For many years we have advocated the use of a risk management approach that entails managing risk through actions, including setting strategic goals and objectives, assessing risk, allocating resources based on risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. Risk assessment, an important element of a risk management approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. FPS meets its mission to protect GSA’s federal facilities by assessing the risks that face those facilities and identifying the appropriate countermeasures to mitigate those risks. Despite the importance of this mission, FPS has not implemented an effective risk management program. In August 2010, we reported that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements. Instead, FPS uses a facility-by- facility approach to risk management: we reported in 2010 that FPS assumes that all facilities with the same security level have the same risk regardless of their location. For example, a level IV facility in a metropolitan area is generally treated the same as one in a rural area. This building-by-building approach prevents FPS from comprehensively identifying risk across the entire portfolio of GSA’s facilities and allocating resources based on risk. Both our and DHS’s risk management frameworks include processes for assessing comprehensive risk across assets in order to prioritize countermeasures based on the overall needs of the system. In response to our recommendations in this area, FPS began developing a new system, the Risk Assessment and Management Program (RAMP). According to FPS, RAMP will support all components of the risk assessment process, including gathering and reviewing building information; conducting and recording interviews with GSA and tenant agencies; assessing threats, vulnerabilities, and consequences to develop a detailed risk profile; recommending appropriate countermeasures; and producing facility security assessment (FSA) reports. FPS also plans to use RAMP to track and analyze workforce data, contract guard program data, and other performance data, such as the types and definitions of incidents and incident response times. We are finalizing our ongoing review of FPS’s efforts to develop and implement RAMP as well as FPS’s transition to DHS’s National Protection and Programs Directorate (NPPD) and expect to report on these issues soon. Over the last 3 years we have reported on the challenges FPS has faced in the human capital area since moving to DHS from GSA in 2003. As mandated by Congress, in 2009 FPS increased the size of its workforce to 1,200 full time employees. However, FPS continues to operate without a strategic human capital plan. We recommended in 2009 that FPS develop a human capital plan to guide its current and future workforce planning efforts. We have identified human capital management as a high-risk issue throughout the federal government, including within DHS. A human capital plan is important to both align FPS’s human capital program with current and emerging mission and programmatic goals, and develop effective processes for training, retention, and staff development. In 2009, we reported that the absence of such a plan has contributed to inconsistent human capital activities among FPS regions and headquarters, as several regions told us they have implemented their own processes for performance feedback, training, and mentoring. In addition, we found that FPS’s workforce planning is limited because FPS headquarters does not collect data on its workforce’s knowledge, skills, and abilities. Without such information, FPS is not able to determine what its optimal staffing levels should be or identify gaps in its workforce needs and determine how to modify its workforce planning strategies to fill these gaps. FPS concurred with our recommendation and drafted a workforce analysis plan in June 2010. According to FPS, the plan must be reviewed by the Office of Management and Budget (OMB) before it is subject to approval by the Secretary of Homeland Security. FPS also has yet to fully ensure that its recent move to an inspector- based workforce does not hinder its ability to protect federal facilities. In 2007, FPS essentially eliminated its police officer position and moved to an all inspector-based workforce. FPS also decided to place more emphasis on physical security activities, such as completing FSAs, and less emphasis on law enforcement activities, such as proactive patrol. We reported in 2008 that these changes may have contributed to diminished security and increases in inspectors’ workload. Specifically, we found that when FPS is not providing proactive patrol at some federal facilities, there is an increased potential for illegal entry and other criminal activity. Moreover, under its inspector-based workforce approach, FPS is relying more on local police departments to handle crime and protection issues at federal facilities; however, we previously reported that at approximately 400 federal facilities across the United States, local police may not have the authority to respond to incidents inside those facilities. We recommended in 2008 that FPS clarify roles and responsibilities of local law enforcement agencies in responding to incidents at GSA facilities. While FPS agreed with this recommendation, FPS has decided not to pursue agreements with local law enforcement officials, in part because of local law enforcement officials’ reluctance to sign such agreements. In addition, FPS believes that the agreements are not necessary because 96 percent of the properties in its inventory are listed as concurrent jurisdiction facilities where both federal and state governments have jurisdiction over the property. Nevertheless, we continue to believe that these agreements would, among other things, clarify roles and responsibilities of local law enforcement agencies when responding to crime or other incidents. We are currently reviewing to what extent FPS is coordinating with state and local police departments to ensure adequate protection of federal facilities and will issue a report next year. FPS’s contract guard program is the most visible component of the agency’s operations and the agency relies on its guards to be its “eyes and ears” while performing their duties. Guards are responsible for controlling access to federal facilities by checking the identification of government employees and the public who enter federal facilities, and operating security equipment to screen for prohibited items. Since 2009, we have identified weaknesses in FPS’s contract guard program which hamper its ability to protect federal facilities. For example, we reported in 2009 and in 2010 that FPS does not have a reliable system to ensure that its 13,000 guards have the training and certifications required to stand post at federal facilities or comply with post orders once they are deployed. In 2009, we also identified substantial security vulnerabilities related to FPS’s guard program. In April and May 2009, GAO investigators conducted covert tests and were able to successfully pass components of an improvised explosive device (IED) concealed on their persons through security checkpoints monitored by FPS guards at 10 Level IV facilities in 4 major metropolitan areas. In addition, FPS’s penetration testing—similar to our covert testing—shows that guards continue to have problems with detecting prohibited items. For example, in March 2011, FPS contract guards allowed components for an active bomb to remain in a Level IV federal building in Detroit, Michigan for 3 weeks before a bomb squad was called to remove them. We also found in 2010 that although some guard contractors did not comply with the terms of their contracts, FPS did not take any enforcement action against them. According to FPS guard contracts, a contractor has not complied with the terms of the contract if, for example, the contractor has a guard working without valid certifications or background suitability investigations, or falsifies a guard’s training records. If FPS determines that a contractor does not comply with these contract requirements, it can—among other things—assess a financial deduction for nonperformed work, elect not to exercise a contract option, or terminate the contract for default or cause. We reviewed the official contract files for the 7 contractors who, as we testified in July 2009, had guards performing on contracts with expired certification and training records to determine what action, if any, FPS had taken against these contractors for contract noncompliance. According to the documentation in the contract files, FPS did not take any enforcement action against the contractors for not complying with the terms of the contract. Instead, FPS exercised the option to extend the contracts for these 7 contractors. Additionally, although FPS requires an annual performance evaluation of each guard contractor and at the conclusion of contracts exceeding $100,000, FPS did not always evaluate the performance of its contractors as required, and some evaluations were incomplete and not consistent with contractors’ performance. In response to our recommendations, FPS has taken several steps to improve the oversight of its contract guard program. Since July 2009, FPS has increased its penetration tests in some regions and the number of guard inspections it conducts at federal facilities in some metropolitan areas. Additionally, FPS began the process of providing additional x-ray and magnetometer training for its workforce. Under the new requirement, inspectors must receive 30 hours of x-ray and magnetometer training and guards are required to take 16 hours. Previously, guards were required to receive 8 hours of training on x-ray and magnetometer machines. Finally, FPS expects to use RAMP, once it is developed, to determine whether its 13,000 guards have met its training and certification requirements and to conduct guard inspections. As stated earlier, we are finalizing our review of FPS’s RAMP. We reported in May 2011 that FPS increased its basic security fee 4 times in 6 years to try to cover costs (an increase of over 100 percent). However, FPS has not reviewed its fees to develop an informed, deliberate fee design. We found that timely, substantive fee reviews are especially critical for fee-funded agencies to ensure that fee collections and operating costs remain aligned. FPS has broad authority to design its security fees, but the current fee structure has consistently resulted in total collection amounts less than agency costs, is not well understood or accepted by tenant agencies, and continues to be a topic of congressional interest and inquiry.