An agency within the U.S. Department of Health and Human Services (HHS), FDA is responsible for promoting and protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices, and ensuring the safety and security of our nation’s food supply, cosmetics, and products that emit radiation. The agency is also responsible for ensuring the proper labeling of foods, drugs, medical devices, tobacco, and cosmetics. Its work also includes advancing public health by facilitating innovations and promoting public access to science-based information on medicines, devices, and foods. The agency does not regulate meat, poultry, and certain egg products, which are regulated by the U.S. Department of Agriculture. FDA performs regulatory activities that include reviewing and approving new drugs and certain medical products; inspecting manufacturing facilities for compliance with regulations and good manufacturing practices; and conducting postmarket surveillance of food, drug, and medical products to ensure that products are safe; tracking and identifying the source of outbreaks of foodborne illnesses; and issuing recall notices and safety alerts for products that threaten the public health. FDA exercises its core functions through four directorates: the Offices of Medical Products and Tobacco; Foods; Global Regulatory Operations and Policy; and Operations. These offices, along with the Office of the Chief Scientist, report to the FDA Commissioner and carry out their missions through seven centers and through FDA’s ORA. Office of Medical Products and Tobacco: Center for Biologics Evaluation and Research. Regulates and evaluates the safety and effectiveness of biological products, such as blood and blood products, vaccines and allergenic products, and protein-based drugs. Center for Drug Evaluation and Research. Promotes and protects the public health by ensuring that all prescription and over-the-counter drugs are safe, as well as by reviewing and regulating clinical research. Center for Devices and Radiological Health. Promotes and protects the public health by ensuring the safety and effectiveness of medical devices and preventing unnecessary human exposure to radiation from radiation-emitting products. Center for Tobacco Products. Oversees tobacco product performance standards, reviews premarket applications for new and modified risk tobacco products and new warning labels, and establishes and enforces advertising and promotion restrictions. Center for Food Safety and Applied Nutrition. In conjunction with FDA’s field staff, promotes and protects the public health, in part by ensuring the safety of the food supply and that foods are properly labeled, and ensures that cosmetics are safe and properly labeled. Center for Veterinary Medicine. Promotes and protects the public health and animal health by helping to ensure that animal food products are safe; and by evaluating the safety and effectiveness of drugs to treat companion animals and those used for food-producing animals. Office of the Commissioner: National Center for Toxicological Research. Conducts peer-reviewed scientific research and provides expert technical advice and training to support FDA’s science-based regulatory decisions. Office of Global Regulatory Operations and Policy: Office of Regulatory Affairs. Leads FDA field activities and provides FDA leadership on imports, inspections, and enforcement policy. ORA supports the FDA product centers by inspecting regulated products and manufacturers, conducting sample analysis on regulated products, and reviewing imported products offered for entry into the United States. The office also develops FDA-wide policy on compliance and enforcement and executes FDA’s Import Strategy and Food Protection Plans. FDA relies extensively on IT to fulfill its mission and to support related administrative needs. The agency has systems dedicated to supporting the following major mission activities: Reviewing and evaluating new product applications, such as for prescription drugs, medical devices, and food additives. These systems are intended to help FDA determine whether a product is safe before it enters the market. For example, the Document Archiving, Reporting, and Regulatory Tracking System is intended to manage the drug and therapeutics review process. Tracking and evaluating firms to ensure that products comply with regulatory requirements. For example, the Field Accomplishments and Compliance Tracking System (FACTS) supports inspections, investigations, and compliance activities. Monitoring the safety of products on the market by collecting and assessing adverse reactions to FDA-regulated products, such as illnesses due to food or negative reactions to drugs. For example, the Vaccine Adverse Event Reporting System accepts reports of adverse events that may be associated with U.S.-licensed vaccines from health care providers, manufacturers, and the public. In addition, FDA relies on various systems that support its administrative processes, such as payroll administration and personnel systems. All of the agency’s systems are supported by an IT infrastructure that includes network components, critical servers, and multiple data centers. The information that FDA receives is growing in volume and complexity. According to the agency, from 2001 to 2011, the number of import shipments that it inspected for admission into the United States increased from about 7 million imports reviewed annually to over 22.6 million. Additionally, in 2011, the agency estimated that 15 percent of the U.S. food supply was imported, including 60 percent of fresh fruits and vegetables and 80 percent of seafood. Advances in science and the increase in imports are factors affecting the complexity of information that FDA receives. The ability of the agency’s IT systems and infrastructure to accommodate this growth is crucial to FDA’s ability to accomplish its mission effectively. Compounding these challenges, reports and studies, both by FDA and others, have noted limitations in a number of key aspects of FDA’s IT environment, including data availability and quality, IT infrastructure, the agency’s ability to use technology to improve regulatory effectiveness, and IT management. In 2007, the FDA Science Board issued a report, FDA Science and Mission at Risk, which provided a broad assessment of challenges facing the agency. Specifically, this study found that the agency’s IT infrastructure was outdated and unstable, and it lacked sufficient controls to ensure continuity of operations or to provide effective disaster recovery services. The Science Board also stated that the agency did not have sufficient IT staff with skills in such areas as capital planning/investment control and enterprise architecture; that processes for recruitment and retention of IT staff were inadequate; and that the agency did not invest sufficiently in professional development. Further, the Science Board found that information was not easily and immediately accessible throughout the agency (including critical clinical trial data that were available only in paper form), hampering FDA’s ability to regulate products. Data and information exchange was impeded because information resided in different systems that were not integrated. According to the Science Board, FDA lacked sufficient standards for data exchanges, both within the agency and between the agency and external parties, reducing its capability to manage the complex data and information challenges associated with rapid innovation, such as new data types, data models, and analytic methods. Also in 2007, FDA commissioned Deloitte Consulting, LLP, to examine ways in which the agency could better meet increased demand for information and make decisions more quickly and easily. Deloitte’s study stated that FDA needed to develop both a common enterprise information management architecture and an IT architecture to facilitate both short- term operational gains, such as improved information access, and long- term gains in strategic flexibility. Deloitte noted that FDA’s former decentralized approach to IT, in which the centers developed their own systems, had led to duplicative work efforts, tools, and information. We also have previously reported on FDA’s systems and modernization efforts and noted deficiencies in its IT management. For example, in a June 2009 report on the agency’s plans for modernizing its IT systems, we noted that FDA lacked a comprehensive IT strategic plan that included results-oriented goals and performance measures to guide the agency’s modernization projects and activities. We also pointed out that FDA had made mixed progress in establishing important IT management capabilities that are essential in helping ensure a successful modernization. These capabilities included investment management, information security, enterprise architecture development, and human capital management. To help ensure the success of the agency’s modernization efforts, we recommended that it expeditiously develop a comprehensive IT strategic plan, give priority to architecture development, and complete key elements of its IT human capital planning. FDA agreed with our recommendations and identified actions initiated or planned to address them. In addition, we have previously identified problems with FDA’s Operational and Administrative System for Import Support (OASIS) import-screening system. Specifically, we reported in 2008 that OASIS had an inaccurate count of foreign establishments manufacturing drugs because unreliable manufacturer identification numbers were generated by customs brokers. FDA officials said these errors resulted in the creation of multiple records for a single establishment, which led to inflated counts of establishments offering drugs for import into the U.S. market. While FDA officials acknowledged this problem, they were unable to provide us with an estimate of the extent of these errors. In addition, the agency did not have a process for systematically identifying and correcting these errors. Accordingly, we made recommendations aimed at correcting these deficiencies; however, FDA did not comment on these recommendations. In September 2010, we reported that OASIS still provided an inaccurate count of foreign establishments manufacturing drugs offered for import into the United States. Further, in September 2009, we reported that Customs and Border Protection’s import screening system did not notify OASIS when imported food shipments arrived at U.S. ports. We pointed out that, without access to time-of-arrival information, FDA did not know when shipments that require examinations or reinspections arrive at the port, which could increase the risk that unsafe food may enter U.S. commerce. We therefore recommended that Customs and Border Protection ensure that its new screening system communicates time-of-arrival information to FDA, and the agency agreed with this recommendation. In May 2010, we testified that, according to FDA officials, Customs and Border Protection had modified its software to notify FDA of a shipment’s time of arrival. GAO-08-597. commit to taking action on them.