NMB is headed by a three-member board, with each member appointed by the President and confirmed by the Senate for a term of 3 years. Day-to-day administration of the agency is provided by NMB’s General Counsel within the Office of Legal Affairs and the Chief of Staff (see fig. 1). NMB does not have an office of inspector general to provide independent audit and investigative oversight. According to NMB, its overall mission is to provide for the independence of air and rail carriers and employees in matters of self-organization, avoid interruption to commerce conducted through the operation of those carriers, and administer statutory adjustment boards as well as develop complementary strategies to resolve disputes. To fulfill its mission, NMB has three program areas: Representation: Unions are selected for the purposes of collective bargaining through secret-ballot elections conducted by NMB. If there is a question concerning representation of a specific craft or class,NMB is charged with resolving the representation dispute through its Office of Legal Affairs, and has the sole jurisdiction to decide these disputes. Mediation and Alternative Dispute Resolution: The RLA provides mediation to help resolve disputes that can occur between management and labor during collective bargaining negotiations.When rail or air carriers and unions cannot reach agreement on the terms of a new or revised collective bargaining agreement—such as working conditions or rates of pay—either party can apply for NMB’s mediation services to resolve their differences or NMB may impose mediation if it finds that resolving the dispute is in the public’s interest. NMB also offers grievance mediation to parties as an alternative way to resolve disputes filed for grievance arbitration. Arbitration: The RLA also offers grievance arbitration to help resolve disagreements between carriers and unions over how to interpret and apply provisions of existing collective bargaining agreements. For example, employees may file grievances if they believe they were wrongfully fired or disciplined in violation of the agreement. If the carrier and the employee cannot resolve the grievance, the RLA permits either of these parties to refer the dispute to arbitration before an adjustment board. The adjustment board consists of a carrier representative, a union representative, and a neutral arbitrator provided by NMB. In this capacity, the arbitrator is called upon to break a tie. NMB does not directly provide arbitration services, but rather maintains a list of registered arbitrators from which the parties can select someone to review and decide their case. In the airline industry, the parties pay the costs of arbitration. In the railroad industry, however, consistent with the requirements of the RLA, NMB pays the fee and travel expenses of the arbitrator. NMB has made some progress in implementing each of the seven recommendations we made in December 2013. In our December 2013 report, we found that NMB lacked a formal strategic planning process and officials confirmed that they did not have a systematic mechanism for involving congressional and other stakeholders in this process. We concluded that without a robust process, NMB lacked assurance that its limited resources were effectively targeted toward its highest priorities. In this review, we found that NMB has implemented a strategic planning process but has not formalized it through written policies and procedures. In fiscal year 2014, NMB developed and published a strategic plan covering fiscal years 2014 through 2019, which we determined was largely consistent with OMB guidance on implementing the GPRA Modernization Act of 2010 (GPRAMA). NMB officials told us they used a strategic planning process soliciting input from staff in NMB program areas as well as from external stakeholders and Congress. Five of the seven external stakeholder groups that we interviewed said they commented on a draft of the strategic plan or discussed aspects of it during regular meetings with the agency, and all reported being satisfied with their overall communication with NMB. However, the agency has not developed a written policy or set of procedures outlining its strategic planning process. Federal internal control standards call for agencies to document the policies and procedures necessary to achieve their objectives, including strategic planning. Specifically, agencies should (1) establish policies and procedures to ensure that management directives are carried out and (2) appropriately document transactions and other significant events, and ensure that those records are properly managed, maintained, and available for examination. Further, through these policies and procedures, agency management can define responsibilities, assign key roles, and delegate authority. Meeting these requirements may be particularly important for NMB. NMB officials said there was little need for preparing written documentation of the strategic planning process, such as a standard operating procedure, because it was simple and would be easy to replicate in the future. Officials also said, because the agency is small, with 51 full-time positions, its staff frequently communicate informally, limiting the need for written procedures. However, three of NMB’s five senior managers, including the Chief of Staff and General Counsel, are eligible to retire, as are many other employees, increasing the risk of the agency losing institutional knowledge should they do so. Moreover, because the agency is small, some staff members have multiple responsibilities, increasing the magnitude of knowledge loss when an individual staff member leaves the agency. In our December 2013 report, we found that NMB was not meeting OMB guidance to implement GPRAMA requirements for annual performance planning and reporting. Specifically, the agency’s performance goals were not objective, quantifiable, and measurable—as required by GPRAMA— and did not have targets and a time period over which to measure performance—as recommended by OMB guidance implementing GPRAMA. Without meeting this federal guidance, we concluded that the agency was not positioned to track and publicly report progress or results in its program areas. In this review, we found that NMB has developed new performance goals. However, of the 19 goals in its fiscal year 2016 performance plan, one goal specified a target, another specified a timeframe; but none followed all elements of OMB guidance for implementing GPRAMA. Several NMB officials told us that it is difficult for the agency to design performance goals because some outcomes are out of its control, such as how long it takes parties to reach agreement through mediation. Many federal agencies also set measurable performance goals for outcomes that include external factors outside of their direct control. Our prior work has shown that there are a number of strategies that federal agencies can use to reduce the influence of external factors on agencies’ measures. OMB officials told us NMB could seek assistance from them to refine its performance goals or could partner with another agency that has a strong performance management department. GAO 2013 Recommendation: NMB should develop and implement a formal mechanism to ensure the prompt resolution of findings and recommendations by independent auditors, including clearly assigning responsibility for this follow-up to agency management. In our December 2013 report, we found that NMB was following most key practices for financial accountability and control, but had an outstanding significant deficiency from its fiscal year 2012 financial statement audit and did not have a mechanism for ensuring prompt resolution of audit findings. As a result, we concluded that some recommendations made by auditors to improve the agency’s internal controls or operations may not have been addressed. In this review, we found that while NMB in fiscal year 2015 resolved the significant deficiency identified in its 2012 financial statement audit, it does not have a formal mechanism to promptly resolve all audit findings consistent with federal internal control standards. Specifically, while NMB drafted a financial audit standard operating procedure in 2014, it does not cover the agency’s response to findings from non-financial audits. The agency has also not addressed two recommendations made in previous auditors’ management letters that accompanied NMB’s financial audit reports. One of those recommendations was made as a result of the fiscal year 2014 audit and the other recommendation was related to a discrepancy that has been unresolved since 1995. In its fiscal year 2015 response, NMB indicated that the only management official with knowledge of the long-term discrepancy had retired and the agency would work to resolve the discrepancy through its financial management system. In our December 2013 report, we found that NMB had not fully implemented key practices for information security and privacy. Without implementation of these key practices, we concluded that NMB had increased risks that the confidentiality, integrity, and availability of its information would be compromised and it had limited assurance that the personal information it collected and used was adequately protected. In this review, we found that NMB has fully transitioned its network infrastructure and records management system into a cloud computing environment as a result of federal initiatives aimed at improving, among other things, the federal government’s operational efficiencies and overall IT security posture. NMB also fully transitioned its financial systems to third-party service providers. Specifically, NMB relies on other agencies’ systems, such as the Department of the Interior, for payroll, personnel, and human resources services, and the Department of the Treasury’s Bureau of the Fiscal Service for a full range of accounting services, including hosting its financial management system. In addition, NMB has begun to take steps to improve its information security program. Specifically, NMB developed a policy for managing agency information, documents, and records. The agency has also drafted procedures for its new enterprise network that include provisions for access and identity control, configuration management, planning, contingency monitoring, and audits. Further, it has developed a procedure for handling cyber incidents. Finally, it has an agreement in place with the Bureau of the Fiscal Service to, among other things, conduct a security assessment of its enterprise network. However, NMB has not fully implemented most key information security and privacy practices. (For additional details, see appendix II.) For example, the agency does not have policies and procedures in place for its information security program, including those for the oversight of third- party providers—entities that provide or manage information systems that support NMB operations. In addition, NMB has not conducted the required assessments of its third-party providers to ensure their systems are in compliance with the Federal Information Security Modernization Act (FISMA) of 2014.