Since FPS was created in 1971, as part of GSA, it has been responsible for providing law enforcement and related security services to all federal facilities held or leased by GSA. Specifically, FPS is responsible for, among other things, (1) hiring security guard contractors and overseeing contract guards deployed at federal facilities, (2) controlling access to federal facilities, (3) responding to incidents, (4) enforcing property rules and regulations, and (5) conducting criminal investigations and facility security assessments (FSA). To accomplish this facility protection mission and other responsibilities, as of October 2014, FPS has about 1,200 full-time employees located in its headquarters and 11 regional offices around the country. FPS also has about 13,500 contract security guards deployed at approximately 5,650 of the almost 9,000 federal facilities it protects. To fund its operations, FPS charges fees for its security services to federal tenant agencies in GSA-controlled facilities. For fiscal year 2014, FPS expected to receive $1.3 billion in fees. In the 1980s, some federal departments and agencies raised concerns that GSA was not providing quality building services, including the physical security provided by FPS, in a timely manner. In response, GSA’s Administrator decided to establish a delegation of authority program that would primarily decentralize building services such as security and lease management. A 1985 Executive Order also directed GSA to delegate its building operations authority to tenant agencies when it was feasible and economical. To make this determination, GSA required agencies to maintain program and financial data, which GSA reviewed to determine whether to grant a delegation. When FPS transferred from GSA to DHS in 2002, this delegation of authority program also transferred. Under the program, FPS is responsible for reviewing delegations for law enforcement and security services and determining ─based on cost and capabilities analysis─ if it is in the best interest of the government to authorize another department or agency to protect a federal facility instead of FPS. FPS also is responsible for ensuring that these delegated facilities are protected in a manner consistent with the Interagency Security Committee’s (ISC) standards. A law enforcement delegation of authority authorizes an agency to enforce federal laws and regulations aimed at protecting the agency’s federal facilities identified in the delegation and the employees and public who work in and visit those facilities; conduct investigations related to offenses against the property and persons on the property, and arrest and detain persons suspected of federal crimes. A delegation of authority for security services typically authorizes an agency to manage its own contract guard program at the specified federal facilities, including awarding and administering contracts, and ensuring that guards are properly trained and certified to protect those facilities. An agency may also receive a delegation of authority for both law enforcement and contract guard services. Delegations of authority are generally granted for about 2 to 5 years, but the expiration dates for some existing delegations are not specified or the delegation indicates that it will continue until terminated by FPS, according to FPS officials. In response to congressional direction, in November 2012, FPS issued its Interim Plan, which outlines its current process for reviewing delegations of authority. This process, which is managed primarily by FPS headquarters staff (one full-time employee and three part-time employees) in coordination with its 11 regional offices, includes four phases. During this phase, which began in 2010 and is still ongoing, FPS has focused on identifying delegations of authority that were primarily granted when FPS was part of GSA because FPS at that time did not have a centralized recordkeeping system. As part of this identification process, FPS contacted its 11 regions and GSA to determine if they had copies of delegations. In addition, in some instances, FPS obtained information about an existing delegation from agencies that were granted such authority. FPS uploaded the information it collected from these delegations into an electronic database. During this phase, the Interim Plan calls for FPS to conduct cost and capabilities analyses to determine whether to renew or rescind an existing delegation or grant a new one. To perform the cost analysis, FPS developed a cost estimation model, which establishes a standardized process for assessing the financial impact of each delegation of authority. As part of this cost analysis, FPS compares its and the delegated agency’s costs of providing law enforcement or security services. For example, to estimate the current resources expended by the delegated agency and to determine the cost that FPS would be expected to incur if the delegation were rescinded, FPS reviews data on the amount it would spend and the amount the agency currently spends on various cost elements, such as salaries and benefits; guards’ training and certification; law enforcement equipment (e.g., computers, uniforms, and mobile radios); and mega-center (dispatch center) services. In addition, information about the FSA; countermeasures (i.e., contract security guards, K-9 officers); training, services; and equipment (i.e., ammunition, cell phones, and office supplies) are also required to be entered into the cost estimation model. To conduct a capability analysis, FPS determines if services—such as acquisition of guard services, training, criminal investigations, guard oversight, and a mega center—are in place at the delegated facility; how those services are provided and resourced; and whether FPS can provide those services on a reimbursable basis and, if so, how much it would cost. According to the Interim Plan, after completing the cost and capabilities analyses, FPS recommends to DHS’s Under Secretary for the National Protection and Programs Directorate (NPPD) whether a delegation should be granted, renewed, or rescinded. The Under Secretary then makes the final decision and notifies the agency requesting a delegation of authority. For delegations that are rescinded, FPS’s Interim Plan requires an orderly transition of law enforcement or guard services so that there is no lapse in protection of the facility. For delegations that are granted or renewed, FPS has responsibility for overseeing the delegations and will conduct periodic inspections to ensure that the delegated facilities are protected in a manner consistent with its contract requirements and federal physical security standards. In September 2014, FPS drafted a directive that establishes its policy and procedures and assigns responsibilities for law enforcement and contract security guard delegations of authority. Among other things, the draft directive provides further detail on the roles and responsibilities of FPS headquarters and regional staff in reviewing delegations of authority and how FPS plans to verify that existing delegations are active, have not expired, or the facility is vacant. The draft directive also requires any agency requesting a delegation to complete a self-assessment of its security services and provide FPS with a copy of the most recent facility security assessment. As of January 2015, FPS had not set a timeframe for finalizing and implementing the draft directive. FPS’s delegations of authority program does not fully meet applicable federal standards we identified for effective program management. FPS lacks reliable data, as called for by federal Standards for Internal Control in the Federal Government, for accurately identifying the total delegations it is responsible for managing. In addition, FPS’s model for estimating the costs associated with a delegation does not fully align with the relevant leading practices outlined in GAO’s Cost Guide. Without fully meeting these standards and leading practices, FPS cannot ensure that its decisions to grant, renew, or rescind delegations of authority are based on sound data and that security resources are efficiently allocated and in a manner that leads to effective protection of federal facilities. FPS lacks reliable data for identifying the total number of delegations of authority it has granted. Specifically, FPS has not established a reliable baseline for the number of delegations of authority that have been granted since the 1980s and remain active and thus, does not know how many it needs to review and oversee to ensure that law enforcement and security services are provided at these federal facilities. The federal Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external-reporting purposes. As previously discussed, in its Interim Plan, FPS reported that it granted over 300 delegations to approximately 30 federal departments and agencies. During the course of our engagement, FPS began verifying these data in accordance with criteria it outlined in its September 2014 draft directive. According to the draft directive, FPS should exclude from the list of 300 delegations of authority identified in the Interim Plan, those delegations that had expired or where the delegated agency no longer occupies the facility. FPS officials also told us that rescinded delegations of authority should also be excluded. Based on its verification process, FPS officials stated that only 62 of the 300 delegations of authority identified in the Interim Plan were active delegations, as of October 2014. However, we reviewed the 62 delegations of authority FPS verified and─ based on FPS’s criteria for excluding delegations─ found that 12 were improperly included. Although FPS’s verification process was to exclude expired delegations, we found that 11 of the 62 delegations of authority it identified as active had expired, including 3 that had expired almost 20 years ago when the delegated agency was still responsible for protecting its own facilities. These 11 delegations of authority were granted to 6 departments and agencies (Departments of Commerce, Health and Human Services, Defense, State, and Treasury, and the Social Security Administration) to protect 81 facilities. Although rescinded delegations are to be excluded, we found that FPS’s validated data included a delegation that was granted to NRC but was rescinded in October 2013. That delegation also should have been excluded from FPS’s validated data because it related to four facilities that NRC officials explained they had not occupied in about 20 years.