Question:
Why GAO Did This Study

GAO designated NASA's acquisition management as a high-risk area in 1990 after a history of persistent cost growth and schedule slippage in many of NASA's major projects. In more recent years, GAO found that NASA had taken some steps to improve its management, and, in May 2017, GAO found that projects were continuing a generally positive trend of limiting cost and schedule growth. But at the same time, GAO noted that many of these projects, including some of the most expensive ones, were approaching the phase in their life cycles when cost and schedule growth is most likely.
This statement summarizes GAO's 2018 findings from its 10th annual snapshot of how well NASA is planning and executing its major acquisition projects, and describes (1) the cost and schedule performance of NASA's portfolio of major projects and (2) the extent to which NASA faces risks for further cost increases and schedule delays. To conduct its review for the 2018 report, GAO-18-280SP , GAO analyzed cost, schedule, and other data for NASA's 26 major projects, each with a life-cycle cost of over $250 million; reviewed monthly project status reports; and interviewed NASA officials.

What GAO Found

The cost and schedule performance of the National Aeronautics and Space Administration's (NASA) portfolio of major projects has deteriorated, but the extent of cost performance deterioration is unknown. NASA expects cost growth for the Orion crew capsule—one of the largest projects in the portfolio—but does not have a current cost estimate. In addition, the average launch delay for the portfolio was 12 months, the highest delay GAO has reported in its 10 years of assessing major NASA projects (see figure below).
The deterioration in portfolio performance was the result of 9 of the 17 projects in development experiencing cost or schedule growth.
Four projects encountered technical issues that were compounded by risky program management decisions. For example, the Space Launch System and Exploration Ground Systems programs are large-scale, technically complex human spaceflight programs, and NASA managed them to aggressive schedules and with insufficient levels of cost and schedule reserves. This made it more difficult for the programs to operate within their committed baseline cost and schedule estimates.
Two projects ran into technical challenges that resulted in delays in the integration and test phase. For example, in December 2017, GAO found that the James Webb Space Telescope project encountered delays primarily due to the integration of the various spacecraft elements taking longer than expected, as well as the need to resolve technical issues during testing. GAO has previously found that integration and testing is when projects are most at risk of incurring cost and schedule growth.
Three projects experienced cost growth or schedule delays due to factors outside of the projects' control, such as delays related to their launch vehicles.
NASA continues to face increased risk of cost and schedule growth in future years due to new, large and complex projects that will enter the portfolio and expensive projects remaining in the portfolio longer than expected.

What GAO Recommends

GAO is not making any new recommendations in this statement. GAO has made recommendations in prior reports to strengthen NASA's acquisition management of its major projects. NASA generally agreed with these recommendations, but has not fully addressed some of them. GAO continues to believe they should be fully addressed.


Question:
Why GAO Did This Study

Recent large-scale data breaches of public and private entities have put hundreds of millions of people at risk of identity theft or other harm. GAO was asked to review issues related to consumers' options to address risks of harm from data breaches. This report, among other things, examines information and expert views on the effectiveness of consumer options to address data breach risks. GAO analyzed available data on options, collected and analyzed related documentation, conducted a literature review of studies, and interviewed a nongeneralizable sample of 35 experts (from academia, government entities, consumer and industry organizations) and identity theft service providers to reflect a range of views.

What GAO Found

No one solution can address the range of potential risks from a data breach, according to interviews with academic, consumer, government, and industry experts and documentation GAO reviewed. Perpetrators of fraud can use stolen personal information—such as account numbers, passwords, or Social Security numbers—to take out loans or seek medical care under someone else's name, or make unauthorized purchases on credit cards, among other crimes. Foreign state-based actors can use personal information to support espionage or other nefarious uses.
Public and private entities that experience a breach sometimes provide complimentary commercial identity theft services to affected individuals to help monitor their credit accounts or restore their identities in cases of identity theft, among other features. Consumers also may purchase the services. As of November 30, 2018, the Office of Personnel Management (OPM) had obligated about $421 million for a suite of credit and identity monitoring, insurance, and identity restoration services to offer to the approximately 22 million individuals affected by its 2015 data breaches. As of September 30, 2018, about 3 million had used the services and approximately 61 individuals had received payouts from insurance claims, for an average of $1,800 per claim. OPM re-competed and awarded a contract to the previously contracted company in December 2018.
GAO's review did not identify any studies that analyzed whether consumers who sign up for or purchase identity theft services were less subject to identity theft or detected financial or other fraud more or less quickly than those who monitored their own accounts for free. A few experts said consumers could sign up for such services if offered for free. Credit monitoring may be convenient for consumers and personalized restoration services may help identity theft victims recover their identities, but such services do not prevent fraud from happening in the first place. The services also do not prevent or directly address risks of nonfinancial harm such as medical identity theft.
Consumer, government, and industry experts highlighted other free options, including a credit freeze, which prevents one type of fraud. A freeze restricts businesses from accessing a person's credit report—and can prevent the illicit opening of a new account or loan in the person's name. A provision of federal law that took effect in September 2018 made it free for consumers to place or lift credit freezes quickly at the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion). Consumers also can regularly monitor their accounts and review their credit reports for free every 12 months. In addition, they can take advantage of free federal assistance such as the guidance on the Federal Trade Commission's IdentityTheft.gov website.
Finally, large amounts of personal information are outside of consumers' control and bad actors can use stolen information for years after a breach. Therefore, experts noted that data security at entities that hold such information—and efforts to make stolen information less useful for identity thieves, through use of new identity verification technologies, for example—are important ways to mitigate risks of harm for consumers.

What GAO Recommends

GAO reiterates a matter for congressional consideration and a recommendation from its 2017 report on identity theft services ( GAO-17-254 ). In that report, GAO found that legislation requiring federal agencies that experience data breaches, including OPM, to offer certain levels of identity theft insurance coverage to affected individuals requires coverage levels that are likely unnecessary. Therefore, Congress should consider permitting agencies to determine the appropriate coverage level for such insurance. GAO also recommended the Office of Management and Budget (OMB) update its guidance for agency responses to data breaches, after analyzing the effectiveness of identity theft services relative to lower-cost alternatives. OMB did not agree or disagree and had not taken action as of early March 2019.


Question:
Why GAO Did This Study

VA's disability compensation program pays cash benefits to veterans with disabilities connected to their military service. In recent years, the number of appeals of VA's benefit decisions has been rising. For decisions made on appeal in fiscal year 2017, veterans waited an average of 3 years for resolution by either VBA or the Board, and 7 years for resolution by the Board. The Veterans Appeals Improvement and Modernization Act of 2017 makes changes to VA's current (legacy) appeals process, giving veterans new options to have their claims further reviewed by VBA or appeal directly to the Board. The Act requires VA to submit to Congress and GAO a plan for implementing a new appeals process, and includes a provision for GAO to assess VA's plan.
This report examines the extent to which VA's plan (1) addresses the required elements in the Act, and (2) reflects sound planning practices identified in prior GAO work. GAO reviewed and assessed VA's appeals plan and related documents against sound planning practices, and solicited VA's views on its assessments.

What GAO Found

The Department of Veterans Affairs' (VA) plan for implementing a new disability appeals process while attending to appeals in the current process addresses most, but not all, elements required by the Veterans Appeals Improvement and Modernization Act of 2017 (Act). VA's appeals plan addresses 17 of 22 required elements, partially addresses 4, and does not address 1. For example, not addressed is the required element to include the resources needed by the Veterans Benefits Administration (VBA) and the Board of Veterans' Appeals (Board) to implement the new appeals process and address legacy appeals under the current process. VA needs this information to certify, as specified under the Act, that it has sufficient resources to implement appeals reform and make timely appeals decisions under the new and legacy processes.
VA's appeals plan reflects certain sound planning practices, but it could benefit from including important details in several key planning areas:
Performance measurement : VA's plan reflects steps taken to track performance, but could articulate a more complete and balanced set of goals and measures for monitoring and assessing performance on a range of dimensions of success. Specifically, the plan reports that VA is developing a process to track timeliness of the new and legacy processes. However, contrary to sound planning practices, the plan does not include timeliness goals for all five appeals options available to veterans, does not include goals or measures for additional aspects of performance (such as accuracy or cost), and does not explain how VA will monitor or assess the new process compared to the legacy process. Unless VA clearly articulates a complete and balanced set of goals and measures, it could inadvertently incentivize staff to focus on certain aspects of appeals performance over others or fail to improve overall service to veterans.
Project management : VA's plan includes a master schedule for implementing the new appeals plan. However, this schedule falls short of other sound practices for guiding implementation and establishing accountability, such as articulating interim goals and needed resources for, and interdependencies among, activities. Unless VA augments its master schedule to include all key activities and reflect sound practices, VA may be unable to provide reasonable assurance that it has the essential program management information needed for this complex and important effort.
Risk assessment : VA has taken steps to assess and mitigate some risks related to appeals reform by, for example, pilot testing two of the five appeals options through its Rapid Appeals Modernization Program (RAMP). However, as designed, RAMP does not include key features of a well-developed and documented pilot test. For example, VA has not articulated how it will assess RAMP before proceeding with full implementation. In addition, RAMP is not pilot testing three options and, as a result, VA will not have data on the extent to which veterans will appeal directly to the Board when given the option. Unless VA identifies and mitigates key risks associated with implementing a new process, VA is taking a chance that untested aspects will not perform as desired.

What GAO Recommends

GAO recommends that VA (1) fully address all legally required elements in its appeals plan, (2) articulate how it will monitor and assess the new appeals process as compared to the legacy process, (3) augment its master schedule for implementation, and (4) address risk more fully. VA agreed with GAO's recommendations and outlined its planned actions to address them.


Question:
Why GAO Did This Study

IRS relies extensively on IT investments to annually collect more than $3 trillion in taxes, distribute more than $400 billion in refunds, and carry out its mission of providing service to America's taxpayers in meeting their tax obligations. For fiscal years 2016 and 2017, the agency reported spending approximately $2.7 billion and $2.6 billion, respectively, for IT investments.
GAO was asked to review IRS's IT operations. GAO's specific objectives were to (1) evaluate the performance of selected IRS IT investments, (2) summarize any risks associated with selected legacy systems and evaluate the steps the agency has taken to manage such risks, and (3) determine the extent to which IRS has implemented key IT workforce planning practices.
GAO analyzed planned versus actual performance information for nine selected investments for fiscal year 2016 and the first 2 quarters of fiscal year 2017—four in development and five in the operations and maintenance phase; identified risks facing three legacy investments and analyzed IRS's efforts to manage these risks against key practices; and analyzed IRS's IT workforce planning efforts against best practices.

What GAO Found

The performance of the Internal Revenue Service's (IRS) selected information technology (IT) investments that GAO reviewed varied. Specifically, the four selected investments in the development phase that GAO reviewed spent less than planned, but most were behind schedule and delivered less scope than planned (see table below). In addition, the five selected investments in the operations and maintenance phase that GAO reviewed had performed internal qualitative assessments of performance as required by the Office of Management and Budget (OMB); however, none of the analyses addressed all key factors specified in OMB guidance.
Three investments GAO reviewed in the operations and maintenance phase that are legacy investments—Individual Master File (IMF), Integrated Data Retrieval System (IDRS), and Mainframes and Servers Services and Support (MSSS)— are facing significant risks due to their reliance on legacy programming languages, outdated hardware, and a shortage of human resources with critical skills. For example, IRS reported that it used assembly language code and Common Business Oriented Language (both developed in the 1950s) for IMF and IDRS, which exposes these investments to a rise in procurement and operating costs, and a decrease in staff available with the proper skill sets. Further, MSSS relies on a significant amount of outdated hardware exposing the investment to rising warranty and maintenance fees, as well as equipment failures. Despite these risks, the agency has not fully implemented key risk management practices and may be challenged in mitigating risks effectively so that they do not impact the agency's ability to carry out its mission.
IRS has not yet fully implemented any of the key IT workforce planning practices GAO has previously identified. Specifically, the agency has developed a tool to automate the IT workforce planning process, but the tool is in the initial stages of implementation. IRS officials attributed the limited progress in implementing IT workforce planning practices to resource constraints and competing priorities. Nevertheless, until the agency fully implements these practices, it will continue to face challenges in assessing and addressing the gaps in knowledge and skills that are critical to the success of its key IT investments.

What GAO Recommends

GAO recommends that IRS perform operational analyses consistent with guidance, implement key risk management practices, and fully implement key IT workforce planning practices. IRS did not agree or disagree with the recommendations, but said it would provide a plan for addressing each recommendation.


Question:
Why GAO Did This Study

TCS programs offer state tax credits to individuals or businesses that donate to scholarship funds for students to attend private elementary and secondary schools. Through these credits, donors may reduce the amount they owe in state taxes by the full or a partial amount of their donation, depending on each program's rules. Designing a TCS program requires that many decisions be made, such as which students will be eligible to receive scholarships and the effect donations will have on donors' state taxes. GAO was asked to review key characteristics of TCS programs.
This report examines (1) state TCS programs' policies regarding student eligibility and scholarship awards, and (2) how donating to a TCS program could affect the amount of state and federal taxes owed by donors.
For both objectives, GAO reviewed publicly-available documents about student eligibility and tax provisions for all 22 programs authorized as of January 2018 and verified the accuracy of the information with state program officials. GAO did not conduct an independent legal review of state laws and regulations. GAO also interviewed federal officials and reviewed relevant federal guidance and policy documents.

What GAO Found

In 2018, there were 22 tax credit scholarship (TCS) programs authorized across 18 states, which provide state tax credits for individual and business donations that fund scholarships for students to attend elementary and secondary private schools (see figure).
To determine the eligibility of students for these scholarships, most TCS programs use household income and have various approaches to determine scholarship award amounts. Income limits vary widely among programs, ranging from approximately $32,000 to $136,500 per year for students from a four-person household in school year 2017-2018. Programs have different requirements for how students can use their scholarships and different methods for calculating scholarship amounts. More than half of the programs (13 of 22) allow students to use their scholarship money for costs like transportation and books in addition to tuition, whereas the remaining programs (9 of 22) require scholarships funds to be used for tuition only. Average scholarship awards in school year 2016-2017 ranged from $500 to $5,468 per student among the 16 programs that published or provided GAO with such information.
The effect of TCS donations on donors' tax liability depends on program characteristics and donors' financial circumstances. Specifically, half of the 22 programs allow eligible donors to claim 100 percent of their donations as state tax credits, meaning that for each dollar donated, state taxes owed are reduced by a dollar, up to any maximum set by the state. The remaining 11 programs allow donors to claim from 50 to 85 percent of their donations as state tax credits. Programs often specify a maximum tax credit that may be claimed each year by a donor, by all donors combined, or both. Individual donors may also reduce their federal tax liabilities through the federal deduction for charitable contributions, depending on their financial circumstances and applicable tax provisions.


Question:
Why GAO Did This Study

According to the Census Bureau, by 2030, about 1 in 5 Americans will be 65 and older. This aging of the population presents challenges and opportunities for policymakers and service providers in helping ensure that the older population's needs—including housing and health services—are met. Federal agencies with programs that provide housing assistance to low-income older households include HUD and USDA. Several HHS programs provide those households with health services.
This report assesses the extent to which the three agencies collaborated to address the housing and health service needs of older adults living in federally assisted housing.
GAO compared agency efforts to leading collaboration practices it has identified (including written agreements; roles and responsibilities; leveraged resources; relevant participants; and defined outcomes) and interviewed HUD, HHS, and USDA officials.

What GAO Found

The Departments of Housing and Urban Development (HUD) and Health and Human Services (HHS) have collaborated on older adult housing and health issues, but these efforts did not fully demonstrate leading practices GAO identified for effective collaboration.
The HUD-HHS efforts demonstrated some leading practices. For example, the agencies have written agreements for data-sharing projects and have leveraged resources to conduct research on older adults.
The Department of Agriculture (USDA) was not included in the efforts although it provides housing assistance to older rural households. GAO identified the inclusion of all relevant participants as a leading practice. According to HUD, the efforts were intended to explore the health of HUD-assisted households. However, by not including USDA in future collaborations, HUD and HHS may miss opportunities to leverage expertise and USDA may not be able to benefit from any resulting insights and improvements.
The HUD-HHS collaborative efforts also did not define common outcomes, another leading practice GAO identified, likely because their collaboration is relatively new. Without common outcomes (for instance, focused on recipient impact or cost savings), the agencies lack measures against which to monitor, evaluate, and report the results of any collaborations.
Future collaborations would benefit from consistent USDA involvement. And by defining common outcomes, the agencies would help inform Congress and stakeholders of results achieved and strategies or areas on which to focus.

What GAO Recommends

GAO is making three recommendations (one each to HUD, HHS, and USDA). They focus on including USDA in collaborations on older adult housing and health services and defining outcomes for the efforts. The three agencies concurred with GAO's recommendations. HUD stated that it had begun examining challenges relating to services for low-income rural older adults.


Question:
Why GAO Did This Study

DOD manages a portfolio of real property assets that as of fiscal year 2016 reportedly included about 568,000 facilities with a combined plant replacement value of about $1 trillion and 27.2 million acres of land. DOD requires the military services and Washington Headquarters Services to collect and maintain information about each of the assets in their inventories to assist the department with management decision making.
In May 2017, the House Armed Services Committee, Subcommittee on Readiness, asked GAO to review DOD's management and use of its real property data. This report evaluates (1) how accurately and completely RPAD reflects DOD's real property assets, (2) DOD's processes to ensure accuracy and completeness in recording and reporting real property data, and (3) DOD's actions to ensure it has addressed risks that may affect the use of real property information for managing its assets. GAO analyzed the RPAD and military services' data for fiscal years 2014-2016; reviewed documentation; conducted site visits; and interviewed DOD officials.

What GAO Found

GAO found that the Department of Defense's (DOD) Real Property Assets Database (RPAD) contained inaccurate data and lacked completeness, although certain data that GAO reviewed had improved their accuracy since fiscal year 2014. RPAD is a department-wide database of real property data annually compiled by the Office of the Secretary of Defense from the inventories of the military services and DOD's Washington Headquarters Services, which manages real property in the National Capital region. DOD uses RPAD to report on DOD's real property to Congress and other federal agencies, such as the Office of Management and Budget and the General Services Administration to assist in managing federal real property.
DOD has weaknesses in its processes for recording and reporting real property data that have led to inaccurate and incomplete information. GAO and others found military services have not consistently recorded real property transactions (i.e., acquisition of, change to, and disposal of a real property asset) and physical inventories of assets. GAO also found that the military services have not corrected identified discrepancies in their data systems, such as missing entries for utilization and facility condition and overdue asset reviews. GAO reviewed records of 120 facilities with identified discrepancies in fiscal year 2015 RPAD data and compared them to the records in the respective data system in 2017 and found that 61 discrepancies remained. The military services had corrected the data in the remaining 59 reviewed facilities in their data systems. DOD's efforts to prepare for an upcoming financial audit have helped identify issues and improve accuracy of some data. However, if DOD does not require the military services to fully monitor recording processes and implement corrective actions to resolve data discrepancies, the department will continue to have incomplete and inaccurate real property data and unreliable RPAD information.
DOD has not addressed three risks that can adversely affect its ability to use its information to manage its real property. Specifically, DOD (1) has unfilled real property positions limiting its capacity to manage its data, (2) lacks a department-wide approach to improving its data quality, and (3) has not identified how it will complete implementation of an effort to improve access to data. These risks exist, in part, because DOD has not developed a strategy that identifies and addresses risks with accompanying time frames and performance metrics. If DOD does not develop a strategy that identifies and addresses risks to data quality and information accessibility, DOD may miss the opportunity to reasonably ensure that the information needed for effective decision making by DOD, Congress, and other federal agencies is available to meet real property accountability and reporting objectives.

What GAO Recommends

GAO is making six recommendations to improve DOD's real property data, including fully monitoring recording processes; developing and implementing corrective actions for identified data discrepancies; and developing a strategy to address risks associated with data quality and information accessibility. DOD concurred or partially concurred with all draft recommendations. In response, GAO agreed to combine two recommendations.


Question:
Why GAO Did This Study

IRS continues to confront the ongoing problems of identity theft (IDT) refund fraud. The agency estimates that at least $1.68 billion was paid in IDT refund fraud in 2016. To help address this issue, consistent with GAO's prior reporting, the Protecting Americans from Tax Hikes Act of 2015 advanced the deadline for employers to file W-2s to SSA to January 31 (about 1 to 2 months earlier than in prior years). This change allows IRS more time to match wage information to tax returns through systemic verification, and identify any discrepancies before issuing refunds.
GAO was asked to assess how well IRS implemented systemic verification. GAO assessed IRS's performance using systemic verification and the extent to which IRS analyzed the effectiveness of the refund hold on this process. GAO analyzed IRS and SSA data and documents, observed SSA's paper W-2 process, and interviewed IRS and SSA officials. GAO compared IRS actions to laws; IRS policies; and standards for internal control, fraud risk management, and program evaluation.

What GAO Found

Beginning in 2017, as required by law, the Internal Revenue Service (IRS) held all refunds for taxpayers claiming the Earned Income Tax Credit (EITC) or Additional Child Tax Credit (ACTC) until February 15. IRS also took actions to verify wage and other information reported on tax returns before issuing refunds, referred to as systemic verification, but several factors limited its success. IRS received over twice as many (over 214 million) Forms W-2, Wage and Tax Statement (W-2) by February 15 compared to the same time in 2016, and reported that W-2 data were responsible for improving fraud detection and reducing taxpayer burden. However, IRS was unable to verify over half of the returns it held until February 15 before issuing the refunds. For example, IRS received W-2s daily but its information technology systems processed them weekly. In response to GAO's review, IRS reported it is planning to assess options for processing W-2s daily. Also, some employers submit W-2s late, but IRS did not track the extent to which late W-2s are associated with fraud or noncompliance. Further, IRS has not assessed options for enforcing late W-2 penalties earlier. Additionally, about 9 percent (about 23 million) of W-2s were filed on paper, which IRS does not begin to receive from the Social Security Administration (SSA) until March. By law, employers who file 250 or more W-2s are required to file W-2s electronically, while those who file fewer than 250 W-2s may opt to file on paper or electronically. In August 2014, GAO suggested that Congress provide the Secretary of the Treasury with the authority to lower the electronic filing requirement from 250 W-2s to 5 to 10. This action could also have the benefit of reducing SSA's W-2 paper processing costs by $9.7 to $11.3 million per year. These issues reduce IRS's access to timely W-2 data, limiting its ability to prevent fraud and reduce noncompliance before issuing refunds.
IRS's preliminary and final analyses of the February 15 refund hold both showed that IRS could have detected significantly more in potential fraud and noncompliance if it held all refunds until late February, when it had more W-2 data available. There are differences between these analyses. For example, the final analysis included more returns and estimated total revenue IRS could protect by extending the refund hold and expanding it to all taxpayers. In that analysis, IRS estimated that it could have protected $100 million in fraud and noncompliance had it held all taxpayer refunds until February 15—$35 million more than it protected by holding refunds with EITC or ACTC. IRS further estimated that moving the refund hold to March 1 for all taxpayers could protect $895 million compared to $533 million if it only held refunds with EITC or ACTC until that date. However, GAO found limitations to IRS's analyses. For example, while IRS has plans to further explore holding refunds longer, it does not have an evaluation plan to assess the effectiveness of the refund hold on systemic verification. Also, IRS did not fully assess the benefits and costs, including taxpayer burden, of the refund hold, nor how its analysis informs its broader fraud risk management or compliance efforts. As a result, IRS does not have sufficient information to inform a decision on potential changes to the refund hold date and those subjected to it. Finally, IRS has not assessed the benefits and costs of expanding systemic verification to use for pre-refund compliance checks in other areas such as income underreporting and employment fraud. Therefore, IRS may be missing opportunities to maximize use of early W-2 data.

What GAO Recommends

GAO recommends IRS collect data to track late W-2 filing penalties and assess options for earlier enforcement; assess the benefits and costs of using existing authority to hold refunds longer, hold all refunds, or both, and expanding systemic verification to other areas; and take actions based on the assessments. IRS listed steps to respond to 5 of 6 recommendations, but said it could not enforce penalties earlier. GAO recognizes the challenges but clarified that assessing other options would provide benefits, as discussed in the report.


Question:
Why GAO Did This Study

VA medical centers spend hundreds of millions of dollars annually on medical supplies and services. In December 2016, VA instituted a major change in how it purchases medical supplies—the MSPV-NG program—to gain effectiveness and efficiencies.
GAO was asked to examine VA's transition to the MSPV-NG program and its use of emergency procurements. This report assesses the extent to which (1) VA's implementation of MSPV-NG was effective in meeting program goals, and (2) VA awards contracts on an emergency basis. GAO analyzed VA's MSPV-NG requirements development and contracting processes, and identified key supply chain practices cited by four leading hospital networks. GAO also reviewed a non-generalizable sample of 18 contracts designated in VA's database as emergency procurements with high dollar values; and met with contracting, logistics, and clinical officials at 6 medical centers, selected based on high dollar contract obligations in fiscal years 2014-2016 and geographic representation.

What GAO Found

The Department of Veterans Affairs (VA) established the Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program to provide an efficient, cost-effective way for its facilities to order supplies, but its initial implementation was flawed, lacked an overarching strategy, stable leadership, and sufficient workforce that could have facilitated medical center buy-in. VA developed requirements for a broad range of MSPV-NG items with limited clinical input. As a result, the program has not met medical centers' needs, and usage remains far below VA's 40 percent target. VA also established cost avoidance as a goal for MSPV-NG, but currently only has a metric in place to measure broader supply chain cost avoidance, not savings specific to MSPV-NG. Also, starting in June 2015, VA planned to award competitive contracts for MSPV-NG items, but instead, 79 percent were added using non-competitive agreements. (See figure.) This was done primarily to meet VA's December 2016 deadline to establish the formulary, the list of items available for purchase through MSPV-NG.
The roll-out of MSPV-NG ran counter to practices of leading hospitals that GAO spoke with, which highlighted key steps, such as prioritizing supply categories and obtaining continuing clinician input to guide decision-making. VA has taken steps to address some deficiencies identified in the first phase of implementation and is considering a new approach for this program. However, until VA addresses the existing shortcomings in the MSPV-NG program, such as the lack of medical center buy-in, it will face challenges in meeting its goals.
Medical centers often rely on emergency procurements to obtain routine goods and services—some of which could be made available at lower cost via MSPV-NG. Sixteen of the 18 contracts in GAO's sample were not competed, which puts the government at risk of paying more. For instance, one medical center procured medical gas on an emergency basis through consecutive non-competitive contracts over a 3-year period. VA policy clearly defines emergency actions; however, inefficiencies in planning, funding, and communication at the medical centers contributed to emergency procurements, resulting in the contracting officers quickly awarding contracts with no competition.

What GAO Recommends

GAO is making 10 recommendations, including that VA expand clinician input in requirements development, calculate MSPV-NG cost avoidance, establish a plan for awarding future competitive contracts, and identify opportunities to strategically procure supplies and services frequently purchased on an emergency basis. VA agreed with GAO's recommendations.


Question:
Why GAO Did This Study

Small and medium-sized manufacturers are an important part of the U.S. economy. In 1988, to enhance the competitiveness, productivity, and technological performance of U.S. manufacturing, NIST established what is now called the MEP program. The program supports manufacturers through services provided by MEP centers. The centers, located in all 50 states and Puerto Rico, are operated by nonfederal organizations. The MEP centers provide assistance, either directly or through third parties, to help improve manufacturing firms' processes and productivity; expand their capacity; and help them adopt new technologies, utilize best management practices, and accelerate company growth. NIST enters into a cooperative agreement with the nonfederal organization that runs each center to provide federal financial assistance conditional upon the center contributing nonfederal matching funds—known as a cost share.
The AICA included a provision for GAO to review the effect of the 2017 cost share adjustment. This report describes (1) the MEP centers' views regarding the extent to which the recent cost share adjustment has helped them serve manufacturers and (2) the extent to which NIST data show impacts of the cost share adjustment on centers' finances and activities. GAO surveyed all 51 MEP centers, analyzed NIST data on the MEP program, and interviewed NIST and MEP center officials.

What GAO Found

Most Manufacturing Extension Partnership (MEP) centers reported that the January 2017 American Innovation and Competitiveness Act (AICA) cost share adjustment has helped them serve manufacturers, especially very small (i.e., less than 20 employees) and rural ones. The AICA adjusted the cost share ratio to remain at 1:1, that is, $1 of nonfederal contributions for each $1 of federal assistance. Before the adjustment, MEP centers' cost share requirement increased over the course of their cooperative agreements from 1:1 to 2:1, requiring centers to obtain a greater proportion of revenue from nonfederal sources. In GAO's survey of all 51 MEP centers, 44 centers cited positive effects of the adjustment on center operations, such as helping to improve center services or better reach underserved manufacturers. Also, 41 centers indicated the adjustment increased their financial stability, which some centers stated has allowed them to focus less on revenue generation and to serve very small and rural manufacturers. However, some MEP center officials observed that the AICA cost share adjustment impact is hard to distinguish from other factors, such as the National Institute of Standards and Technology's (NIST) recompetition of nearly all centers' cooperative agreements between fiscal years 2014 and 2017. The recompetition increased the level of federal financial assistance for most centers and reset many centers' cost share ratio from 2:1 to 1:1 prior to the 2017 adjustment. Still, center officials said that if the cost share requirement reverted to what it was prior to the 2017 adjustment, centers would be less able to serve manufacturers, particularly very small and rural ones.
NIST data show that there have been some changes in MEP centers' finances and activities since the AICA cost share adjustment; however, these changes generally began prior to the adjustment. For example, NIST data on centers' finances show an increase in federal assistance and a decrease in reported nonfederal contributions from fiscal year 2017 to 2018, but these changes generally began around fiscal year 2014, when NIST began the recompetition process. Similarly, NIST data on centers' activities show an overall increase in the numbers of very small and rural manufacturers served from fiscal year 2017 to 2018. While the change in the number of very small manufacturers served began around fiscal year 2014, the number of rural manufacturers served fluctuated from fiscal years 2014 through 2018. Like MEP center officials, NIST officials said the impact of the AICA cost share adjustment is intertwined with the recompetition impacts and, going forward, the AICA adjustment may help sustain recent increases in the number of very small and rural manufacturers served.


Question:
Why GAO Did This Study

The federal government can reduce duplicative efforts and free up resources for mission-critical activities by consolidating mission-support services that multiple agencies need—such as payroll or travel—within a smaller number of providers so they can be shared among agencies. However, migrating to a shared services provider has not consistently increased cost savings, efficiencies, or customer satisfaction, according to OMB and others who have observed these migrations.
GAO was asked to review previous shared services initiatives. This report: (1) identifies the progress and challenges associated with federal shared services initiatives for selected HR and financial management activities and (2) assesses OMB and GSA's actions to address those challenges. GAO analyzed planning and performance documents and interviewed officials from selected customer and provider agencies and from agencies involved with shared services policy and guidance. GAO also interviewed subject-matter experts familiar with shared services. GAO reviewed steps OMB and GSA are taking to identify and address challenges from past migrations to improve shared services performance.

What GAO Found

Efforts to promote greater use of shared services for human resources (HR) and financial management activities resulted in some cost savings and efficiency gains, but challenges impeded more widespread adoption. For example, the Office of Personnel Management estimates that shared services for HR, including payroll resulted in more than $1 billion in government-wide cost-savings and cost avoidance between fiscal years 2002 and 2015. However, challenges include limited oversight, demand uncertainty among providers, and limited choices for customers. To address these challenges, the Office of Management and Budget (OMB) and the General Services Administration (GSA), as the shared services initiative leaders, introduced a new marketplace model in 2018 meant to better meet the needs of customers and service providers by offering more choices for purchasing shared services (see figure). They are also working on plans to create Service Management Offices and Task Order Review Boards to work with agencies to adopt standards for common management activities.
GAO found that OMB and GSA were following some key change management practices such as improving interagency collaboration in their design of the marketplace model. However, implementation weaknesses may limit their success. For example, OMB and GSA do not have a plan to monitor the implementation of NewPay, a 2018 payroll shared services initiative designed to determine how well the new model works. A monitoring plan which includes performance goals and milestones could help OMB and GSA avoid gaps in service or costly delays as agencies transition to the new model for obtaining shared services.

What GAO Recommends

GAO is making four recommendations to OMB including to work with GSA to finalize a plan for monitoring the implementation of NewPay, among other actions. OMB staff did not comment on GAO's recommendations, but noted that OMB may update its shared services policy in the future.


Question:
Why GAO Did This Study

ARPA-E provides funding for research to overcome long-term and high-risk technological barriers in developing energy technologies. Since 2009, ARPA-E has awarded approximately $1.3 billion to universities, public and private companies, and national laboratories to fund energy research projects. Starting in May 2017, DOE began reviewing its financial assistance department-wide, including ARPA-E's, to determine if it met the administration's priorities.
GAO was asked to examine this review process as it pertained to ARPA-E. This report describes (1) how DOE implemented the financial assistance review process; and (2) the perspectives of ARPA-E selectees on the impacts of the review process.
GAO reviewed documents and interviewed officials at ARPA-E and DOE's Office of Management, which coordinated the review. GAO also interviewed a nonprobability sample of 10 of the 68 ARPA-E award selectees whose financial assistance was evaluated under the review. GAO identified selectees to interview based on representation across ARPA-E's recipient types, including universities, private companies, and national laboratories, among other criteria. While the views of selectees GAO interviewed cannot be generalized to all affected ARPA-E selectees, they provide illustrative examples of the effects of DOE's review.

What GAO Found

The Department of Energy (DOE) developed and implemented a new process to review its financial assistance to ensure that all new work funded by the department—including by DOE's Advanced Research Projects Agency-Energy (ARPA-E)—was consistent with the current administration's priorities. The review process covered funding opportunity announcements as well as certain other types of financial assistance. New awards were delayed until the review of the underlying financial assistance opportunity was completed. DOE reviewed and approved ARPA-E's financial assistance on a rolling basis from May through September 2017, and nearly all ARPA-E financial assistance was approved. DOE Office of Management officials met with ARPA-E officials on several occasions to discuss their review of ARPA-E financial assistance. DOE officials GAO interviewed said they wanted to complete the review as quickly as possible to minimize effects on DOE programs. GAO determined that the delay was not reportable under the Impoundment Control Act. The Impoundment Control Act requires the President to notify Congress if an agency wants to withhold the obligation of funds. GAO has separately informed Congress of an impoundment of $91 million in funds that were not allocated to any financial assistance awards, and was not related to DOE's review process.
According to the 10 ARPA-E project selectees GAO interviewed, DOE's financial assistance review process created uncertainty, which led to a variety of project impacts. The impacts most commonly cited by selectees included potentially delayed project timelines, as well as difficulties in staffing their project teams, among other impacts as shown below.
DOE officials GAO interviewed said that they are reviewing DOE financial assistance in fiscal year 2018. DOE officials said that a key benefit of the fiscal year 2017 review process was an opportunity to better identify and coordinate future financial assistance department-wide on crosscutting issues. However, DOE plans to review fiscal year 2018 financial assistance prior to issuing funding opportunity announcements to the public, and thus before any recipients apply or are selected. As a result, DOE officials said, the uncertainty that ARPA-E selectees experienced during the fiscal year 2017 review process should be reduced.

What GAO Recommends

GAO is not making any recommendations. DOE provided technical comments, which GAO incorporated as appropriate.


Question:
Why GAO Did This Study

Americans increasingly rely on mobile wireless communications for safety-related communications like calling 911 and receiving weather alerts. Mobile wireless networks face risks from physical incidents including extreme weather events and intentional and accidental damage. For example, in 2017 several major hurricanes damaged wireless network infrastructure, leaving many U.S. citizens without reliable access to wireless communications.
GAO was asked to review federal efforts to improve the resiliency of wireless networks following natural disasters and other physical incidents. This report examines: (1) trends in mobile wireless outages reported to FCC since 2009 and (2) actions federal agencies and industry have taken since 2013 (after Hurricane Sandy) to improve wireless network resiliency, among other objectives. GAO analyzed wireless outage data from 2009 to 2016 (4 years before and after Hurricane Sandy); reviewed FCC, DHS, and industry documents; and interviewed stakeholders who represented a variety of perspectives, such as industry, public safety, and consumer groups. GAO assessed FCC's efforts to monitor an industry initiative to improve wireless network resiliency against federal internal control standards.

What GAO Found

The number of wireless outages attributed to a physical incident—a natural disaster, accident, or other manmade event, such as vandalism—increased from 2009 to 2016, as reported to the Federal Communications Commission (FCC). During this time, the number of outages substantially increased from 189 to 1,079 outages, with most of the increase occurring from 2009 to 2011. FCC officials said this increase was due in part to growth in wireless customers and wireless infrastructure. Almost all outages attributed to a physical incident were due to an accident, such as damage to a cable due to a digging error (74 percent) or a natural disaster (25 percent). However, outages due to a natural disaster had a longer median duration (ranging from 19 to 36 hours), which was more than twice as long as outages caused by an accident. Power failures and failures in other providers' networks also play a role in wireless outages attributed to physical incidents. For instance, carriers reported that 87 percent of wireless outages attributed to a physical incident were due to a failure in another provider's network on which they rely.
Since 2013, federal agencies and industry have taken actions to improve the resiliency of wireless networks. For example, the Department of Homeland Security (DHS) and FCC charter federal advisory committees that have examined resiliency issues and potential solutions, such as sharing infrastructure during emergencies. FCC also proposed a rule that would disclose how individual wireless carriers' networks performed during emergency events. In response, an industry coalition announced an initiative—the Wireless Network Resiliency Cooperative Framework—whereby carriers agreed to allow roaming on each other's networks and aggregated statistics to be published on how networks performed during emergency events. This initiative prompted FCC to not adopt its proposed rule. FCC said it would engage with industry about the framework's implementation and use, but FCC has limited formal plans to oversee or spread knowledge of the framework:
FCC developed a plan to track the completion of initial implementation tasks outlined in the framework, but this plan does not include steps to track or evaluate any outputs or outcomes from the framework.
FCC and industry documents describe broad goals for the framework, such as advancing information sharing during and after emergency events, but neither FCC nor industry has set any specific measures to help determine whether the framework achieves these broad goals.
Although some public safety officials and other stakeholders GAO contacted were not aware of the framework, FCC did not have plans to actively communicate information about the framework to these audiences.
More robust measures and a better plan to monitor the framework would help FCC collect information on the framework and evaluate its effectiveness. Such steps could help FCC address any challenges or decide whether further action is needed. Also, by promoting awareness about the framework, FCC would help public safety officials and other industry participants to be well positioned to use the framework to help them prepare for or respond to emergency events.

What GAO Recommends

FCC should work with industry to develop specific performance measures for the Wireless Network Resiliency Cooperative Framework, monitor the framework's outcomes, and promote awareness of it. FCC agreed with the recommendations.


Question:
Why GAO Did This Study

Supporting efforts to promote democracy has been a foreign policy priority for the U.S. government. In recent years, USAID and State have allocated about $2 billion per year toward democracy assistance overseas. Congress required USAID and State to each establish guidelines for and report on the use of contracts, grants, and cooperative agreements for certain democracy programs.
GAO was asked to review U.S. democracy assistance. This report (1) examines funding USAID, NED, and State obligated for democracy assistance primarily through contracts, grants, and cooperative agreements and (2) evaluates documentation of USAID award-type decisions, among other objectives.
GAO analyzed USAID, NED, and State democracy assistance award data for fiscal years 2012–2016. GAO also reviewed relevant regulation and agency policies and analyzed documentation for a nongeneralizable sample of USAID awards selected based on factors such as award type, program area, and country.

What GAO Found

In fiscal years 2012–2016, the U.S. Agency for International Development (USAID) obligated $5.5 billion and the National Endowment for Democracy (NED) obligated $610.2 million in democracy assistance funding. The total funding the Department of State (State) obligated for democracy assistance could not be reliably determined. One-third of all USAID obligations were provided through public international organizations (PIOs), which under USAID guidance are composed principally of countries or other organizations designated by USAID; 94 percent of PIO obligations were provided to the World Bank for democracy assistance projects in Afghanistan. The remaining two-thirds of USAID obligations were provided through contracts, grants (excluding PIOs), and cooperative agreements. Of the 10 State bureaus providing democracy assistance, 3 were unable to provide reliable funding data for fiscal years 2012–2016. Data from these bureaus were incomplete, nonstandard, or inaccurate. Federal internal control standards call for agencies to use quality information from reliable sources to achieve intended objectives and to monitor activities. Without such data, State cannot effectively monitor its democracy assistance programming and report reliable data externally.
For the awards GAO sampled, USAID generally did not document decisions about whether to award a contract, grant, or cooperative agreement (known as award-type decisions) in a complete and timely manner. According to applicable USAID guidance, agency officials were required to (1) document the final award-type decision with their written determination, including a rationale based on the requirements of the Federal Grant and Cooperative Agreement Act, and (2) complete this documentation before award solicitation occurs or, for noncompetitive awards, before USAID initiated communications with a potential sole-source awardee. However, USAID provided both complete and timely documentation of the award-type decision for 5 of the 41 awards GAO sampled. For the remaining 36 awards, the documentation was either incomplete, not timely or timeliness was indeterminate, or both (see table). While USAID has taken steps to improve documentation for award-type decisions by updating its guidance and templates, it has not assessed whether these updates have resulted in complete and timely documentation. It is important that USAID document these decisions in advance of solicitation because the selection of an award type may affect requirements for administering the award, including competition and oversight requirements and whether or not profit is permissible.

What GAO Recommends

State should improve the reliability and completeness of its democracy assistance funding data, and USAID should assess whether steps taken are resulting in complete and timely documentation of democracy assistance award-type decisions. State and USAID concurred with GAO's recommendations and described actions planned or under way to address them.


Question:
Why GAO Did This Study

The UI program, which is overseen by DOL and administered by states, paid $30 billion to about 5.7 million individuals in 2017. Under federal law, to be eligible for benefits, individuals are generally required to actively search for work, but the specific work search requirements vary by state. Yet, states found that some benefits were overpaid to UI claimants who were ineligible because they were not meeting work search requirements. GAO was asked to review improper payments due to UI claimants' failure to actively search for work. Building on GAO's prior work ( GAO-18-133R ), this report examines (1) state administrative practices associated with work search overpayments; (2) selected states' approaches to address work search overpayments; and (3) DOL's oversight and support of states' efforts.
GAO analyzed DOL data, including the results of state reviews of a representative random sample of UI payments made from fiscal years 2013 through 2017. GAO also reviewed UI information from six states selected for variation in work search requirements and overpayment rates, interviewed DOL and state officials, and reviewed relevant federal laws, regulations, and guidance.

What GAO Found

GAO's analysis of Department of Labor (DOL) data found that certain state administrative practices, such as reviewing a higher percentage of claimant-reported work search activities and frequent use of formal warnings, were associated with lower estimated work search overpayment rates for the Unemployment Insurance (UI) program. According to DOL data, 22 states were warning claimants after the first discovered occurrence of their failure to meet work search requirements (i.e., issuing formal warnings) rather than reporting that an overpayment was made, while the other states were reporting such cases as overpayments. In 2017, DOL determined that federal law does not permit states to use such policies. GAO's analysis of DOL data shows that in fiscal year 2017, estimated work search overpayments were nearly $1.4 billion (see fig.), but would have been an estimated $1.8 billion (+/-$0.2 billion) greater if states had not issued formal warnings and established overpayments. DOL officials told GAO in July 2017 that the agency would issue a letter to states informing them that federal law does not permit them to warn claimants instead of establishing an overpayment. To date, DOL has not issued the letter. Until DOL provides states with such notification, states may continue to report inconsistent information on overpayments.
State officials GAO interviewed reported using multiple approaches to address work search overpayments, including using their online systems that automate collecting information on claimants' work search activities; conducting audits of claimants work search activities beyond those required; and sending automated messages to claimants regarding their work search requirements. Officials said that their approaches encouraged claimants to conduct a more active work search and prevented work search overpayments in some cases.
DOL monitors states' work search overpayment rate estimates and has helped states address such overpayments, but lacks clear procedures for how states should verify claimants' work search activities. DOL directs states to verify a “sufficient” number of work search activities during their audits but has not provided information on what is considered sufficient. DOL data show that some states did not review claimants' work search activities for a majority of audited cases. DOL officials said that the agency plans to clarify its procedures after issuing a letter about formal warnings. By clarifying these procedures, DOL will have greater assurance that states are complying with verification requirements.

What GAO Recommends

GAO is making four recommendations to DOL, including that it provide states information about its determination that the use of state formal warning policies is no longer permissible and clarify its work search verification requirements. DOL agreed with GAO's recommendations and stated that it would take action to address them.


Question:
Why GAO Did This Study

Accidents at grade crossings are a major source of fatalities in the railroad industry. FRA—the federal agency responsible for providing regulatory oversight of grade-crossing safety—–issued regulations on the use of train horns in 2005. Railroads generally support sounding the horn, whereas, communities often support quiet zones to reduce noise.
Congress included a provision in statute for GAO to examine FRA's train horn regulations, including those on quiet zones. Among other things, this report: (1) describes benefits and costs of quiet zones, and (2) examines how FRA evaluates the effectiveness of its train horn regulations. GAO analyzed FRA's documentation on quiet zones, including FRA's train horn regulations and 2011 and 2013 studies on quiet zone safety; reviewed literature; and interviewed FRA program officials in headquarters, Grade Crossing Managers in FRA's 8 regions, and a nongeneralizable sample of another 32 stakeholders from 6 states, railroads, public authorities, and private industry consulting firms. State and public authorities were selected based on the number of quiet zones, geographic diversity, and FRA's recommendations.

What GAO Found

GAO found that the benefits of quiet zones—–i.e., highway-rail at-grade crossings (grade crossings) where train horns are not sounded—have not been quantified and that the costs to establish quiet zones vary. The Federal Railroad Administration's (FRA) train horn regulations allow public authorities (e.g., cities or towns) the opportunity to establish quiet zones if they install safety measures that reduce risks associated with the absence of the train horn (see fig.). While GAO did not identify any research that has quantified the benefits of quiet zones, most stakeholders GAO interviewed said that these quiet zones provide benefits to communities, such as reducing noise or increasing economic development. According to FRA guidance, the factors that affect the costs to establish quiet zones can vary based on the number of grade crossings and types of safety measures used. Public authorities, which typically incur the costs and receive the benefits of quiet zones, must therefore decide whether the benefits of quiet zones exceed the costs.
To evaluate the effectiveness of its train horn regulations, FRA has analyzed data on grade crossings in quiet zones and is transitioning to a formal process for inspecting quiet zones.
Analyses: FRA's analyses showed grade crossings in quiet zones were generally as safe as they were when train horns were sounded. However, these analyses did not control for changes to grade crossings' characteristics over time—–e.g., train speeds or frequency. Such changes may decrease the analyses' reliability. A revised methodology that accounts for these changes could provide FRA with better information on the long-term effects of the train horn regulations, including the safety of quiet zones.
Inspections: Recognizing the need for additional oversight, FRA has taken steps to formalize its process for inspecting quiet zones. FRA has primarily relied on public authorities to oversee quiet zones and ensure compliance with the train horn regulations, in addition to informal inspections by FRA's Grade Crossing Managers. In September 2017, FRA began conducting formal inspections of quiet zones using Grade Crossing Inspectors. However, FRA has not developed guidance for how inspections are to be conducted, including how frequently inspections are to be performed or what should be examined. Without guidance, FRA cannot ensure that inspections are being conducted consistently across FRA's eight regions.

What GAO Recommends

GAO recommends that FRA: (1) revise its methodology for analyzing the safety of quiet zones, and (2) develop guidance on conducting quiet zone inspections. The Department of Transportation partially concurred with the first recommendation, saying it would consider it, and fully concurred with the second. GAO continues to believe changes to the methodology are needed, as discussed in the report.


Question:
Why GAO Did This Study

More than 4 decades ago, Congress authorized the creation of the SPR to reduce the impact of disruptions in supplies of petroleum products. DOE manages the SPR. As a member of the International Energy Agency, the United States is obligated to maintain reserves equivalent to at least 90 days of the previous year's net imports (imports minus exports). The SPR's storage and related infrastructure is aging, and DOE has plans to modernize these facilities. Since 2015, Congress has mandated crude oil sales. As of March 2018, the SPR held about 665 million barrels of crude oil.
GAO was asked to examine the SPR's ability to meet U.S. energy security needs. This report examines, among other things, the extent to which (1) DOE has identified the optimal size of the SPR, and (2) DOE's plans for modernizing the SPR take into account the effects of congressionally mandated crude oil sales. GAO reviewed DOE's plans and studies, and interviewed agency officials and nine experts selected based on prior work, referrals, and a literature review.

What GAO Found

The Department of Energy (DOE) has not identified the optimal size of the Strategic Petroleum Reserve (SPR). In 2016, DOE completed a long-term strategic review of the SPR after its last comprehensive examination conducted in 2005. The 2016 review examined the benefits of several SPR sizes, but it did not identify an optimal size and its review was limited in several ways. In particular, DOE did not fully consider recent and expected future changes in market conditions, such as the implications of falling net imports, or the role that increased levels of private reserves (reserves held by private companies for their own purposes) may play in responding to supply disruptions. These changes have contributed to SPR and private reserves reaching historically high levels on a net imports basis (see figure). These changes are expected to continue to evolve—according to government projections, the United States will become a net exporter in the late 2020s before again becoming a net importer between 2040 and 2050. GAO has found that agencies should reexamine their programs if conditions change. Without addressing the limitations of its 2016 review and periodically performing reexaminations in the future, DOE cannot be assured that the SPR will be sized appropriately into the future.
DOE has taken steps to take into account congressionally mandated sales of SPR crude oil in its $1.4 billion modernization plans for SPR's infrastructure and facilities. The SPR is projected to hold 405 million barrels of oil by the end of fiscal year 2027. However, DOE's current plans are based on information analyzed prior to recently mandated sales. According to DOE officials, the agency began a study in March 2018 to assess the effects of these sales on the SPR's modernization. However, this study is not examining all options for handling any excess SPR assets that may be created by currently mandated sales or any additional sales that may be mandated in the future, inconsistent with an agency order on real property asset management that calls for identifying excess assets. For example, DOE does not plan to examine the potential to lease unused SPR storage capacity to the private sector because DOE is not currently authorized to enter into such leases, according to agency officials. If authorized, leasing capacity could generate revenues that could help offset the costs of modernization. By not examining a full range of options, DOE risks missing beneficial ways to modernize the SPR while saving taxpayer resources.

What GAO Recommends

GAO is making four recommendations, including that DOE (1) supplement the 2016 review by conducting an additional analysis, (2) ensure that the agency periodically reexamines the size of the SPR, and (3) consider a full range of options for handling potentially excess assets as it conducts its study, among other things. DOE agreed with two, partially agreed with one, and disagreed with another recommendation on refined product reserve studies. GAO maintains that the recommendations are valid.


Question:
Why GAO Did This Study

With the goal of providing safe, decent, affordable housing, HUD provides rental assistance to low-income households through its HCV program, administered locally by approximately 2,200 PHAs around the country. In fiscal year 2016, the HCV program received approximately $20 billion in funding and provided rental assistance to approximately 2.4 million households. Local demand in the program may exceed voucher supply, and individuals may wait years before receiving a voucher. After receiving a voucher, participants have a limited amount of time to secure a rental. Accordingly, PHAs have issued alerts about criminals targeting program participants with fraud schemes, such as by claiming to offer admission to the program for a fee.
This report describes (1) the types of reported fraud schemes against HCV participants, including older adults, PHAs' awareness of such schemes and their frequency, and indicators of such schemes online; and (2) HUD's and PHAs' antifraud regulations, guidance, and information related to fraud risks affecting program participants. GAO reviewed online fraud alerts and consumer complaint data from calendar years 2011 to 2016; conducted a generalizable survey of PHA officials about their awareness of fraud against participants; interviewed agency officials and experts; and conducted online covert tests of 350 rental ads and 26 commercial websites. GAO visited eight PHAs, selected based on size and location, among other factors.
GAO is not making recommendations in this report. HUD had no comments on a draft of this report.

What GAO Found

Public Housing Agencies (PHA) have reported various types of fraud schemes against Housing Choice Voucher (HCV) participants, including older adults, but were aware of limited instances of such schemes. Similarly, GAO identified few potential indicators of these schemes in online covert testing of rental ads and websites. According to GAO's analysis of fraud alerts and complaint data, the type of fraud participants may encounter—such as waiting-list, rental, and side-payment fraud—depends on where they are in the HCV process and whether they are applicants, voucher holders, or landlords, as shown in the figure below. For example, side-payment fraud involves agreements—mutual or compelled—in which the voucher holder pays additional rent or other payments to the landlord for benefits, for example to secure a rental or avoid eviction.
According to GAO's survey of PHAs representing approximately 1.9 million households, PHAs reported few incidents of the various fraud types, although side-payment fraud, a program violation, was noted most frequently. Specifically, GAO estimates that while 41 percent of PHAs were aware of instances of side-payment fraud in the prior year, most reported 2 to 5 incidents in the prior year. In addition, 3 to 10 percent of PHAs were aware of instances of the other types of fraud GAO identified. GAO's online covert testing also found few indicators of potential fraud. For example, some websites requested payment for information about the HCV application process, but none explicitly offered to do something prohibited by program rules, such as placing someone on a waiting list for a fee.
The Department of Housing and Urban Development's (HUD) and PHAs' antifraud regulations, guidance, and information largely focus on efforts to protect the HCV program. For example, PHAs are required by HUD to inform families of program-related fraud and abuse, including the prohibition against side payments. In addition, GAO found that several PHAs voluntarily provide targeted messages to participants about fraud schemes by outside parties. Through industry associations, PHAs have mechanisms through which they share best practices that could include these and other issues.


Question:
Why GAO Did This Study

Puerto Rico, the largest and most populous territory of the United States, is subject to congressional authority, although it has broad authority over matters of internal governance. After it defaulted on over $1.5 billion in public debt since 2015, Congress passed PROMESA to establish federal oversight of fiscal affairs. This debt crisis coincided with DOL finalizing the 2016 Overtime Rule, which was invalidated in federal court and is being appealed. PROMESA included a provision for GAO to assess the rule's impact on Puerto Rico and examine its economic condition.
This report (1) examines the economic conditions in Puerto Rico as of the end of 2016, and (2) assesses the potential effects of applying the 2016 Overtime Rule to Puerto Rico. GAO analyzed 1990-2016 economic data and replicated DOL's impact analysis of the 2016 Overtime Rule using 2015 ACS data, the same year used by DOL in its analysis. GAO also reviewed federal laws, regulations, court documents, agency guidance, and criteria related to the federal overtime rule; facilitated group discussions with employers in Puerto Rico from industries most likely to be impacted by the rule; and interviewed relevant stakeholders and labor groups.

What GAO Found

Unreliable economic and limited labor data make conditions in Puerto Rico difficult to evaluate.
Puerto Rico Planning Board data show that from 2005 to 2016 Puerto Rico's gross domestic product (GDP), a principal economic indicator, decreased by over 9 percent, after adjusting for inflation, and the devastation brought by Hurricane Maria in 2017 has worsened economic conditions. While the overall downward trend is reliable, GAO found that the Planning Board uses outdated methods to calculate GDP, which results in unreliable data from year to year and can make it difficult for policymakers to fully analyze specific economic needs and develop long-range plans. The Bureau of Economic Analysis (BEA), within the U.S. Department of Commerce (Commerce), does not calculate GDP for Puerto Rico, as it does for the other U.S. territories. For 6 years, BEA has provided technical support to the Planning Board to update its methods and Planning Board officials described plans to do so, but its methods remain outdated. A 2016 Congressional Task Force recommended that BEA calculate Puerto Rico's GDP, and BEA considers it a long-term goal; however, BEA has not taken steps to do so.
Further, Puert Rico has limited labor statistics because it is not included in the Current Population Survey (CPS), which is produced by Commerce's Census Bureau (Census) and Department of Labor's (DOL) Bureau of Labor Statistics (BLS). CPS provides detailed information about employment, such as hours of work and earnings. The Puerto Rico Oversight, Management, and Economic Stability Act (PROMESA) suggested that Census conduct a study to determine the feasibility of expanding data collection to include Puerto Rico. Census officials said that they estimated the cost of such a study but have not yet conducted it. Census officials also cited concerns with data collection burdens. However, without CPS data on Puerto Rico, policymakers are limited in estimating the full economic impact of different policy changes. For example, DOL did not have the data needed to include Puerto Rico in its assessment of the economic impact of DOL's 2016 Overtime Rule. Conducting such a study would help policymakers consider the tradeoffs of including Puerto Rico in the CPS.
GAO used a different dataset—American Community Survey (ACS)—to assess the potential effects of applying the 2016 Overtime Rule, which would have increased the salary level threshold from $23,660 to $47,476 at which executive, administrative, and professional workers would not be eligible for overtime pay. GAO estimated that about 47,250 of 1.06 million workers in Puerto Rico would be affected—that is, they would become eligible for overtime pay. In response to a salary level threshold increase, employers from selected industries in Puerto Rico told GAO that they might increase certain workers' salaries, but cut overtime hours for other workers, and adjust the number of staff. An economist and a labor group official said that employers could respond by adjusting the number of staff or their hours, but the impacts to employers may be limited and the workforce could benefit. In 2017, a federal district court invalidated the 2016 Overtime Rule and the overtime salary threshold remains at $23,660, but that decision is currently on appeal.

What GAO Recommends

GAO recommends that BEA include Puerto Rico in its reporting on GDP and that Census and BLS study the feasibility of including Puerto Rico in the CPS. Commerce agreed with our recommendations and DOL did not have any comments on the report.


Question:
Why GAO Did This Study

CRAs such as Equifax assemble information about consumers to produce credit reports and may provide other services, such as identity verification to federal agencies and other organizations. Data breaches at Equifax and other large organizations have highlighted the need to better protect sensitive personal information.
GAO was asked to report on the major breach that occurred at Equifax in 2017. This report (1) summarizes the events regarding the breach and the steps taken by Equifax to assess, respond to, and recover from the incident and (2) describes actions by federal agencies to respond to the breach. To do so, GAO reviewed documents from Equifax and its cybersecurity consultant related to the breach and visited the Equifax data center in Alpharetta, Georgia, to interview officials and observe physical security measures. GAO also reviewed relevant public statements filed by Equifax. Further, GAO analyzed documents from the IRS, SSA, and USPS, which are Equifax's largest federal customers for identity-proofing services, and interviewed federal officials related to their oversight activities and response to the breach.

What GAO Found

In July 2017, Equifax system administrators discovered that attackers had gained unauthorized access via the Internet to the online dispute portal that maintained documents used to resolve consumer disputes (see fig.). The Equifax breach resulted in the attackers accessing personal information of at least 145.5 million individuals. Equifax's investigation of the breach identified four major factors including identification, detection, segmenting of access to databases, and data governance that allowed the attacker to successfully gain access to its network and extract information from databases containing personally identifiable information. Equifax reported that it took steps to mitigate these factors and attempted to identify and notify individuals whose information was accessed. The company's public filings since the breach occurred reiterate that the company took steps to improve security and notify affected individuals.
The Internal Revenue Service (IRS), Social Security Administration (SSA), and U.S. Postal Service (USPS)—three of the major federal customer agencies that use Equifax's identity verification services—conducted assessments of the company's security controls, which identified a number of lower-level technical concerns that Equifax was directed to address. The agencies also made adjustments to their contracts with Equifax, such as modifying notification requirements for future data breaches. In the case of IRS, one of its contracts with Equifax was terminated. The Department of Homeland Security offered assistance in responding to the breach; however, Equifax reportedly declined the assistance because it had already retained professional services from an external cybersecurity consultant. In addition, the Bureau of Consumer Financial Protection and the Federal Trade Commission, which have regulatory and enforcement authority over consumer reporting agencies (CRAs) such as Equifax, initiated an investigation into the breach and Equifax's response in September 2017. The investigation is ongoing.

What GAO Recommends

GAO is not making recommendations in this report. GAO plans to issue separate reports on federal oversight of CRAs and consumer rights regarding the protection of personally identifiable information collected by such entities. A number of federal agencies and Equifax provided technical comments which we incorporated as appropriate.


Question:
Why GAO Did This Study

Over the next 5 years, DOD plans to spend over $65 billion on its space system acquisitions portfolio, including many systems that rely on software for key capabilities. However, software-intensive space systems have had a history of significant schedule delays and billions of dollars in cost growth.
Senate and House reports accompanying the National Defense Authorization Act for Fiscal Year 2017 contained provisions for GAO to review challenges in software-intensive DOD space programs. This report addresses, among other things, (1) the extent to which these programs have involved users; and (2) what software-specific management challenges, if any, programs faced.
To do this work, GAO reviewed four major space defense programs with cost growth or schedule delays caused, in part, by software. GAO reviewed applicable statutes and DOD policies and guidance that identified four characteristics of effective user engagement. GAO reviewed program documentation; and interviewed program officials, contractors, and space systems users. GAO also analyzed program metrics, test and evaluation reports, and external program assessments.

What GAO Found

The four major Department of Defense (DOD) software-intensive space programs that GAO reviewed struggled to effectively engage system users. These programs are the Air Force's Joint Space Operations Center Mission System Increment 2 (JMS), Next Generation Operational Control System (OCX), Space-Based Infrared System (SBIRS); and the Navy's Mobile User Objective System (MUOS). These ongoing programs are estimated to cost billions of dollars, have experienced overruns of up to three times originally estimated cost, and have been in development for periods ranging from 5 to over 20 years. Previous GAO reports, as well as DOD and industry studies, have found that user involvement is critical to the success of any software development effort. For example, GAO previously reported that obtaining frequent feedback is linked to reducing risk, improving customer commitment, and improving technical staff motivation. However, the programs GAO reviewed often did not demonstrate characteristics of effective user engagement that are identified in DOD policy and statute:
Early engagement. OCX involved users early; JMS planned to but, in practice, did not; SBIRS and MUOS did not plan to involve users early.
Continual engagement. JMS, OCX, and SBIRS all planned to continually involve users but, in practice, did not fully do so; MUOS did not plan to do so.
Feedback based on actual working software. OCX and SBIRS provided users opportunities to give such feedback but only years into software development; JMS and MUOS did not provide opportunities for feedback.
Feedback incorporated into subsequent development. JMS, OCX, and SBIRS all planned to incorporate user feedback but, in practice, have not done so throughout development; MUOS did not plan to do so.
As reflected above, actual program efforts to involve users and obtain and incorporate feedback were often unsuccessful. This was due, in part, to the lack of specific guidance on user involvement and feedback. Although DOD policies state that users should be involved and provide feedback on software development projects, they do not provide specific guidance on the timing, frequency, and documentation of such efforts. Without obtaining user feedback and acceptance, programs risk delivering systems that do not meet users' needs. In selected instances, the lack of user involvement has contributed to systems that were later found to be operationally unsuitable.
The programs GAO reviewed also faced software-specific challenges in using commercial software, applying outdated software tools, and having limited knowledge and training in newer software development techniques. For example, programs using commercial software often underestimated the effort required to integrate such software into an overall system. Secondly, selected programs relied on obsolete software tools that they were accustomed to using but which industry had since replaced. Finally, GAO found that two of the reviewed programs lacked knowledge of more modern software development approaches. DOD has acknowledged these challenges and has efforts underway to address each of them.

What GAO Recommends

GAO is making two recommendations that DOD ensure its guidance that addresses software development provides specific, required direction on the timing, frequency, and documentation of user involvement and feedback. DOD concurred with the recommendations.


Question:
Why GAO Did This Study

This testimony summarizes the information contained in GAO's June 2018 report, entitled Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts ( GAO-18-418 ).

What GAO Found

The Internal Revenue Service (IRS) has identified over 100 interactions requiring taxpayer authentication based on potential risks to IRS and individuals. IRS authenticates millions of taxpayers each year via telephone, online, in person, and correspondence to ensure that it is interacting with legitimate taxpayers. IRS's estimated costs to authenticate taxpayers vary by channel.
IRS has made progress on monitoring and improving authentication, including developing an authentication strategy with high-level strategic efforts. However, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. Doing so would help IRS clarify relationships between its authentication efforts and articulate resource needs relative to expected benefits. Further, while IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes. As a result, IRS may not identify current or emerging threats to the tax system.
IRS can further strengthen authentication to stay ahead of fraudsters. While IRS has taken preliminary steps to implement National Institute of Standards and Technology's (NIST) new guidance for secure digital authentication, it does not have clear plans and timelines to fully implement it by June 2018, as required by the Office of Management and Budget. As a result, IRS may not be positioned to address its most vulnerable authentication areas in a timely manner. Further, IRS lacks a comprehensive process to evaluate potential new authentication technologies. Industry representatives, financial institutions, and government officials told GAO that the best authentication approach relies on multiple strategies and sources of information, while giving taxpayers options for actively protecting their identity. Evaluating alternatives for taxpayer authentication will help IRS avoid missing opportunities for improving authentication.


Question:
Why GAO Did This Study

VA provides health care services, including pharmacy services, to approximately 9 million veterans each year. Since 2000, VAMCs have faced recurring challenges in managing their pharmacy inventories, including difficulties with accurately accounting for and updating inventory totals through their pharmacy systems.
GAO was asked to review VA pharmacy inventory management. This report (1) describes approaches selected VAMCs use to manage their pharmacy inventories and (2) assesses the extent to which VA oversees VAMCs' efforts to manage their pharmacy inventories.
To conduct this work, GAO visited a non-generalizable selection of five VAMCs chosen for the complexity of services offered and variation in location. GAO also reviewed VA national policies and local polices for the selected VAMCs and interviewed VA officials at the headquarters, regional, and local levels. GAO assessed VA's oversight of pharmacy management in the context of federal internal control standards.

What GAO Found

Selected Department of Veterans Affairs' (VA) medical centers (VAMC) use generally similar approaches for managing their pharmacy inventories. For example, all VAMCs store certain medications in secured areas. However, GAO found that VAMCs have also taken unique approaches for procuring and tracking medications, as allowed under VA policy. For example, to better address medication shortages, one VAMC pharmacy GAO visited established a shortage committee that meets on a weekly basis. Another VAMC pharmacy uses an automated dispensing machine together with compatible software that allows the pharmacy to track the location of most inpatient medications in real-time (see figure).
GAO also found that VA's oversight of VAMCs' pharmacy inventory management is limited as VA lacks a comprehensive inventory management system or a focal point for system-wide oversight. In May 2018, VA signed a contract for a new electronic health records system that should allow VA to monitor VAMCs' inventories; however, VA officials expect implementation of this system to take up to 10 years. Based on a review of VA policies and interviews with VA officials, GAO found that VA has not designated a focal point with defined responsibilities for system-wide oversight of VAMCs' pharmacy inventory management. This is inconsistent with federal internal control standards for monitoring and establishing structure and authority to achieve an entity's objectives. Without a focal point for system-wide oversight, VA has limited awareness of the unique approaches that VAMCs use to manage their inventories and is missing an opportunity to evaluate these approaches. Additionally, VA cannot effectively share and standardize inventory management best practices as appropriate. Having a focal point is especially important given that VAMCs have historically had challenges in managing their inventories and a comprehensive pharmacy inventory management system may not be available for the foreseeable future.

What GAO Recommends

GAO recommends that VA designate a focal point for overseeing VAMCs' pharmacy inventory management efforts system-wide and define the focal point's responsibilities. VA concurred in principle with the recommendation.


Question:
Why GAO Did This Study

In 2018, FCC estimated that 35 percent of Americans living on tribal lands lack broadband service compared to 8 percent of Americans overall. Broadband service can be delivered through wireless technologies using radio frequency spectrum. According to FCC, increasing tribal access to spectrum would help expand broadband service on tribal lands. GAO was asked to review spectrum use by tribal entities—tribal governments and tribally owned telecommunications providers.
This report examines (1) tribal entities' ability to obtain and access spectrum to provide broadband services and the reported barriers that may exist, and (2) the extent to which FCC promotes and supports tribal efforts to obtain and access spectrum. GAO interviewed 16 tribal entities that were using wireless technologies. Selected entities varied geographically, among other characteristics. GAO analyzed FCC's license and auction data as of September 2018, reviewed FCC's rulemakings on spectrum for broadband services, and interviewed other tribal and industry stakeholders and FCC officials. The information presented is not generalizable to all tribes or industry participants.

What GAO Found

The tribal entities GAO contacted cited various barriers to obtaining spectrum licenses in bands that can be used to provide broadband services. According to its analysis of data from the Federal Communications Commission (FCC), GAO identified 18 tribal entities that held active spectrum licenses in such bands. For example, of these 18 tribal entities, 4 obtained licenses through secondary market transactions—that is, they bought or leased the license from another provider, and 2 obtained a license through an FCC spectrum auction. Licensed spectrum is generally preferred because it offers better quality of service compared to unlicensed spectrum; however, almost all of the tribal entities GAO contacted said that they are accessing unlicensed spectrum to provide Internet service. They identified barriers to obtaining licensed spectrum through auctions and secondary market transactions, barriers such as high costs and, in the case of secondary market transactions, a lack of information on who holds licenses over tribal lands. Because most spectrum allocated for commercial use has already been assigned, the secondary market is one of very few avenues available to tribal entities that would like to access licensed spectrum.
FCC has taken steps to promote and support tribal access to spectrum. For example, FCC issued proposed rulemakings in 2011 and 2018 that sought comment on tribal-specific proposals, such as establishing tribal-licensing priorities and initiating processes to transfer unused spectrum licenses to tribal entities. However, FCC has not finalized these rules and is in the process of responding to comments to the 2018 rulemaking. Also, while FCC has made additional spectrum available for broadband use in recent years, tribal stakeholders cited limitations with the spectrum FCC has made available. For example, FCC allows broadband providers to operate in unused television broadcast bands on an unlicensed basis. While stakeholders GAO interviewed cited some advantages of these bands, such as being useful to reach remote customers, they also noted technical and cost limitations that reduced the potential to improve tribal access to spectrum. FCC stated that it is implementing spectrum initiatives and recognizes the importance of promoting a robust secondary market to improve communications throughout the United States, including tribal lands. However, GAO found that FCC has not collected data related to tribal access to spectrum, analyzed unused licensed spectrum that exists over tribal lands, or made data available to tribal entities in an accessible and easy manner that could be beneficial in their efforts to obtain spectrum licenses from other providers. By collecting data on the extent that tribal entities are obtaining and accessing spectrum, FCC could better understand tribal spectrum issues and use this information as it implements ongoing spectrum initiatives. Further, given that the secondary market is one of few ways for tribal entities to access licensed spectrum to be able to provide Internet service, FCC could promote a more robust secondary market by analyzing unused licensed spectrum over tribal lands and using that information to inform FCC's oversight of the secondary market. Additionally, by making information available on who holds spectrum licenses over tribal lands, FCC could remove a barrier tribes may face in attempting to obtain spectrum through the secondary market.

What GAO Recommends

FCC should (1) collect data on tribal access to spectrum; (2) analyze unused licensed spectrum over tribal lands; and (3) make information available in a more accessible manner that would promote tribes' ability to purchase or lease spectrum licenses over their lands from other providers. FCC agreed with the recommendations.