Since its creation in 1977, DOE has been responsible for developing, producing, and maintaining nuclear weapons; preventing the proliferation of weapons of mass destruction; designing, building, and maintaining naval nuclear propulsion systems; and ensuring the security of the nuclear weapons complex. In 2000, however, the Congress created a separately organized agency within DOE—the NNSA. NNSA’s Office of Defense Nuclear Security is primarily responsible for developing the agency’s security programs, including protecting, controlling, and accounting for material and ensuring physical security for all facilities in the complex. Historically, NNSA has conducted comprehensive annual surveys of contractors’ operations for safeguards and security. These surveys, which can draw upon subject matter experts throughout the complex, generally take about 2 weeks to conduct and cover 5 “topical” areas and 32 subtopical areas. The topical areas include program management, protection program operations, information security, nuclear materials control and accountability, and personnel security. The survey team assigns ratings of satisfactory, marginal, or unsatisfactory. Currently, NNSA’s facilities have been rated satisfactory in most topical areas. All deficiencies (findings) identified during a survey require the contractors to take corrective action, and both findings and corrective actions are to be entered in the Safeguards and Security Information Management System—a DOE-wide, integrated tracking database for findings of surveys and other safeguards and security activities. In addition, NNSA’s Office of Facilities and Operations is expected to provide policy guidance for safeguards and security. This office is also expected to be responsible for the Nuclear Safeguards and Security Program, which oversees the implementation of safeguards and security in NNSA facilities. The office is expected to integrate and defend the budget for safeguards and security to ensure that program components can achieve mission objectives. Through various contract mechanisms, NNSA provides financial incentives, such as award fees, for contractor performance. NNSA assesses this performance based on the extent contractors meet a set of measures, which are generally established in annual performance plans—so-called performance measures. DOE’s Office of Independent Oversight and Performance Assurance supports NNSA in safeguards and security assessments and conducts independent oversight activities in line with DOE and NNSA policies and priorities. Among other things, the office is responsible for evaluating the effectiveness of contractors’ performance in safeguards and security. To carry out this function, this office periodically assesses both federal and contractor operations at a site and identifies findings, issues, and opportunities for improvement. It also performs follow-up reviews to ensure corrective actions are effective and that weaknesses in safeguards and security are appropriately addressed. NNSA has not been fully effective in managing its safeguards and security program in four key areas, and therefore, it cannot be assured that its contractors are working to maximum advantage to protect its sites. First, NNSA has not fully defined safeguards and security roles and responsibilities. Second, without an effective management structure, site offices are uncertain about how to conduct their safeguards and security responsibilities. This uncertainty has resulted in inconsistencies in how site offices comply with DOE orders in assessing contractors. Third, even when assessments are done, NNSA contractors do not consistently conduct required DOE analyses in preparing corrective action plans. Finally, NNSA’s shortfalls at its site offices in the total number of staff and expertise could make it more difficult for the site offices to oversee safeguards and security effectively. Since its creation in March 2000, NNSA’s management structure has been in a state of flux, and NNSA expects it will take at least to September 2004 to implement a new management structure. However, NNSA needs a stable structure to establish clear roles and responsibilities for its headquarters and site offices, including safeguards and security oversight. In May 2001, NNSA’s Administrator proposed a management structure for his organization, but in December 2001, we reported that a clearly delineated overall management structure still did not exist. In February 2002, NNSA reported in more detail to Congress on its outline for a new management structure to improve NNSA’s effectiveness and efficiency. NNSA expected to implement the new structure later in the year. Since then, NNSA headquarters and field officials have been defining safeguards and security roles and responsibilities. In December 2002, NNSA fundamentally changed the management structure for safeguards and security. It abolished operations offices, which had been responsible for conducting the annual, comprehensive surveys as well as other safeguards and security activities. It divided these operations offices’ responsibilities among the site offices and a service center, formerly the Albuquerque operations office; headquarters will oversee the performance of the site offices. The restructuring brings day-to-day federal oversight of laboratories and plants closer to the site offices. However, these changes do not complete the management structure. NNSA plans to further streamline its oversight of contractors by reducing site activities. Among other things, NNSA plans to focus more on ensuring that contractors’ management systems are valid. Furthermore, NNSA plans to review its policies and practices and decide which site office oversight activities can be reduced or eliminated in order for the site offices to work more efficiently. It has not yet identified which specific activities will be modified. At the time of our review, headquarters could not provide details on how it intends to monitor the NNSA site offices’ performance with respect to safeguards and security or address deficiencies. In creating this new management structure, NNSA has not yet developed a Functions, Responsibilities, and Authorities Manual (FRAM), an organizational tool used by managers at federal agencies, including DOE, for defining roles and responsibilities. This manual is to address the functions, responsibilities, and authorities of all elements within NNSA. NNSA headquarters security officials agree that this guidance is crucial and stated that they are currently developing the components of a FRAM, which should be finalized in 2003. NNSA told us that completing the FRAM takes significant time because of the highly detailed planning necessary for determining staff functions at the various sites. According to NNSA site office officials, as they wait for formal guidance from headquarters on conducting security oversight, each office is carrying out oversight activities as it deems appropriate. In addition, these officials told us that they have not received formal notification about the change in their safeguards and security oversight responsibilities, such as responsibilities for the survey program. Officials at several site offices expressed frustration with this lack of direction. NNSA site offices are not consistent in how they assess contractor safeguards and security activities, and they may not be conducting these assessments in accordance with DOE policy. The lack of consistency and the failure to implement DOE policy occurs in part because the site offices have had to assume new oversight responsibilities without, among other things, clear guidance from headquarters on how to carry out these responsibilities. As a result, three offices of the seven NNSA site offices we visited continue to use the traditional survey approach to oversee security activities (Oak Ridge, Savannah River, and NNSA’s Office of Transportation Safeguards), while the remaining four have adopted or are adopting a surveillance model—-Amarillo, Kirtland, Livermore, and Los Alamos. The distinction between these two activities is important: A survey provides a comprehensive annual review, by a team of experts, of contractor safeguards and security and generally takes about 2 weeks; formerly, the operations offices generally conducted surveys, assisted by experts from throughout the complex, as necessary. In contrast, surveillance relies on a single or small number of NNSA site officials overseeing one or more aspects of a contractor’s safeguards and security activities throughout the year, and the documentation from a surveillance or a group of surveillance activities may be used as part of the survey. By relying on surveillance, NNSA may have less assurance that it fully knows the condition of security at its sites and therefore potentially cannot act to correct deficiencies undisclosed by this limited review. Surveillance allows subject matter experts at the sites to evaluate areas of contractor safeguards and security performance more often than the traditional survey process and therefore potentially identify deficiencies faster. However, according to DOE officials, reliance on surveillance is not consistent with DOE orders calling for a comprehensive survey of a contractor’s safeguards and security performance. This survey provides a unified assessment of all security-related topical areas. Officials from DOE’s Office of Security—which developed the policy for conducting surveys—believe the surveillance model does not comply with DOE order survey requirements because it is not comprehensive. Officials from DOE’s Office of Independent Oversight and Performance Assurance expressed concern about the site offices’ ability to conduct surveillance because of shortfalls in available expertise. Furthermore, the director of NNSA’s Office of Defense Nuclear Security acknowledged that although some NNSA site offices, such as the Los Alamos site office, are using the surveillance model, this site and others lacked the necessary personnel to conduct surveillance. According to officials from DOE’s Office of Independent Oversight and Performance Assurance and one site office, surveillance is not compatible with the current Safeguards and Security Information Management System, a DOE information database system used to track findings and associated corrective actions, and therefore could pose problems for sites in entering information. On the other hand, NNSA officials at site offices and headquarters argue that using the surveillance model for oversight will produce an annual end of the year survey report and should have the same end result as an annual survey. However, NNSA could have difficulty ensuring consistent and comprehensive assessments because of the difficulties posed by using the surveillance model without appropriate NNSA-wide implementation guidance, site office staffing shortfalls, and database compatibility problems. Contractors have not consistently prepared effective, formal root cause analyses in developing corrective action plans for identified deficiencies, as DOE policy requires. An effective, formal, root cause analysis can enhance the development of corrective actions, as we observed while reviewing some plans.