In 2008, we reported that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS’s security goals, there is only limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. FPS uses a facility-by-facility approach to risk management. Under this approach, FPS assumes that all facilities with the same security level have the same risk regardless of their location. For example, a level IV facility in a metropolitan area is generally treated the same as one in a rural area. We also reported in 2008 that FPS’s approach does not include a process for examining comprehensive risk across the entire portfolio of GSA’s facilities. Both our and DHS’s risk management frameworks include processes for assessing comprehensive risk across assets in order to prioritize countermeasures based on the overall needs of the system. FPS’s building-by-building approach, however, prevents it from comprehensively identifying and prioritizing vulnerabilities and making countermeasure recommendations at a strategic level. Over the years we have advocated the use of a risk management approach that links threats and vulnerabilities to resource requirements and allocation. A risk management approach entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives, assessing risk, allocating resources based on risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. Risk assessment, an important element of a risk management approach, helps decision makers identify and evaluate potential risks so that countermeasures can be designed and implemented to prevent or mitigate the effects of the risks. In response to our recommendations in this area, FPS began developing a new system referred to as the Risk Assessment Management Program (RAMP). This system is designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures in place to mitigate risk. FPS also anticipates that RAMP will allow inspectors to obtain information from one electronic source, generate reports automatically, enable FPS to track selected countermeasures throughout their life cycle, address some concerns about the subjectivity inherent in facility security assessments (FSA), and reduce the amount of time inspectors and managers spend on administrative work. FPS designed RAMP so that it will produce risk assessments that are compliant with Interagency Security Committee (ISC) standards, which, among other things, require risk assessment methodologies to be credible, reproducible, and defensible and for FSAs to be done every 3 to 5 years. According to FPS, RAMP is also compatible with the risk management framework set forth by the National Infrastructure Protection Plan (NIPP), and consistent with the business processes outlined in the memorandum of agreement with GSA. According to FPS, RAMP will support all components of the FSA process, including gathering and reviewing building information; conducting and recording interviews; assessing threats, vulnerabilities, and consequences to develop a detailed risk profile; recommending appropriate countermeasures; and producing FSA reports. FPS also plans to use RAMP to track and analyze certain workforce data, contract guard program data, and other performance data, such as the types and definitions of incidents and incident response times. Currently, FPS is in the process of implementing the first phase of RAMP and plans to have it fully implemented by the end of 2011. We are reviewing the design and implementation of RAMP and will provide Congress with a final report next year. We reported in July 2009 and April 2010 that FPS faces challenges in ensuring that many of the 15,000 contract security guards that FPS relies on to help protect federal facilities have the required training and certification to be deployed at federal facilities. We also identified substantial security vulnerabilities related to FPS’s guard program. Each time they tried, in April and May 2009, our investigators successfully passed undetected through security checkpoints monitored by FPS’s guards, with the components for an improvised explosive device concealed on their persons at 10 level IV facilities in four major metropolitan areas. FPS also took a number of immediate actions to address concerns raised about contract guard management in our July 2009 contract guard report. For example, since July 2009, FPS has increased its penetration tests in some regions and the number of guard inspections it conducts at federal facilities in some metropolitan areas. FPS currently requires its inspectors to complete two guard inspections a week at level IV facilities. Prior to this new requirement, FPS did not have a national requirement for guard inspections, and each region we visited had requirements ranging from no inspections to five inspections per month per FPS inspector. FPS is also in the process of providing additional X-ray and magnetometer training in response to our July 2009 testimony. FPS anticipates that guards will be fully trained by the end of 2010. Under FPS’s revised training program, inspectors must receive 30 hours of X-ray and magnetometer training and guards must receive 16 hours. Prior to this revision, guards needed 8 hours of training on X-ray and magnetometer machines. However, despite these changes, we remain concerned about FPS’s oversight of the contract guard program and made recommendations for additional improvements in our April 2010 report. For example, we reported that despite FPS’s recent actions, guards were continuing to neglect or inadequately perform their assigned responsibilities. We also remained concerned that FPS had not acted diligently in ensuring the terms of its guard contract and taken enforcement action when noncompliance occurred. Thus, we recommended, among other things, that FPS identify other approaches that would be cost-beneficial for protecting federal facilities. FPS agreed with this recommendation but has not yet implemented it. We have reported on several issues related to locating FPS within DHS’s Immigration and Customs Enforcement (ICE). For example, we reported in 2008 that some of FPS’s operational and funding challenges stemmed from it being part of ICE. In October 2009, to enable FPS to better focus on its primary facility protection mission, the Secretary of Homeland Security transferred FPS from ICE to the National Protection and Programs Directorate (NPPD). According to DHS, transferring FPS to NPPD will enhance oversight and efficiency while maximizing the department’s overall effectiveness in protecting federal buildings across the country. We are reviewing the transition of FPS into NPPD and will provide Congress with a final report in 2011. FPS has yet to fully ensure that its recent move to an inspector-based workforce does not hinder its ability to protect federal facilities. In 2007, FPS essentially eliminated its police officer position and moved to an all- inspector-based workforce. FPS also decided to place more emphasis on physical security activities, such as completing FSAs, and less emphasis on law enforcement activities, such as proactive patrol. We reported in 2008 that these changes may have contributed to diminished security and increases in inspectors’ workload. Specifically, we found that when FPS is not providing proactive patrol at some federal facilities, there is an increased potential for illegal entry and other criminal activity. For example, in one city we visited, a deceased individual had been found in a vacant GSA facility that was not regularly patrolled by FPS. Under its inspector-based workforce approach, FPS will rely more on local police departments to handle crime and protection issues at federal facilities. However, at about 400 federal facilities across the United States, the federal government has exclusive jurisdiction, and it is unclear if local police have the authority to respond to incidents inside those facilities. Additionally, FPS has not entered into any memorandums of agreement for increased law enforcement assistance at federal facilities. In most of the cities we visited, local law enforcement officials said they would not enter into any agreements with FPS that involve increased responsibility for protecting federal facilities because of liability concerns, existing shortages of staff, and the need to respond to crime in their cities that would make it difficult to divert resources from their primary mission. For example, local law enforcement officials from one location we visited said they are significantly understaffed and overburdened with their current mission and would not be able to take responsibility for protecting federal facilities. We believe that it is important that FPS ensure that its decision to move to an inspector-based workforce does not hamper its ability to protect federal facilities. We recommended in 2008 that FPS clarify roles and responsibilities of local law enforcement agencies in responding to incidents at GSA facilities. While FPS agreed with this recommendation, FPS has decided not to pursue agreements with local law enforcement officials, in part because of reluctance on the part of local law enforcement officials to sign such agreements. In addition, FPS believes that the agreements are not necessary because 96 percent of the properties in its inventory are listed as concurrent jurisdiction facilities where both federal and state governments have jurisdiction over the property. Nevertheless, we continue to believe that these agreements would, among other things, clarify roles and responsibilities of local law enforcement agencies when responding to crime or other incidents. While FPS has recently increased the size of its workforce as mandated by Congress, we reported in our 2009 report that FPS has operated without a human capital plan. We recommended that FPS develop a human capital plan to guide its current and future workforce planning efforts. We have identified human capital management as a high-risk issue throughout the federal government, including within DHS. Without a long-term strategy for managing its current and future workforce needs, including effective processes for hiring, training, and staff development, FPS will be challenged to align its personnel with its programmatic goals. FPS concurred with this recommendation and has drafted a workforce analysis plan but has not yet fully developed or implemented a human capital plan. FPS’s primary means of funding its operations—the basic security fee charged to some federal agencies—does not account for a building’s level of risk, the level of service provided, or the cost of providing those services.