts and laboratory representatives raised concerns that the program's reviews may not target the highest-risk activities, in part because it has not formally assessed which activities pose the highest risk. Without assessing the risk of activities it oversees and targeting its resources appropriately, the program cannot ensure it is balancing its resources against their impact. Technical expertise is another key element GAO identified in past work. The Select Agent Program has taken steps to hire additional expert staff and improve training, but workforce and training gaps remain. Moreover, the program does not have joint strategic planning documents to guide its oversight. Although it began taking steps to develop a joint strategic plan during GAO's review, the program is not developing workforce plans as part of this effort. GAO's past work has found that strategic workforce planning is an essential tool to help agencies align their workforces with their missions and develop long-term strategies for acquiring, developing, and retaining staff. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program leverage resources to ensure all workforce and training needs are met. Selected countries and regulatory sectors GAO reviewed promote effective oversight using approaches that differ from the U.S. Select Agent Program's approaches: In Great Britain, oversight of laboratories that work with pathogens is under an independent government agency focused on health and safety. In both Great Britain and Canada, regulators focus their oversight on (1) biological safety, due to safety incidents which provided the impetus for laboratory oversight in these countries; and (2) regulation of all potentially hazardous pathogens and activities in laboratories. GAO is making 11 recommendations for the Select Agent Program, including to (1) assess risks from its current structure and the effectiveness of its mechanisms to reduce conflicts of interest and address risks as needed, (2) assess the risk of activities it oversees and target reviews to high-risk activities, and (3) develop a joint workforce plan. HHS and USDA agreed with GAO's recommendations. or John Neumann at (202) 512-3841 or neumannj@gao.gov .