The federal government obligates tens of billions annually on IT. Prior IT expenditures, however, have too often produced failed projects—that is, projects with multimillion dollar cost overruns and schedule delays and with questionable mission-related achievements. In our 2017 high risk series update, we reported that improving the management of IT acquisitions and operations remains a high risk area because the federal government has spent billions of dollars on failed IT investments. Agencies are generally required to use full and open competition— meaning all responsible sources are permitted to compete—when awarding contracts. However, the Competition in Contracting Act of 1984 recognizes that full and open competition is not feasible in all circumstances and authorizes contracting without full and open competition under certain conditions. In addition, there are competition- related requirements for other types of contract vehicles, including multiple award indefinite-delivery/indefinite-quantity (IDIQ) contracts and the General Services Administration’s (GSA) Federal Supply Schedule (FSS). The rules regarding exceptions to full and open competition and other competition-related requirements are outlined in various parts of the Federal Acquisition Regulation (FAR). For example: Contracting officers may award a contract without providing for full and open competition if one of seven exceptions listed in FAR Subpart 6.3 apply. Examples of allowable exceptions include circumstances when products or services required by the agency are available from only one source, when disclosure of the agency’s need would compromise national security, or when the need for products and services is of such an unusual and compelling urgency that the federal government faces the risk of serious financial or other injury. Generally, exceptions to full and open competition under FAR subpart 6.3 must be supported by written justifications that contain sufficient facts and rationale to justify use of the specific exception. Depending on the proposed value of the contract, the justifications require review and approval at successively higher approval levels within the agency. Contracting officers are also authorized to issue orders under multiple award IDIQ contracts noncompetitively. Generally contracting officers must provide each IDIQ contract holder with a fair opportunity to be considered for each order unless exceptions apply. Contracting officers who issue orders over certain thresholds under an exception to fair opportunity are required to provide written justification for doing so. In April 2017 we found that government-wide, more than 85 percent of all order obligations under multiple-award IDIQ contracts were competed from fiscal years 2011 through 2015. Orders placed under GSA’s FSS program are also exempt from FAR part 6 requirements. However, ordering procedures require certain FSS orders exceeding the simplified acquisition threshold to be placed on a “competitive basis,” which includes requesting proposals from as many schedule contractors as practicable. If a contracting officer decides not to provide opportunity to all contract holders when placing an FSS order over the simplified acquisition threshold, that decision must be documented and approved. The FAR allows for orders to be placed under these circumstances based on the following justifications: when an urgent and compelling need exists; when only one source is capable of providing the supplies or services because they are unique or highly specialized; when in the interest of economy and efficiency, the new work is a logical follow-on to an original FSS order that was placed on a “competitive basis;” and when an item is “peculiar to one manufacturer.” Agencies may also award contracts on a sole-source basis in coordination with the Small Business Administration (SBA) to eligible 8(a) program participants. While agencies are generally not required to justify these sole-source awards, contracts that exceed a total value of $22 million require a written justification in accordance with FAR Subpart 6.3. In certain situations, it may become evident that services could lapse before a subsequent contract can be awarded. In these cases, because of time constraints, contracting officers generally use one of two options: (1) extend the existing contract or (2) award a short-term stand-alone contract to the incumbent contractor on a sole-source basis to avoid a lapse in services. While no government-wide definition of bridge contracts exists, we developed the following definitions related to bridge contracts that we used for our October 2015 report: Bridge contract. An extension to an existing contract beyond the period of performance (including base and option years), or a new, short-term contract awarded on a sole-source basis to an incumbent contractor to avoid a lapse in service caused by a delay in awarding a follow-on contract. Predecessor contract. The contract in place prior to the award of a bridge contract. Follow-on contract. A longer-term contract that follows a bridge contract for the same or similar services. This contract can be competitively awarded or awarded on a sole-source basis. Contracts, orders, and extensions (both competitive and noncompetitive) are included in our definition of a “bridge contract” because the focus of the definition is on the intent of the contract, order, or extension. DOD and some of its components, including the Navy, the Defense Logistics Agency (DLA), and the Defense Information Systems Agency (DISA), have established their own bridge contract definitions and policies. Congress enacted legislation in 2017 that established a definition of “bridge contracts” for DOD and its components. For the purposes of this report, we use the same definition as we used in our October 2015 report to define bridge contracts, unless otherwise specified. We acknowledge that in the absence of a government-wide definition, agencies may have differing views of what constitutes a bridge contract. We discuss these views further in the body of this report. In our October 2015 report on bridge contracts, we found that the agencies included in our review—DOD, HHS, and the Department of Justice—had limited or no insight into their use of bridge contracts. In addition, we found that while bridge contracts are typically envisioned as short term, some bridge contracts included in our review involved one or more bridges that spanned multiple years—potentially undetected by approving officials. The fact that the full length of a bridge contract, or multiple bridge contracts for the same requirement, is not readily apparent from documents that may require review and approval, such as an individual J&A, presents a challenge for those agency officials responsible for approving the use of bridge contracts. Approving officials signing off on individual J&As may not have insight into the total number of bridge contracts that may be put in place by looking at individual J&As alone. In October 2015, we recommended that the Administrator of the Office of Federal Procurement Policy (OFPP) take the following two actions: (1) take appropriate steps to develop a standard definition for bridge contracts and incorporate it as appropriate into relevant FAR sections; and (2) as an interim measure until the FAR is amended, provide guidance to agencies on: a definition of bridge contracts, with consideration of contract extensions as well as stand-alone bridge contracts; and suggestions for agencies to track and manage their use of these contracts, such as identifying a contract as a bridge in a J&A when it meets the definition, and listing the history of previous extensions and stand-alone bridge contracts. OFPP concurred with our recommendation to provide guidance to agencies on bridge contracts, and stated its intention is to work with members of the FAR Council to explore the value of incorporating a definition of bridge contracts in the FAR. As of November 2018, OFPP had not yet implemented our recommendations but has taken steps to develop guidance on bridge contracts. Specifically, OFPP staff told us they have drafted management guidance, which includes a definition of bridge contracts, and provided it to agencies’ Chief Acquisition Officers and Senior Procurement Executives for review. OFPP staff told us they received many comments on the draft guidance and were in the process of addressing those comments. Federal agencies reported annually obligating between $53 billion in fiscal year 2013 to $59 billion in fiscal year 2017 on IT-related products and services. Of that amount, agencies reported that more than $15 billion each year—or about 30 percent of all obligations for IT products and services—were awarded noncompetitively. However, in a generalizable sample of contracts and orders, we found significant errors in certain types of orders, which call into question the reliability of competition data associated with roughly $3 billion per year in obligations. As a result, the actual amount agencies obligated on noncompetitive contract awards for IT products and services is unknown. From fiscal years 2013 through 2017, we found that total IT obligations reported by federal agencies ranged from nearly $53 billion in fiscal year 2013 to $59 billion in fiscal year 2017. The amount obligated on IT products and services generally accounted for about one-tenth of total federal contract spending (see figure 1). For fiscal years 2013 through 2017, the three agencies we reviewed in more depth—DOD, DHS and HHS––collectively accounted for about two- thirds of federal IT spending (see figure 2). From fiscal years 2013 through 2017, agencies reported in FPDS-NG obligating more than $15 billion—about 30 percent of all annual IT obligations—each year on noncompetitively awarded contracts and orders. We determined, however, that the agencies’ reporting of certain competition data was unreliable (see figure 3). Specifically, we found that contracting officers miscoded 22 out of 41 orders in our sample, of which 21 cited “follow-on action following competitive initial action” or “other statutory authority” as the legal authority for using an exception to fair opportunity. DOD contracting officers had miscoded 11 of the 21 orders, while DHS and HHS contracting officers had miscoded 4 and 6 orders, respectively. This miscoding occurred at such a high rate that it put into question the reliability of the competition data on orders totaling roughly $3 billion per year in annual obligations. In each of these cases, contracting officers identified these orders as being noncompetitively awarded when they were, in fact, competitively awarded. As an assessment of the extent to which contracts and orders that were identified as being competitively awarded were properly coded was outside the scope of our review, we are not in a position to assess the overall reliability of competition information of IT-related contracts. For these 21 orders, we found that DHS was aware of issues surrounding most of their miscodings and had taken actions to fix the problems, while DOD and HHS generally had limited insights as to why these errors occurred. DHS miscoded 4 orders, 3 of which were orders awarded under single award contracts. DHS officials told us that orders issued from single award contracts should inherit the competition characteristics of the parent contract. However, as FPDS-NG currently operates, contracting officers have the ability to input a different competition code for these orders. In this case, each of the single award contracts was competitively awarded and therefore all the subsequent orders issued from these contracts should be considered competitively awarded, as there are no additional opportunities for competition. DHS has taken actions to address this issue. DHS officials stated that in conjunction with DOD they have asked GSA, which manages the FPDS-NG data system, to modify FPDS-NG to automatically prefill competition codes for orders awarded under single award contracts. DHS officials noted that GSA expects to correct the issue in the first quarter of fiscal year 2019, which should mitigate the risks of agencies miscoding orders issued under single award contracts in the future. DHS officials have also provided training to their contracting personnel that single award orders must inherit the characteristics of the parent contract. DOD and HHS officials, on the other hand, had limited insights as to why their orders were miscoded. For example, DOD miscoded a total of 11 orders (5 orders awarded under single award contracts and 6 awarded under multiple award contracts). For 8 of these orders, contracting officers did not provide the reasons as to why these errors occurred. For the remaining 3 orders awarded—each of which were issued under single award contracts—contracting officials told us that they had used the “follow-on action following competitive initial action” because the underlying contract had been competed. Similarly, at HHS, which miscoded a total of 6 orders (4 awarded under single award contracts and 2 awarded under multiple award contracts), component officials told us that these errors were accidental and could not provide any additional insight as to why these errors were made. While GSA’s changes in the FPDS-NG system, when implemented, may help address the issue of miscoding competition data on orders issued from single award contracts, it will not address errors in coding for multiple award orders that cited exceptions to competition even when they were competed. The FAR notes that FPDS-NG data are used in a variety of ways, including assessing the effects of policies and management initiatives, yet we have previously reported on the shortcomings of the FPDS-NG system, including issues with the accuracy of the data. Miscoding of competition requirements may hinder the accomplishment of certain statutory, policy, and regulatory requirements. For example, The FAR requires agency competition advocates, among other duties and responsibilities, to prepare and submit an annual report to their agencies’ senior procurement executive and chief acquisition officer on actions taken to achieve full and open competition in the agency and recommend goals and plans for increasing competition. OMB required agencies to reduce their reliance on noncompetitive contracts, which it categorized as high-risk, because, absent competition, agencies must negotiate contracts without a direct market mechanism to help determine price. Federal internal control standards state that management should use quality information to achieve an entity’s objectives. Without identifying the reasons why contracting officers are miscoding these orders in FPDS-NG, DOD and HHS are unable to take action to ensure that competition data are accurately recorded, and are at risk of using inaccurate information to assess whether they are achieving their competition objectives. After excluding the $3 billion in annual obligations we determined was not sufficiently reliable, we found that from fiscal years 2013 through 2017 about 90 percent of noncompetitive IT obligations reported in FPDS-NG were used to buy services, hardware, and software (see figure 4). Services include the maintenance and repair of IT equipment as well as professional technology support. Hardware includes products such as fiber optic cables and computers, and software includes items such as information technology software and maintenance service plans. The documentation for the contracts and orders at the three agencies we reviewed generally cited either that only one source could meet their needs or that they were awarding the contract sole-source to an 8(a) small business participant when noncompetitively awarding IT contracts or orders. Specifically, based on our generalizable sample, we estimate that nearly 60 percent of fiscal year 2016 noncompetitive contracts and orders at DOD, DHS, and HHS were awarded noncompetitively because agencies cited that only one contractor could meet the need, and approximately 26 percent of contracts and orders were awarded sole- source to an 8(a) small business participant. We estimate that agencies cited a variety of other reasons for not competing approximately 16 percent of noncompetitive contracts and orders, such as unusual and compelling urgency, international agreement, and national security. Within our sample of 142 contracts and orders, we analyzed J&As or similar documents to obtain additional detail as to why the contracts and orders were awarded noncompetitively. See table 2 for a breakdown of the overall reasons cited for awarding contracts noncompetitively within our sample. For 79 of the 142 contracts and orders we reviewed, agencies cited that only one source could meet the need. We found that this exception was the most commonly cited reason for a sole-source IT contract or order at DOD and DHS, but not at HHS. At HHS, the most common reason was that the contract or order was awarded on a sole source basis to an 8(a), which we discuss in more detail later. Agencies justified use of the “only one source” exception on the basis that the contractor owned the proprietary technical or data rights; the contractor had unique qualifications or experience; compatibility issues; or that a brand-name product was needed (see figure 5). The following examples illustrate the reasons cited by the agencies as to why only one contractor could meet their needs: Proprietary data rights issues and compatibility issues. The Navy issued a 9-month, approximately $350,000 order under an IDIQ contract for two data terminal sets. The terminal sets, which according to Navy officials, have been used by the Navy since the 1990s to exchange radar tracking and other information among airborne, land- based, and ship-board tactical data systems and with certain allies. The Navy’s J&A document noted that the contractor owned the proprietary data rights to the transmitting equipment and software, and the Navy required the equipment to be compatible and interchangeable with systems currently fielded throughout the Navy. Furthermore, the document noted that seeking competition through the development of a new source would result in additional costs that would far exceed any possible cost savings that another source could provide and would cause unacceptable schedule delays. This example illustrates that decisions the program officials make during the acquisition process to acquire or not acquire certain rights to technical data can have far-reaching implications for DOD’s ability to sustain and competitively procure parts and services for those systems, as we have previously reported. In our May 2014 report on competition in defense contracting, we found that 7 of 14 justifications we reviewed explained that the awards could not be competed due to a lack of technical data. All 7 of these justifications or supporting documents described situations, ranging from 3 to 30 years in duration, where DOD was unable to conduct a competition because data rights were not purchased with the initial award. We recommended in May 2014 that DOD ensure that existing acquisition planning guidance promotes early vendor engagement and allows both the government and vendors adequate time to prepare for competition. DOD concurred with our recommendation. In April 2015, DOD updated its acquisition guidance to incorporate new guidelines for creating and maintaining a competitive environment. These guidelines emphasize acquisition planning steps including involvement with industry in obtaining feedback on draft solicitations, market research, and requirements development. Unique qualifications and experience. DHS placed four separate orders under an IDIQ contract for data center support totaling approximately $7 million. The requirement was to maintain mission critical services during a data center support pilot, prototype, and transition period starting in fiscal year 2015. Among other things, DHS’s J&A noted that no other contractors had sufficient experience with DHS’s infrastructure and requirements necessary to maintain services at the required level during the transition period. HHS awarded an approximately $4 million contract to buy support services for an IT center for a 12-month ordering period, including options. HHS’s J&A noted that only the incumbent contractor had the requisite knowledge and experience to operate and maintain the mission and business systems in the IT center during the transition of operations from one location to another. The justification further stated that HHS had no efforts underway to increase competition in the future as this requirement is not anticipated to be a recurring requirement. Program officials stated that they are migrating from legacy IT systems to a new commercial off-the-shelf system. Brand-name products. DOD awarded a 5-month, approximately $500,000 contract for brand name equipment and installation that supported various video-teleconference systems. The J&A stated that this particular brand name product was the only product that would be compatible with current configurations installed in one of its complexes. To increase competition in the future, the J&A stated that technical personnel will continue to evaluate the marketplace for commercially available supplies and installation that can meet DOD’s requirements. For 42 of the 142 contracts and orders we reviewed, we found that agencies awarded a sole-source contract or order to 8(a) small business participants. HHS awarded 13 of its 23 sole-source contracts and orders we reviewed to 8(a) small business participants, DOD awarded 25 of 95, and DHS 4 of 24. We found that all contracts and orders in our review that were awarded on a sole-source basis to 8(a) small business participants were below the applicable competitive thresholds or otherwise below the FAR thresholds that require a written justification. As previously discussed, agencies may award contracts on a sole-source basis to eligible 8(a) participants, either in coordination with SBA or when they are below the competitive threshold. While agencies are generally not required to justify these smaller dollar value sole-source 8(a) awards, contracts that exceed a total value of $22 million require a written justification. Since none of the 8(a) sole source contracts and orders in our review required written justifications, the contract files generally did not provide the rationale behind the sole-source award. Policy and contracting officials from all three agencies we reviewed stated they made sole-source awards to 8(a) small business participants to help meet the agency’s small business contracting goals and save time. HHS officials further stated that they consider their awards to 8(a) small business participants a success because they are supporting small businesses. Officials stated that once a requirement is awarded through the 8(a) program, the FAR requires that requirement be set aside for an 8(a) contractor unless the requirement has changed or that an 8(a) contractor is not capable or available to complete the work. For 23 of the 142 contracts and orders we reviewed, we found that agencies cited other reasons for awarding contracts and orders noncompetitively. For example: Urgent and compelling need. DHS’s Coast Guard awarded an approximately 10-month, $6.5 million order (encompassing all options) for critical payroll services in its human resources management system under a GSA federal supply schedule contract. The Coast Guard justified the award based on an urgent and compelling need. A Coast Guard official explained that the efforts to competitively award a follow-on contract had been delayed as the Coast Guard had not developed a defined statement of work in a timely manner, and that the agency had received a larger number of proposals than initially anticipated. Therefore, the evaluation process took longer than expected. In addition, the Coast Guard’s competitive follow-on contract, which was awarded in June 2018, was protested. In October 2018, GAO denied the protest and the Coast Guard is currently planning to transition to the newly awarded contract. International agreement. The Army placed an approximately 8- month, $1 million order under an IDIQ contract for radio systems and cited international agreement as the reason for a noncompetitive award. This order was part of a foreign military sales contract with the Government of Denmark. Authorized or required by statute. The Defense Logistics Agency (DLA) cited “authorized or required by statute” when it placed an approximately $1.5 million, 12-month order under an IDIQ contract for sustainment support services for an application that is used for planning and initiating contracting requirements in contingency environments. DLA noted that this model was contracted under the Small Business Innovation Research Program, which supports scientific and technological innovation through the investment of federal research funds into various research projects. National security. The U.S. Special Operations Command (SOCOM) placed an approximately 8-month, $1 million order for radio spare parts and cited national security as the reason for a noncompetitive award. We estimate that about 8 percent of contracts and orders above $150,000 in fiscal year 2016 at DOD, DHS, and HHS were bridge contracts. Consistent with our October 2015 findings, agencies we reviewed face continued challenges with oversight of bridge contracts, based on 15 contracts and orders we reviewed in-depth. For example, we found that in 9 of the 15 cases, bridge contracts were associated with additional bridges not apparent in the documentation related to the contract and order we reviewed, such as a J&A, and corresponded with longer periods of performance and higher contract values than initially apparent. Agency officials cited a variety of reasons for needing bridge contracts, including acquisition planning challenges, source selection challenges, and bid protests. Based on our generalizable sample, we estimate that about 8 percent of contracts and orders above $150,000 in fiscal year 2016 at DOD, DHS, and HHS were bridge contracts. We verified, using our definition of bridge contracts as criteria, that 13 of 142 contracts and orders in our generalizable sample were bridge contracts based on reviews of J&As, limited source justifications, or exceptions to fair opportunity, among other documents. In addition, we found two additional bridge contracts related to our generalizable sample while conducting our in-depth review, bringing the total number of bridge contracts we identified during this review to 15. We found that the bridge contracts we reviewed were often longer than initially apparent from our review of related documentation, such as a J&A, and sometimes spanned multiple years. Bridge contracts can be a useful tool in certain circumstances to avoid a gap in providing products and services, but they are typically envisioned to be used for short periods of time. When we conducted an in-depth review of the bridge contracts, such as by reviewing the contract files for the predecessor, bridge, and follow-contracts, we found that in most cases, these involved one or more bridges that spanned longer periods and corresponded with higher contract values than initially apparent. Specifically, we found that 9 of the 15 bridge contracts had additional bridges related to the same requirement that were not initially apparent from documents requiring varying levels of approval by agency officials, such as the J&As. Collectively, agencies awarded bridge contracts associated with these 15 contracts and orders with estimated contract values of about $84 million (see table 3). The following examples illustrate contracts we reviewed in which the periods of performance were longer than initially apparent: HHS’s Indian Health Service (IHS) awarded a 4-month, approximately $1.6 million bridge order for project management and support services for IHS’s resource and patient management system. We found, however, that the predecessor contract had already been extended by 6 months before the award of the bridge order due to acquisition planning challenges associated with delays in developing the acquisition package for the follow-on contract. Subsequently, the 4- month bridge order was extended for an additional 6 months, in part because the follow-on award—which had been awarded to a new contractor—was protested by the incumbent contractor due to concerns over proposal evaluation criteria. Ultimately, the protest was dismissed. Following the resolution of the bid protest, officials awarded an additional 2-month bridge order for transition activities. In total, the bridge orders and extensions spanned 18 months and had an estimated value of about $4.7 million. Figure 6 depicts the bridge orders and extensions and indicates the 4-month bridge and 6-month extension we had initially identified. The Air Force awarded a 3-month, approximately $630,000 bridge contract to support a logistics system used to monitor weapon system availability and readiness. We found, however, that the Air Force had previously awarded a 3-month bridge contract due to delays resulting from a recent reorganization, which, according to Air Force officials, made it unclear which contracting office would assume responsibility for the requirement. The Air Force subsequently awarded an additional 3-month bridge contract due to acquisition planning challenges, such as planning for the award of the follow-on sole- source contract. The total period of performance for the bridges was 9 months with an estimated value of about $1.9 million (see figure 7). As of August 2018, 13 of the 15 bridge contracts had follow-ons in place—5 were awarded competitively and 8 were awarded noncompetitively. Two bridge contracts do not currently have follow-on contracts in place for various reasons. For example, in one instance, the Coast Guard’s requirement for human resources and payroll support services has continued to operate under a bridge contract because the Coast Guard’s planned follow-on contract—a strategic sourcing IDIQ— was awarded in June 2018, and subsequently protested, among other delays. Based on our reviews of contract documentation and information provided by agency officials, we found that acquisition planning challenges were the principal cause for needing to use a bridge contract across the 15 bridge contracts we reviewed. In particular, acquisition packages prepared by program offices to begin developing a solicitation were often not prepared in a timely fashion. Acquisition packages include statements of work and independent government cost estimates, among other documents, and are generally prepared by the program office, with the assistance of the contracting office. In addition to acquisition planning challenges, officials cited delays in source selection and bid protests, among others, as additional reasons justifying the need to use a bridge contract (see figure 8). The following examples illustrate reasons officials cited for needing a bridge contract: DOD’s DISA awarded a bridge contract for IT support services due to acquisition planning challenges, and specifically, the late submission of acquisition packages. According to contracting officials, the bridge contract was originally intended to consolidate 3 of the previous contracts associated with this requirement, but a fourth was added much later in the process. DISA contracting officials said that the program office did not submit acquisition package documentation in a timely manner, and, once submitted, the documentation required numerous revisions. These officials added that they had to award an additional bridge contract to avoid a lapse in service once they received a completed package from the program office because there was not enough time to do a competitive source selection and analysis. DOD’s SOCOM extended an IDIQ contract for radio supplies and services due to source selection delays and acquisition workforce challenges. For example, contracting officials said they extended the IDIQ for 12 months because the contracting office was working on a source selection for the follow-on contract for modernized radios and simply did not have the manpower to award a new sustainment contract for the existing radios at the same time. DHS’s Customs and Border Protection (CBP) awarded an approximately 16-month bridge contract in June 2016 for engineering and operations support of CBP’s Oracle products and services due to bid protests associated with March 2016 orders for this requirement. We found the protests were filed on the basis that CBP had issued the task order on a sole-source basis, which precluded other contractors from competing for the award. GAO dismissed the protest in May 2016 as a result of CBP’s stated intent to terminate the task order and compete the requirement as part of its corrective action plan. According to CBP contracting officials, they awarded the approximately16-month bridge contract to the incumbent contractor to continue services until GAO issued a decision and the services could be transitioned to the awardee. In September 2017, CBP officials awarded the competitive follow-on contract to a new vendor, but this award was also protested due to alleged organizational conflicts of interest, improperly evaluated technical proposals, and an unreasonable best-value tradeoff determination. As a result, CBP officials issued a stop-work order effective October 2017. To continue services during the protest, CBP officials extended the existing bridge contract by 3 months and then again by another 6 months. In January 2018, GAO dismissed the protest in its entirety and the stop-work order was lifted. According to a CBP contracting official, CBP did not exercise the final 3 months of options of the 6-month extension. In 2015, we found that the full length of a bridge contract, or multiple bridge contracts, is not always readily apparent from review of an individual J&A, which presents challenges for approving officials, as they may not have insight into the total number of bridges put into place by looking at individual J&As alone. We found a similar situation in our current review. For example, the J&As for the 8 bridge contracts with J&As did not include complete information on the periods of performance or estimated values of all related bridge contracts. OFPP has not yet taken action to address the challenges related to the use of bridge contracts that we found in October 2015. At that time, we recommended that OFPP take appropriate steps to develop a standard definition of bridge contracts and incorporate it as appropriate into relevant FAR sections, and to provide guidance to federal agencies in the interim. We further recommended that the guidance include (1) a definition of bridge contracts, with consideration of contract extensions as well as stand-alone bridge contracts, and (2) suggestions for agencies to track and manage their use of these contracts, such as identifying a contract as a bridge in a J&A when it meets the definition, and listing the history of previous extensions and stand-alone bridge contracts back to the predecessor contract in the J&A. However, as of November 2018, OFPP had not yet done so. As a result, agencies continue to face similar challenges with regard to the use of bridge contracts that we identified in 2015 and there is a lack of government-wide guidance that could help to address them. In the absence of a federal government-wide definition, others have taken steps to establish a bridge contracts definition. For example, Congress has established a statutory definition of bridge contracts that is applicable to DOD and its components. Specifically, Section 851 of the National Defense Authorization Act for Fiscal Year 2018 defined a bridge contract as (1) an extension to an existing contract beyond the period of performance to avoid a lapse in service caused by a delay in awarding a subsequent contract; or (2) a new short-term contract awarded on a sole- source basis to avoid a lapse in service caused by a delay in awarding a subsequent contract. Section 851 requires that, by October 1, 2018, the Secretary of Defense is to ensure that DOD program officials plan appropriately to avoid the use of a bridge contract for services. In instances where bridge contracts were awarded due to poor acquisition planning, the legislation outlines notification requirements with associated monetary thresholds for bridge contracts. Acting on this requirement and in response to our prior bridge contracts report, DOD established a bridge contracts policy memorandum in January 2018. The policy defines bridge contracts as modifications to existing contracts to extend the period of performance, increase the contract ceiling or value or both, or a new, interim sole-source contract awarded to the same or a new contractor to cover the timeframe between the end of the existing contract and the award of a follow-on contract. The DOD policy excludes extensions awarded using the option to extend services clause as bridge contracts unless the extension exceeds 6 - months. In addition, DOD’s bridge contract policy directs the military departments and DOD components to develop a plan to reduce bridge contracts and to report their results annually to the Office of the Under Secretary of Defense for Acquisition and Sustainment. As of August 2018, DHS and HHS did not have component- or department-level policies that define or provide guidance on the use of bridge contracts. Differing definitions of bridge contracts can lead to varying perspectives as to what constitutes a bridge contract. For example: Differing views on whether a contract within the 8(a) program can be a bridge. In one instance, we reviewed a 3-month, approximately $1.9 million bridge contract that DLA awarded to the incumbent contractor for a variety of IT contractor support services for DLA’s Information Operations (J6). This bridge contract was awarded to continue services until DLA could award a 12-month, roughly $2.9 million sole- source contract (including all options) to an 8(a) small business participant to consolidate tasks from 20 contracts as part of a reorganization effort within J6. After that contract expired, DLA awarded a second 12-month, about $3 million contract (including all options) to the same 8(a) small business participant to continue these task consolidation efforts. DLA subsequently awarded a 2-month $122,000 contract extension to continue services until it could award a follow-on order under DLA’s J6 Enterprise Technology Services (JETS) multiple award IDIQ contract, the award of which had also been delayed. Although the 8(a) contracts were not awarded to the incumbent of the initial 3-month bridge, we believe that these contracts could be considered bridge contracts as they were meant to bridge a gap in services until the reorganization efforts were complete and the JETS contract was awarded. DLA contracting officials, however, told us they do not consider the 8(a) contracts to be bridge contracts as these two contracts and the follow-on task order under JETS were awarded sole-source to 8(a) small business participants. DLA officials added that they plan to keep the requirement in the 8(a) program. Differing views as to whether contract extension are bridges. DOD’s policy generally does not include contract extensions using the “option to extend services” clause as bridges, unless the option is extended beyond the 6 months allowed by the clause. Navy policy, however, states that using the option to extend services clause is considered a bridge if the option was not priced at contract award. Similarly, HHS officials stated that the department does not consider contract extensions using the “option to extend services” clause to be bridge contract actions if the total amount of the services covered are evaluated in the initial award, and if the length does not extend beyond the allowable 6 months. The differences among agencies’ views and policies may be due to the extent to which the extensions are considered “competitive”. For the purposes of our definition, if the extension—whether it was competed or not—was used to bridge a gap in service until a follow-on contract could be awarded, then it would be considered a bridge. Without agreement as to what constitutes a bridge contract, agencies’ efforts to improve oversight of and to identify challenges associated with the use of bridge contracts will be hindered. While we are not making any new recommendations in this area, we continue to believe that our October 2015 recommendation to OFPP to establish a government-wide definition and provide guidance to agencies on their use remains valid. An estimated 7 percent of IT noncompetitive contracts and orders at selected agencies in fiscal year 2016 were in support of legacy IT systems as newly defined in statute, which is considerably fewer than we found when using the previous definition of legacy IT. At the time our review began, OMB’s draft definition for legacy IT systems stated that legacy IT spending was spending dedicated to maintaining the existing IT portfolio, excluding provisioned services such as cloud. Using this definition, and based on our generalizable sample, we estimated that about 80 percent of IT noncompetitive contracts and orders over $150,000 in fiscal year 2016 at DOD, DHS, and HHS were awarded in support of legacy IT systems. In December 2017, however, Congress enacted the Modernizing Government Technology Act (MGT) as part of the National Defense Authorization Act for Fiscal Year 2018. This act defined a legacy IT system as an “outdated or obsolete system of information technology.” Using this new statutory definition of a legacy IT system, we requested that each agency reassess how it would characterize the nature of the IT system using the revised definition provided under the MGT Act. For the 142 contracts and orders we reviewed, we found that when using the new definition, agencies significantly reduced the number of contracts and orders identified as supporting legacy IT systems. For example, using the OMB draft definition agencies identified that 118 out of 142 contracts and orders were supporting legacy IT systems. However, when using the more recent MGT Act definition, agencies identified only 10 out of 137 contracts and orders as supporting legacy IT systems (see figure 9). Consequently, using the definition provided under the MGT Act, we estimate that about 7 percent of IT noncompetitive contracts and orders over $150,000 in fiscal year 2016 at DOD, DHS, and HHS were awarded in support of outdated or obsolete legacy IT systems. Agencies’ program officials said that they are still supporting outdated or obsolete legacy IT systems (as defined by the MGT Act) because they are needed for the mission, or they are in the process of buying new updated systems or modernizing current ones. For example: Army officials awarded a 5-year, roughly $1.2 million contract to install, configure, troubleshoot, and replace Land Mobile Radio equipment at Ft. Sill, Oklahoma. An Army official noted that all equipment is older than 12 years and is nearing its end of life. The radio equipment, however, is required to support first responder and emergency service personnel critical communications. An Army official did not indicate any plans to modernize, but noted that the impact of this system not being supported would significantly affect all of Fort Sill’s land mobile radio communications. The Air Force awarded a $218,000 order to buy repair services for the C-130H aircraft’s radar display unit and electronic flight instrument. An Air Force official noted that legacy hardware that was bought through the order is part of critical systems that are required to safely fly the aircraft. The system, however, is obsolete and the associated hardware is no longer supported by the vendor. The official told us that there is currently a re-engineering effort to modernize the systems that use this hardware. HHS issued a 12–month, nearly $2.5 million order to buy operations and maintenance support for a Food and Drug Administration (FDA) system used to review and approve prescription drug applications. According to an FDA program official, efforts are underway to retire the system by gradually transferring current business processes to a commercial-off-the-shelf solution that can better meet government needs. This official, however, told us that the system currently remains in use because FDA’s Office of New Drugs is still heavily reliant on the system. Competition is a cornerstone of the federal acquisition system and a critical tool for achieving the best possible return on investment for taxpayers. In the case of information technology, federal agencies awarded slightly under a third of their contract dollars under some form of noncompetitive contract. Further, our current work was able to quantify that about a tenth of all information technology-related contracts and orders were made under some form of a noncompetitively awarded bridge contract, which provides new context for the issues associated with their use. The challenges themselves, however, remain much the same since we first reported on the issue in 2015. OFPP has yet to issue guidance or promulgate revised regulations to help agencies identify and manage their use of bridge contracts, and our current work finds that the full scope of bridge contracts or the underlying acquisition issues that necessitated their use in the first place may not be readily apparent to agency officials who are approving their use. We continue to believe that our 2015 recommendation would improve the use of bridge contracts, and we encourage OFPP to complete its ongoing efforts in a timely fashion. The frequency of the errors in reporting and their concentration within a specific type of contract action signals the need for more management attention and corrective action. These errors resulted in the potential misreporting of billions of dollars awarded under orders as being noncompetitively awarded when, in fact, they were competed. One agency included in our review—DHS—has taken steps to address the problems that underlie the errors in coding and provided additional training to its staff. DOD and HHS could benefit from additional insight as to the reasons behind the high rates of miscoding to improve the accuracy of this information. We are making a total of two recommendations, one to DOD and one to HHS. The Secretary of Defense should direct the Under Secretary of Defense for Acquisition and Sustainment to identify the reasons behind the high rate of miscoding for orders awarded under multiple award contracts and use this information to identify and take action to improve the reliability of the competition data entered into FPDS-NG. (Recommendation 1) The Secretary of Health and Human Services should direct the Associate Deputy Assistant Secretary for Acquisition to identify the reasons behind the high rate of miscoding for orders awarded under multiple award contracts and use this information to identify and take action to improve the reliability of the competition data entered into FPDS-NG. (Recommendation 2) We provided a draft of this report to DOD, DHS, HHS, and OMB for review and comment. DOD and HHS provided written comments and concurred with the recommendation we made to each department. In its written response, reproduced in appendix II, DOD stated it will analyze FPDS-NG data in an effort to identify why the miscoding of orders on multiple award contracts occurs, and use the information to advise the contracting community of actions to improve the reliability of competition data. In its written response, reproduced in appendix III, HHS stated that the Division of Acquisition within HHS’s Office of Grants and Acquisition Policy and Accountability uses a data quality management platform to ensure data accuracy. HHS is currently in the process of performing the annual data validation and verification of the acquisition community’s contract data for fiscal year 2018. Once this process is complete the Division of Acquisition will contact contracting offices that produced records that were flagged as containing errors and provide recommendations that should help improve the fiscal year 2019 accuracy rating. HHS added that it will closely monitor those checks and all others to ensure contract data are accurate. However, in its letter, HHS did not specify how its annual data validation and verification process would specifically address the fact that we found a high rate of miscoding of competition data for certain orders. OMB staff informed us that they had no comments on this report. DHS, HHS and the Air Force provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Secretary of Homeland Security, the Secretary of Health and Human Services, and the Director of the Office of Management and Budget. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or dinapolit@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Our report examines (1) the extent to which agencies used noncompetitive contracts to procure Information Technology (IT) products and services for fiscal years 2013 through 2017; (2) the reasons for using noncompetitive contracts for selected IT procurements; (3) the extent to which IT procurements at selected agencies were bridge contracts; and (4) the extent to which noncompetitive IT procurements at selected agencies were in support of legacy systems. To examine the extent to which agencies used noncompetitive contracts and orders to procure IT products and services, we analyzed government-wide Federal Procurement Data System-Next Generation (FPDS-NG) data on IT obligations from fiscal years 2013 through 2017. To define IT, we used the Office of Management and Budget’s (OMB) Category Management Leadership Council list of IT products and service codes, which identified a total of 79 IT-related codes for IT services and products. Data were adjusted for inflation to fiscal year 2017 dollars, using the Fiscal Year Gross Domestic Product Price Index. To assess the reliability of the FPDS-NG data, we electronically tested for missing data, outliers, and inconsistent coding. Based on these steps, we determined that FPDS-NG data were sufficiently reliable for describing general trends in government-wide and IT contract obligations data for fiscal years 2013 through 2017. In addition, as we later describe, we compared data for a generalizable sample of 171 noncompetitive contracts and orders to contract documentation, and we determined that 29 of these had been inaccurately coded in FPDS-NG as noncompetitive. As such, we determined that the data were not reliable for the purposes of reporting the actual amount agencies obligated on noncompetitive contracts and orders for IT products and services. Specifically, we determined, that data for IT noncompetitive obligations awarded under multiple award contracts that cited “follow-on action following competitive initial action” or “other statutory authority” as the legal authority for using an exception to fair opportunity for the Departments of Defense (DOD), Homeland Security (DHS), and Health and Human Services (HHS) in fiscal year 2016 were not reliable. Evidence from our review of this sample suggests there was a high rate of miscoding for these orders; thus, we applied these findings to the remaining agencies and fiscal years because we do not have confidence that the data were more reliable than what we had found. To determine the reasons for using noncompetitive contracts for selected IT procurements, we selected the three agencies with the highest reported obligations on IT noncompetitive contracts for fiscal years 2012 through 2016 (the most recent year of data available at the time we began our review)—DOD, DHS and HHS. These three agencies collectively accounted for about 70 percent of all noncompetitively awarded contracts for IT during this period. From these agencies, we selected a generalizable stratified random sample of 171 fiscal year 2016 noncompetitive contracts and orders for IT above the simplified acquisition threshold of $150,000. The sample was proportionate to the amount of noncompetitive contracts and orders for IT at each agency. Based on our review of documentation collected for the generalizable sample, we excluded 29 contracts and orders because they were awarded competitively, but had been miscoded as noncompetitive or as having an exception to fair opportunity. As a result, our sample consisted of 142 contracts and orders. See table 4 for a breakdown by agency. To determine the extent to which IT procurements at selected agencies were bridge contracts or in support of legacy systems, agencies provided information as to whether the contracts and orders met GAO’s definition of a bridge contract—which we defined as an extension to an existing contract beyond the period of performance (including base and option years) or a new, short-term contract awarded on a sole-source basis to an incumbent contractor to avoid a lapse in service caused by a delay in awarding a follow-on contract—and whether they met the definitions of legacy IT systems in OMB’s draft IT Modernization Initiative and the Modernizing Government Technology Act (MGT). OMB’s draft IT Modernization Initiative defined legacy systems as spending dedicated to maintaining the existing IT portfolio but excluding provisioned services, such as cloud, while the MGT Act defines them as outdated or obsolete. We verified the agencies’ determinations of whether a contract or order was a bridge by reviewing documentation, such as justification and approval and exception to fair opportunity documents, for the contracts and orders in our generalizable sample, and conducting follow-up with agency officials as needed. We verified agencies’ determination of whether or not a contract or order was in support of a legacy system, as defined in OMB’s draft IT Modernization Initiative by reviewing the agencies’ determination and comparing these determinations to additional documentation, such as the statement of work, and conducting follow-up with program officials about the nature of the requirement where needed. We verified agencies’ determination of whether a contract or order was in support of a legacy system as defined in the MGT Act by reviewing agencies’ rationale for these determinations and following up with agency officials where we identified discrepancies between the determination and rationale. To obtain additional insights into bridge contracts and legacy systems, we selected a nonprobability sample of 26 contracts and orders from our generalizable sample of 142 contracts and orders for in-depth review. We selected these contracts based on factors such as obtaining a mix of bridge contracts and other contracts used in support of legacy IT systems and location of the contract files. For our in-depth review of contracts and orders, we collected and analyzed contract file documentation for the selected contracts and orders and interviewed contracting and program officials to gain insights into the facts and circumstances surrounding the awards of IT noncompetitive contracts and orders. In cases where we selected a potential bridge contract, we also reviewed the predecessor contract, additional bridge contracts (if any), and, follow-on contract, if awarded at the time of our review. For bridge contracts and orders, we asked about the reasons why bridges were needed and the status of follow-on contracts. We verified, using the definition of bridge contracts that we developed for our October 2015 report as criteria, that 13 of 142 contracts and orders in our generalizable sample were bridge contracts based on reviews of justification and approval documents, limited source justifications, or exceptions to fair opportunity, among other documents. We acknowledge, however, that in the absence of a government-wide definition, agencies may have differing views of what constitutes a bridge contract. In addition, we found 2 additional bridge contracts not included in our generalizable sample while conducting our in-depth review. For example, we selected three noncompetitive orders from our generalizable sample for in-depth review that were used to buy accessories and maintenance for the U.S. Special Operations Command (SOCOM) PRC-152 and 117G radios. We found that although the three orders were not bridge contracts, the underlying indefinite delivery/ indefinite quantity (IDIQ) contract—which outlines the terms and conditions, including pricing for the orders—had been extended 12 months to continue services until the follow-on IDIQ could be awarded. We also selected an Air Force order for equipment for the Joint Strike Fighter instrumentation pallet for in-depth review. Further analysis revealed that the underlying IDIQ was extended for 5 additional months to continue services until officials could award a follow-on contract for this requirement. Including these 2 additional bridge contracts brings the total number of bridge contracts we identified during this review to 15. For legacy contracts and orders we asked about the nature of the requirement and plan to move to newer technologies or systems. The selection process for the generalizable sample is described in detail below. We selected a generalizable stratified random sample of 171 contracts and orders from a sample frame of 3,671 fiscal year 2016 IT noncompetitive contracts and orders, including orders under multiple award indefinite delivery/indefinite quantity contracts over $150,000 to generate percentage estimates to the population. We excluded contracts and orders with estimated values below the simplified acquisition threshold of $150,000 as these contracts have streamlined acquisition procedures. We stratified the sample frame into nine mutually exclusive strata by agency and type of award, i.e. contract, order, and multiple award order for each of the three agencies. We computed the minimum sample size needed for a proportion estimate to achieve an overall precision of at least plus or minus 10 percentage points or fewer at the 95 percent confidence level. We increased the computed sample size to account for about 10 percent of the population to be out of scope, such as competitive or non-IT contracts or orders. We then proportionally allocated the sample size across the defined strata and increased sample sizes where necessary so that each stratum would contain at least 10 sampled contracts or orders. The stratified sample frame and sizes are described in table 5 below. We selected contracts and orders from the following components: DOD: Air Force, Army, Navy, Defense Information Systems Agency, Defense Logistics Agency, Defense Security Service, Defense Threat Reduction Agency, U.S. Special Operations Command, and Washington Headquarter Services; HHS: Centers for Disease Control, Centers for Medicare and Medicaid Services, Food and Drug Administration, Indian Health Service, National Institutes of Health, and the Office of the Assistant Secretary for Administration; DHS: Federal Emergency Management Agency, Office of Procurement Operations, U.S. Citizenship and Immigration Services, U.S. Coast Guard, U.S. Customs and Border Protection, and the U.S. Secret Service. We excluded 29 contracts and orders as we determined they had been miscoded as noncompetitive or as not having an exception to fair opportunity. Based on these exclusions, we estimate the number of noncompetitive contracts and orders in this population was about 3,000 (+/- 6.7 percent). All estimates in this report have a margin of error, at the 95 percent confidence level, of plus or minus 9 percentage points or fewer. We conducted this performance audit from April 2017 to December 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Janet McKelvey (Assistant Director), Pete Anderson, James Ashley, Andrew Burton, Aaron Chua, Andrea Evans, Lorraine Ettaro, Julia Kennon, Miranda Riemer, Guisseli Reyes-Turnell, Roxanna Sun, Alyssa Weir, and Kevin Walsh made key contributions to this report.

Summary: The federal government spends tens of billions of dollars each year on IT products and services. Competition is a key component to achieving the best return on investment for taxpayers. Federal acquisition regulations allow for noncompetitive contracts in certain circumstances. Some noncompetitive contracts act as “bridge contracts”—which can be a useful tool to avoid a lapse in service but can also increase the risk of the government overpaying. There is currently no government-wide definition of bridge contracts. GAO was asked to review the federal government's use of noncompetitive contracts for IT. This report examines (1) the extent that agencies used noncompetitive contracts for IT, (2) the reasons for using noncompetitive contracts for selected IT procurements, (3) the extent to which IT procurements at selected agencies were bridge contracts, and (4) the extent to which IT procurements were in support of legacy systems. GAO analyzed FPDS-NG data from fiscal years 2013 through 2017 (the most recent and complete data available). GAO developed a generalizable sample of 171 fiscal year 2016 noncompetitive IT contracts and orders awarded by DOD, DHS, and HHS—the agencies with the most spending on IT, to determine the reasons for using noncompetitive contracts and orders, and the extent to which these were bridge contracts or supported legacy systems. From fiscal years 2013 through 2017, federal agencies reported obligating more than $15 billion per year, or about 30 percent, of information technology (IT) contract spending on a noncompetitive basis (see figure). GAO found, however, that Departments of Defense (DOD), Homeland Security (DHS), and Health and Human Services (HHS) contracting officials misreported competition data in the Federal Procurement Data System-Next Generation (FPDS-NG) for 22 of the 41 orders GAO reviewed. GAO's findings call into question competition data associated with nearly $3 billion in annual obligations for IT-related orders. DHS identified underlying issues resulting in the errors for its orders and took corrective action. DOD and HHS, however, had limited insight into why the errors occurred. Without identifying the issues contributing to the errors, DOD and HHS are unable to take action to ensure that competition data are accurately recorded in the future, and are at risk of using inaccurate information to assess whether they are achieving their competition objectives. GAO found that DOD, DHS, and HHS primarily cited two reasons for awarding a noncompetitive contract or order: (1) only one source could meet the need (for example, the contractor owned proprietary technical or data rights) or (2) the agency awarded the contract to a small business to help meet agency goals. GAO estimates that about 8 percent of 2016 noncompetitive IT contracts and orders at DOD, DHS, and HHS were bridge contracts, awarded in part because of acquisition planning challenges. GAO previously recommended that the Office of Federal Procurement Policy define bridge contracts and provide guidance on their use, but it has not yet done so. GAO believes that addressing this recommendation will help agencies better manage their use of bridge contracts. Additionally, GAO estimates that about 7 percent of noncompetitive IT contracts and orders were used to support outdated or obsolete legacy IT systems. Officials from the agencies GAO reviewed stated these systems are needed for their mission or that they are in the process of modernizing the legacy systems or buying new systems. GAO recommended DOD and HHS identify the reasons why competition data for certain orders in FPDS-NG were misreported and take corrective action. DOD and HHS concurred.