Question:
Why GAO Did This Study

In 2016, VBA awarded 12 contracts to five private firms for up to $6.8 billion lasting up to 5 years to conduct veterans' disability medical exams. Both VBA contracted medical examiners and medical providers from the Veterans Health Administration perform these exams, with a growing number of exams being completed by contractors. Starting in 2017, VBA contracted examiners conducted about half of all exams. GAO was asked to review the performance and oversight of VBA's disability medical exam contractors.
This report examines (1) what is known about the quality and timeliness of VBA contracted exams; (2) the extent to which VBA monitors contractors' performance; and (3) how VBA ensures that its contractors provide qualified and well-trained examiners. GAO analyzed the most recent reliable data available on the quality and timeliness of exams (January 2017 to February 2018), reviewed VBA and selected contract documents and relevant federal laws and regulations, and interviewed agency officials, exam contractors, an audit firm that checks examiners' licenses, and selected veterans service organizations.

What GAO Found

The Veterans Benefits Administration (VBA) has limited information on whether contractors who conduct disability compensation medical exams are meeting the agency's quality and timeliness targets. VBA contracted examiners have completed a growing number of exams in recent years (see figure). VBA uses completed exam reports to help determine if a veteran should receive disability benefits. VBA reported that the vast majority of contractors' quality scores fell well below VBA's target—92 percent of exam reports with no errors—for the first half of 2017. Since then, VBA has not completed all its quality reviews, but has hired more staff to do them. VBA officials acknowledged that VBA also does not have accurate information on contractor timeliness. VBA officials said the exam management system used until spring 2018 did not always retain the initial exam report completion date, which is used to calculate timeliness. In spring 2018, VBA implemented a new system designed to capture this information.
VBA monitoring has addressed some problems with contractors, such as reassigning exams from contractors that did not have enough examiners to those that did. However, the issues GAO identified with VBA's quality and timeliness information limit VBA's ability to effectively oversee contractors. For example, VBA officials said they were unable to track the timeliness of exam reports sent back to contractors for corrections, which is needed to determine if VBA should reduce payment to a contractor. The new system implemented in spring 2018 tracks more detailed data on exam timeliness. However, VBA has not documented how it will ensure the data are accurate or how it will use the data to track the timeliness and billing of corrected exam reports. VBA also has no plans to use the new system to analyze performance data to identify trends or other program-wide issues. Without such plans, VBA may miss opportunities to improve contractor oversight and the program overall.
A third-party auditor verifies that contracted examiners have valid medical licenses, but VBA does not verify if examiners have completed training nor does it collect information to assess training effectiveness in preparing examiners. While VBA plans to improve monitoring of training, it has not documented plans for tracking or collecting information to assess training. These actions could help ensure that VBA contractors provide veterans with high-quality exams and help VBA determine if additional training is needed.

What GAO Recommends

GAO recommends VBA (1) develop a plan for using its new data system to monitor contractors' quality and timeliness performance, (2) analyze overall program performance, (3) verify that contracted examiners complete required training, and (4) collect information to assess the effectiveness of that training. The Department of Veterans Affairs agreed with GAO's recommendations.


Question:
Why GAO Did This Study

Power plants' electricity output must be matched continuously with demand, which varies depending on the time of day and year. To maintain a reliable supply of electricity, operators of the electricity grid—a complex network of power plants and power lines managed by utility companies and other operators—take steps to ensure power plants are available to generate electricity when needed. Increasingly, renewable sources of energy, such as solar and wind, are being integrated into the grid.
Energy storage allows for electricity to be stored and used later when it is needed and could change the operating capabilities of the electricity grid. Batteries and other energy storage technologies can store energy in one form—such as chemical, mechanical, or thermal energy—and transform that energy to generate electrical power at a later time.
GAO was asked to provide information on the role of energy storage in grid operations. This report describes (1) how energy storage can be used to enhance grid operations and performance; (2) factors that affect the deployment of energy storage for grid operations; and (3) federal and state policies and other efforts that address the deployment of energy storage. GAO reviewed studies published from 2012 through 2017; and interviewed 41 stakeholders, including officials from government agencies and representatives of industry and other groups based on their knowledge of energy storage and grid operations.

What GAO Found

Energy storage can be used in various ways to enhance the reliability, resilience, and efficiency of grid operations, according to studies GAO reviewed and stakeholders GAO interviewed. Such storage can be deployed throughout the electricity system and act as a generation, transmission, distribution, or customer-sited asset to provide various services, address operational challenges and needs, and potentially reduce costs, as shown in the figure below. For example, storage can help grid operators address supply disruptions and the variability of renewable energy resources, such as solar and wind; relieve transmission congestion; defer the need for transmission or distribution system upgrades; and provide backup power during a power outage.
Examples of Potential Storage Applications on the Electricity Grid
Various factors affect energy storage deployment. These include industry and technology readiness, safety concerns and stringency of siting requirements, increasing use of renewable resources, cost-competitiveness of storage and challenges with quantifying the value of storage, and the regulatory environment, according to studies GAO reviewed and stakeholders GAO interviewed. For example, industry and technical challenges include uncertainty about the performance of certain technologies over time and in various operating conditions.
Federal and state policymakers have used various policies and other efforts to encourage the deployment of storage and address market barriers. For example, the Department of Energy has undertaken various efforts, including research and development focused on improving factors that affect the cost and capacity of certain storage technologies. In addition, the Federal Energy Regulatory Commission has issued proposed and final rules to address market barriers to storage deployment in wholesale markets. Lastly, state policies and other efforts that aim to encourage the deployment of storage or to address market barriers include establishing mandates and targets for storage adoption, revising planning requirements, and offering financial incentives and funding.


Question:
Why GAO Did This Study

To help address long-standing financial management system deficiencies, DHS initiated its TRIO project, which has focused on migrating three of its components to a modernized financial management system provided by IBC, an OMB-designated, federal SSP. House Report Number 3128 included a provision for GAO to assess the risks of DHS using IBC in connection with its modernization efforts.
This report examines (1) the extent to which DHS and the TRIO components followed best practices in analyzing alternatives, and the key factors, metrics, and processes used in their choice of a modernized financial management system; (2) the extent to which DHS managed the risks of using IBC for its TRIO project consistent with risk management best practices; and (3) the key factors and challenges that have impacted the TRIO project and DHS's plans for completing remaining key priorities. GAO interviewed key officials, reviewed relevant documents, and determined whether DHS followed best practices identified by GAO as necessary characteristics of a reliable, high-quality AOA process and other risk management best practices.

What GAO Found

The Department of Homeland Security's (DHS) TRIO project represents a key effort to address long-standing financial management system deficiencies. During 2012 and 2013, the TRIO components—U.S. Coast Guard (Coast Guard), Transportation Security Administration (TSA), and Domestic Nuclear Detection Office (DNDO)—each completed an alternatives analysis (AA) to determine a preferred alternative for modernizing its financial management system. GAO found that DNDO's AA substantially met the four characteristics—well-documented, comprehensive, unbiased, and credible—that GAO previously identified for a reliable, high-quality analysis of alternatives (AOA) process. However, Coast Guard's and TSA's AAs did not fully or substantially meet three of these characteristics, and DHS guidance for conducting AAs did not substantially incorporate certain best practices, such as identifying significant risks and mitigation strategies and performing an independent review to help validate the AOA process. Based on these analyses and other factors, the TRIO components determined that migrating to a federal shared service provider (SSP) represented the best alternative, and in 2014, DHS selected the Department of the Interior's Interior Business Center (IBC) as the federal SSP for the project. However, because Coast Guard's and TSA's AAs did not fully or substantially reflect all of the characteristics noted above, they are at increased risk that the alternative selected may not achieve mission needs.
DHS also did not fully follow best practices for managing project risks related to its use of IBC on the TRIO project. Specifically, DHS followed three of seven risk management best practices, such as determining risk sources and categories and establishing a risk management strategy. However, it did not fully follow four best practices for defining risk parameters, identifying risks, developing risk mitigation plans, and implementing these plans largely because its guidance did not sufficiently address these best practices. For example, although DHS created joint teams with IBC and provided additional resources to IBC to help address risk mitigation concerns, it did not always develop sufficiently detailed risk mitigation plans that also included contingency plans for selected critical risks. As a result, although IBC's capacity and experience for migrating large agencies the size of Coast Guard and TSA was identified as a risk in July 2014, a contingency plan working group to address this concern was not established until January 2017. By not fully following risk management best practices, DHS is at increased risk that potential problems may not be identified or properly mitigated.
DHS, IBC, Office of Management and Budget (OMB), and other federal oversight agencies identified various challenges that have impacted the TRIO project and contributed to a 2-year delay in the implementation of Coast Guard's and TSA's modernized solutions. These challenges include the lack of sufficient resources, aggressive schedule, complex requirements, increased costs, and project management and communication concerns. To help address these challenges, DHS and IBC established review teams and have taken other steps to assess potential mitigating steps. In May 2017, DHS determined that migrating the solution from IBC to a DHS data center represented the best option and initiated discovery efforts to further assess this as its path forward for the TRIO project.

What GAO Recommends

GAO recommends that DHS more fully follow best practices for conducting an AOA process and managing risks. DHS concurred with GAO's recommendations and described actions it will take, or has taken, in response.


Question:
Why GAO Did This Study

Growth of voucher and ESA programs has drawn attention to the ways states ensure accountability and transparency to the public and prospective parents. With over half of voucher and ESA programs specifically designed for students with disabilities, there is interest in the information parents receive about special education services and rights when enrolling in a choice program. GAO was asked to examine these topics in more depth.
This report examines (1) academic, administrative, and financial accountability mechanisms in private choice programs; (2) information available to the public and families on private choice programs and participating schools; and (3) how parents of students with disabilities are informed about changes in rights when enrolling in private choice programs. GAO analyzed information from all voucher and ESA programs operating in January 2017 and interviewed officials from Education, national groups, and six of the largest private choice programs. GAO reviewed websites of a nationally representative sample of private voucher schools, and worked with private choice groups and national organizations to contact families that recently interacted with a choice program. GAO interviewed all 17 families that responded.

What GAO Found

States include different academic, administrative, and financial accountability mechanisms in their voucher and education savings account (ESA) programs—programs that use public funds for private school educational expenses (see figure). Of the 27 programs operating in January 2017, most had academic and administrative accountability mechanisms for participating schools, such as academic testing requirements (18 of 27) or health and safety requirements (25 of 27). In addition, 15 of 27 programs required schools to demonstrate financial soundness and 8 of 27 programs required annual financial audits.
Almost all of the 27 private school choice program websites provide a directory of participating schools and some provide guidance on selecting schools. However, GAO estimates that no more than half of all schools participating in any type of voucher program mention students with disabilities anywhere on their websites, according to GAO's review of a nationally generalizable sample of websites of private schools in voucher programs. Further, GAO estimates that no more than 53 percent of private schools in voucher programs designed for students with disabilities provide disability-related information on their websites.
GAO found private school choice programs inconsistently provide information on changes in rights and protections under the Individuals with Disabilities Education Act (IDEA) when parents move a child with a disability from public to private school. In 2001, the U.S. Department of Education (Education) strongly encouraged states and school districts to notify parents of these changes, but according to Education, IDEA does not provide it with statutory authority to require this notification. According to GAO's review of information provided by private school choice programs, and as confirmed by program officials, in school year 2016-17, 83 percent of students enrolled in a program designed specifically for students with disabilities were in a program that provided either no information about changes in IDEA rights or provided information that Education confirmed contained inaccuracies about these changes. Officials from national stakeholder groups, private choice programs, and Education told GAO that some parents do not understand that certain key IDEA rights and protections—such as discipline procedures and least restrictive environment requirements—change when parents move their child from public to private school. Ensuring that quality information is communicated consistently and accurately to parents can help address potential misunderstanding about changes in federal special education rights.

What GAO Recommends

Congress should consider requiring states to notify parents/guardians about changes in federal special education rights when a parent moves a child from public to private school. In addition, GAO recommends Education review and correct inaccurate IDEA-related information provided by states. Education generally agreed with our recommendation.


Question:
Why GAO Did This Study

In 2015, 3.8 million Americans reported misusing prescription drugs within the last month, and deaths from prescription opioids have more than quadrupled since 1999. About half of the people who reported misusing prescription drugs in 2015 received them from a friend or relative.
One way to help prevent this kind of diversion and potential misuse is by providing secure and convenient ways to dispose of unused, unneeded, or expired prescription medications. The Secure and Responsible Drug Disposal Act of 2010 authorizes pharmacies and other entities already authorized by DEA to handle controlled substances to also collect unused prescription drugs for disposal. In 2014, DEA finalized regulations for the implementation of the Act, establishing a voluntary process for eligible entities to become authorized collectors of unused prescription drugs using disposal bins.
GAO was asked to review participation among authorized collectors that maintain disposal bins. In this report GAO describes (1) participation rates among entities eligible to collect unused prescription drugs and (2) factors that affect participation. GAO analyzed the most currently available DEA data from April 2017 on entities eligible to participate and those participating as authorized collectors. GAO also conducted interviews with DEA officials and a nongeneralizable sample of 11 stakeholder organizations selected to illustrate different types of authorized collectors and long-term care facilities. GAO is not making any recommendations. DEA provided technical comments, which GAO incorporated as appropriate.

What GAO Found

GAO found that about 3 percent of pharmacies and other entities eligible to collect unused prescription drugs for disposal have volunteered to do so. The Drug Enforcement Administration (DEA) authorizes these entities to dispose of unused drugs to help reduce their potential misuse. Analysis of DEA data shows that as of April 2017, 2,233 of the 89,550 (2.49 percent) eligible entities—that is, certain entities already authorized by DEA to handle controlled substances—had registered with DEA to use disposal bins to collect unused prescription drugs. Most—about 81 percent—of the authorized collectors were pharmacies, followed by hospitals or clinics. GAO also found that participation rates varied by state, though in 44 states less than 5 percent of the state's pharmacies and other eligible entities had registered to become authorized collectors.
Stakeholders cited several factors that may explain why relatively few pharmacies and other eligible entities have registered with DEA as authorized collectors of unused drugs. Most notably, stakeholders representing authorized collectors told GAO that because participation is voluntary, the cost associated with maintaining a disposal bin—which includes purchasing and installing the bin according to DEA requirements and paying for the destruction of its contents—is an important factor to weigh against potential benefits. DEA noted that availability of disposal by law enforcement agencies also contributes to low participation.


Question:
Why GAO Did This Study

In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise. These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems. In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations.
The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations, and House Report 114-537 includes a provision for GAO to review changes to DOD's nuclear personnel reliability assurance programs. This report addresses the extent to which DOD and the military services have (1) made progress in implementing recommendations to improve the nuclear enterprise and (2) made changes to their personnel reliability assurance programs. GAO reviewed relevant documents and interviewed agency officials from DOD and the military services. This is a public version of a classified report GAO issued in August 2017. It omits information DOD deemed classified.

What GAO Found

The Department of Defense (DOD) has made progress in implementing the recommendations from the 2014 nuclear enterprise reviews and the 2015 nuclear command, control, and communications (NC3) systems report.
In December 2016, the Office of Cost Assessment and Program Evaluation (CAPE) provided the military services with guidance that emphasizes using performance measures and milestones to evaluate progress to aid them in tracking and analyzing their implementation of the recommendations from the 2014 nuclear enterprise reviews. However, CAPE's guidance does not require the military services and other DOD components to identify and document risks as part of its recommendation tracking processes. As a result, DOD does not consistently identify and document risks, and it may not be identifying and communicating potential risks related to the nuclear enterprise. One of the 2014 nuclear enterprise reviews found that the avoidance of managing risks by many leaders within the enterprise adversely affected the mission. Developing additional guidance on identifying and documenting risks could enhance DOD's ability to provide oversight of its efforts to monitor progress and make informed responses to address any identified risks.
For recommendations made in the 2015 NC3 report, DOD's Office of the Chief Information Officer (DOD CIO) uses an internal spreadsheet to track implementation but has not yet identified performance measures, milestones, or risks. DOD CIO has drafted a template that, once it has been approved and implemented, will provide a form that could be used for documenting performance measures, milestones, and risks. By identifying and communicating this information, DOD CIO could improve its efforts to track the progress of DOD's actions, evaluate their effects, and formulate responses to risks.
DOD and the military services have implemented changes to their personnel reliability assurance programs in response to recommendations from the 2014 nuclear enterprise reviews. These programs are intended to ensure that DOD personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are trustworthy, reliable, and capable of performing their assigned nuclear weapons-related mission. The 2014 nuclear enterprise reviews found that these personnel reliability assurance programs were overly complex and administratively burdensome and that frequent and intrusive inspections left nuclear units more focused on preparing for and responding to inspections than on ensuring personnel reliability. DOD and the services have updated their guidance for personnel reliability assurance programs, including focusing on nine essential elements of reliability. For example, the Air Force has incorporated these elements into the standards it uses for its security forces. Additionally, the Air Force has centralized some of its administrative processes, and the Joint Staff has updated inspection procedures in a way that may ease the burden on personnel being inspected.

What GAO Recommends

DOD should develop additional guidance on identifying and documenting risks, and should identify and communicate performance measures and risks. DOD concurred and provided information about planned actions to implement them.


Question:
Why GAO Did This Study

Approximately 300 foreign airports offer last point of departure flights to the United States. TSA is the federal agency with primary responsibility for securing the nation's civil aviation system and assesses foreign airports and inspects air carriers to ensure they have in place effective security measures. While TSA is authorized under U.S. law to conduct foreign airport assessments, it does not have authority to impose or otherwise enforce security requirements at foreign airports. TSA is authorized to impose and enforce requirements on air carriers. The Aviation Security Act of 2016 includes a provision for GAO to review TSA's effort to enhance security at foreign airports.
This report addresses (1) steps TSA has taken to enhance foreign airport assessments and air carrier inspections since 2011, (2) the results of TSA's foreign airport assessments and air carrier inspections, and (3) steps TSA takes to address any deficiencies identified during foreign airport assessments and air carrier inspections. GAO reviewed TSA program data, interviewed TSA officials, and conducted site visits to TSA field locations that manage assessments and inspections.

What GAO Found

The Transportation Security Administration (TSA) has taken steps to enhance its foreign airport assessments and air carrier inspections since 2011, including aligning resources based on risk, resolving airport access issues, making evaluations more comprehensive, and creating operational efficiencies. For example, TSA has implemented targeted foreign airport assessments in locations where risk is high and developed the Global Risk Analysis and Decision Support System to strengthen data analysis. In addition, TSA has increased the number of joint airport assessments with the European Commission. Specifically, TSA officials GAO met with indicated that TSA's strong relationship with the European Commission has afforded the agency excellent access to foreign airports in Europe and a better understanding of vulnerabilities at these locations, which has resulted in more comprehensive assessments.
In its analysis of TSA foreign airport assessment results, GAO found that during fiscal years 2012 through 2016 there was considerable regional variation among last point of departure airports in the level of compliance with select International Civil Aviation Organization security standards and recommended practices. TSA attributed this regional variation to lack of airport resources or technical knowledge, among other factors. TSA officials also stated that while these challenges are not easy to overcome, agency efforts, such as training host country staff, can help foreign airports reduce their vulnerability scores over time. GAO's analysis of TSA's foreign airport assessment data confirmed that point by demonstrating that most foreign airports categorized with poor vulnerability ratings in fiscal year 2012 improved their vulnerability score in at least one follow-up assessment during fiscal years 2012 through 2016.
Meanwhile, U.S. and foreign-flagged air carriers providing last point of departure service to the United States from foreign airports complied with all TSA security requirements in most inspections, and TSA was able to resolve the majority of security deficiencies it identified with on-the-spot counseling. In some cases, TSA inspectors submitted violations for investigation because the violations were considered serious enough to potentially warrant an enforcement action.
TSA addresses identified deficiencies at foreign airports through capacity development, such as training and on-the-spot counseling. However, GAO found that TSA's database for tracking the resolution status of security deficiencies did not have comprehensive data on security deficiencies' root causes and corrective actions. In addition, the database lacked adequate categorization mechanisms. For example, while it captures three broad categories of root causes (e.g., lack of knowledge) it does not capture subcategories (e.g., supervision) that would better explain the root causes of security deficiencies. Fully collecting these data and improving the specificity of categorization would help TSA strengthen analysis and decision making. For example, TSA would be better positioned to determine the extent to which airports that received particular types of capacity development assistance were able to close security vulnerabilities. This is a public version of a sensitive report issued in October 2017. Information that TSA deemed to be sensitive is omitted from this report.

What GAO Recommends

To help strengthen TSA's analysis and decision making, GAO recommends that TSA fully capture and more specifically categorize data on the root causes of security deficiencies that it identifies and corrective actions. TSA concurred with the recommendations.


Question:
Why GAO Did This Study

Congress created several authorities that provide DOD research labs with ways to increase efficiency and foster innovation.
Senate report 114-255 contained a provision for GAO to study governance models used by federal labs. This report evaluates DOD labs' use of authorities to foster innovation and efficiency.
GAO selected four authorities that recent work on best practices for science and technology management and expedited defense lab hiring have shown to be the most crucial for supporting innovation; administered a survey to 44 lab directors to gain insight into their use of the authorities; interviewed key lab officials and contractors; and reviewed relevant policies and guidance.

What GAO Found

Congress has provided the Department of Defense's (DOD) research labs with several authorities to enhance management and operations. Four authorities that GAO examined provide lab directors with greater ability to make their own decisions regarding the funding of projects, hiring, lab management, and purchasing of equipment or services.
1. Laboratory initiated research authority. This authority, as implemented, provides labs with a means to fund new science and technology projects that they consider a priority. Labs may use a percentage of all funds available to the lab and are permitted to charge customers of the lab a percentage fee of the costs for activities performed by the lab for the customer.
2. Direct hire authority. This authority enables labs to compete with private industry for high-quality talent. For example, it provides for streamlined hiring of applicants with relevant advanced degrees, or students enrolled in science, technology, engineering, and mathematics programs.
3. Laboratory enhancement pilot program authority. This authority generally allows lab directors to propose alternative methods that might lead to more effective lab management, and waive certain policies or procedures that might affect implementation of these methods.
4. Micro-purchase authority. This authority raises the threshold for small purchases for DOD research lab activities from $3,500 to $10,000 to facilitate acquisitions.
While labs have used these authorities, their use has sometimes been limited, particularly with the laboratory initiated research authority. DOD lab directors at Air Force, Navy, and Army cited several obstacles that impede wider use of that authority, specifically:
Air Force: Financial management officials at the Air Force stated that the service's accounting system does not currently have an automated capability to transfer the allowable percentage fee of costs to a central account at the Air Force Research Laboratory. This lack of capability, officials noted, creates a significant administrative burden related to charging these fees.
Navy: In fiscal year 2017, Navy labs invested $7.3 million in lab infrastructure projects, compared to $32.9 million and $53.7 million at the Air Force and Army, respectively. Navy lab officials told us that they were restricted in their use of infrastructure funds available under the laboratory initiated research authority due to a lack of clear guidance as to whether and how to use this authority within the Capital Investment Program of the Navy Working Capital Fund.
Army: The Army requires its labs to use a similar percentage of funds from two sources: (1) what it refers to as directly appropriated funds and (2) funds labs charge for customer activities. Some Army lab directors reported assessing a lower rate on customer funds than allowed so as not to drive customers away. The labs then generally charge a lower than desired rate on their directly appropriated funds, which further constrains the total funding available to them.

What GAO Recommends

GAO is making three recommendations to enhance DOD's use of laboratory initiated research authority, including that the Air Force assess potential accounting system improvements, the Navy clarify how labs can use the authority for infrastructure improvements, and the Army assess its policy to determine whether changes are needed to remove disincentives for labs to use the authority. DOD concurred with the recommendations.


Question:
Why GAO Did This Study

In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise. These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems. In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations.
The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations. This report addresses the extent to which DOD and the military services have (1) made progress in the implementation, tracking, and evaluation—including identifying and documenting risk—of the recommendations of the 2014 nuclear enterprise reviews and the 2015 NC3 report and (2) improved oversight of the defense nuclear enterprise and managed roles, responsibilities, and collaboration among various organizations. GAO reviewed relevant documents and interviewed agency officials from DOD and the military services.

What GAO Found

The Department of Defense (DOD) has made progress in implementing the recommendations from the 2014 nuclear enterprise reviews and a 2015 nuclear command, control, and communications (NC3) review and has improved its tracking and evaluation of this progress. For example, since GAO last reported—in October 2017—an additional 74 of the 247 sub-recommendations from the 2014 reviews have been closed; 96 remain open. In January 2018, in response to a GAO recommendation, the Office of Cost Assessment and Program Evaluation (CAPE) issued guidance to aid the military services in identifying, assessing, and documenting risks associated with the 2014 recommendations, such as unintended consequences from their implementation. The guidance calls on them to update their risk assessments periodically as new data become available. The Air Force and Navy have begun to provide risk information in CAPE's and their own tracking tools. In July 2018, in response to a GAO recommendation, DOD's Chief Information Officer issued guidance to improve tracking and evaluation of progress in implementing the 2015 recommendations.
DOD and the military services have taken steps to improve oversight of the nuclear enterprise in response to the 2014 reviews but lack clear roles and responsibilities and methods for collaboration. The Secretary of Defense created the Nuclear Deterrent Enterprise Review Group (NDERG) in 2014 to ensure the long-term health of the nuclear enterprise by addressing resourcing, personnel, organizational, and enterprise policy issues. However, DOD guidance has not clearly defined roles and responsibilities for the NDERG or provided methods for the NDERG to communicate and collaborate with other nuclear oversight organizations, including those shown in the figure. Nor has NC3 oversight guidance been updated to reflect changes in roles and responsibilities and to include methods for communication and collaboration among NC3 oversight groups. In the absence of defined roles and responsibilities for the NDERG and NC3 oversight bodies and methods for how the NDERG and NC3 oversight groups are to communicate and collaborate, senior leaders may not be in a position to effectively manage resourcing and risk across the department.

What GAO Recommends

GAO makes four recommendations for DOD to clarify roles, responsibilities, and methods of communication and collaboration for both the NDERG and NC3 oversight bodies. DOD concurred with all four recommendations and provided information about planned actions to implement them.


Question:
Why GAO Did This Study

Forty railroads are currently required by statute to implement PTC, a communications-based system designed to slow or stop a train that is not being operated safely. Of these, 29 passenger railroads collectively provide over 500 million passenger trips annually. Although the deadline for PTC implementation is December 31, 2018, railroads may receive a maximum 2-year extension to December 31, 2020, if they meet certain statutory criteria.
GAO was asked to review passenger railroads' progress toward PTC implementation. This statement discusses (1) passenger railroads' PTC progress and FRA's steps to assist them, and (2) how passenger railroads and FRA plan to approach the 2018 and 2020 deadlines. GAO analyzed railroads' most recent quarterly reports covering activities through June 30, 2018; sent a brief questionnaire to all 40 railroads; and interviewed officials from FRA and 16 railroads, selected in part based on those identified as at-risk by FRA.

What GAO Found

As of June 30, 2018, passenger railroads (28 commuter railroads and Amtrak) generally remained in the early stages of positive train control (PTC) implementation—including equipment installation and early field testing. However, many passenger railroads are nearing completion of the equipment installation stage. For example, two-thirds of passenger railroads reported being more than 90 percent complete with equipment installation. With regard to testing, Amtrak has reported that it has initiated both field testing and revenue service demonstration (RSD), an advanced form of field testing that is required to fully implement PTC. However, most commuter railroads reported slower progress with testing. Of the 28 commuter railroads required to implement PTC, 19 reported initiating field testing, but only eight reported initiating RSD. The Federal Railroad Administration (FRA) recently clarified the criteria railroads must meet to qualify for a 2-year extension past the December 31, 2018, PTC implementation deadline. To receive an extension, railroads must meet six statutory criteria. For the sixth criterion, commuter railroads are authorized to either initiate RSD on at least one track segment or use FRA-approved substitute criteria. FRA clarified these and other requirements at three PTC symposiums hosted for railroads in summer 2018. For example, FRA officials said that initiating field testing instead of RSD was one approach that commuter railroads could potentially take to receive FRA's approval of substitute criteria. FRA's actions are consistent with GAO's March 2018 recommendation that the agency communicate to railroads the requirements and process for an extension.
Challenges related to PTC implementation and FRA's resources raise questions as to the extent FRA and the passenger railroad industry are poised for full PTC implementation by December 31, 2020. Most passenger railroads anticipate needing an extension, leaving substantial work for both railroads and FRA to complete before the end of 2020. Almost three-quarters of passenger railroads (21 of 29) reported that they, or the railroad which owns the track on which they operate, will apply for an extension. More than half of these railroads reported planning to apply for an extension using substitute criteria, and of these, eight intend to apply for substitute criteria based on field testing. Though use of substitute criteria is authorized in law, this approach defers time-intensive RSD testing into 2019 and beyond. In addition, passenger railroads reported that they continue to face many of the same challenges GAO previously identified, such as software defects and limited industry-wide availability of vendors. Further, passenger railroads expressed concern that FRA's workload will markedly increase as railroads submit requests for extension approvals. FRA has acknowledged concerns about the pending surge of submissions and agency officials said they have taken recent steps to help manage the forthcoming influx of documentation, such as reallocating resources. However, as of September 21, 2018, only one passenger railroad had applied for an extension. It remains unclear how many extension requests FRA will receive or what FRA's enforcement strategy will be for noncompliance with the statute, such as for railroads that fail to apply for an extension by the deadline.

What GAO Recommends

In March 2018, GAO recommended FRA take steps to systematically communicate extension information to railroads and to use a risk-based approach to prioritize agency resources and workload. FRA has taken some steps to address these recommendations, such as recently communicating and clarifying extension requirements to all railroads during three symposiums. GAO will continue to monitor FRA's progress.


Question:
Why GAO Did This Study

Nutrient pollution—caused by excess nitrogen and phosphorus entering water bodies—poses significant risks to the nation's water quality. Nutrients can enter water bodies from point sources and nonpoint sources. The Clean Water Act establishes the basic structure for regulating discharges of pollutants, including excess nutrients. Under the act, authorized states—assisted and overseen by EPA—set limits on nutrients impairing a water body and limits on point source discharges. EPA encourages states to use nutrient credit trading to address nutrient pollution. According to EPA, trading allows a point source to meet nutrient discharge limits by buying pollutant credits from a source that has reduced its discharges more than required.
GAO was asked to examine nutrient credit trading programs. This report describes (1) the extent to which nutrient credit trading programs have been used and what the outcomes of the programs have been, (2) how states and EPA oversee nutrient credit trading programs, and (3) what key factors stakeholders view as affecting participation in nutrient credit trading. GAO reviewed EPA documents and interviewed EPA officials to gather information on trading programs. GAO then selected a nongeneralizable sample of three programs with the most trades in 2014 (based on the most recent available data); reviewed program documents; and interviewed EPA, state, and program officials and other stakeholders about the programs.

What GAO Found

In 2014, 11 states had 19 nutrient credit trading programs, and trading provided flexibility for some point sources, such as wastewater treatment plants, to meet nutrient discharge limits, according to Environmental Protection Agency (EPA) data and officials. The majority of nutrient credit trading during 2014 occurred in three state programs—programs in Connecticut, Pennsylvania, and Virginia. A review of trading data from these programs showed that most point sources participating in the three state programs did not purchase credits in 2014 to meet their discharge limits, which are established in National Pollutant Discharge Elimination System (NPDES) permits under the Clean Water Act. For the point sources that did purchase credits in 2014, state officials in the three states told GAO that the total amount in pounds of nutrients that point sources purchased as credits was generally small. Nevertheless, state officials explained that nutrient credit trading was useful because it allowed point sources to manage risk, reduce the cost of compliance, and better manage the timing of upgrades of nutrient removal technology.
States oversee nutrient credit trading programs, and EPA helps ensure that programs are consistent with the act. States oversee nutrient credit trading programs by approving and verifying the generation of credits to ensure that credits represent real reductions in nutrient pollution. A state's approval and verification process varies depending on whether the credit generator is a point or nonpoint source, such as runoff from agricultural and urban areas. For point sources, the states GAO reviewed followed a process for verifying credits that is based on the existing oversight process for NPDES permits. Because nonpoint sources do not have NPDES permits, states use a separate process to approve and verify that nonpoint sources' pollution reduction activities have generated credits for trading. When questions or concerns arise, EPA uses its oversight authority to ensure that trades and trading programs are fully consistent with the act. EPA officials told GAO that they conduct oversight primarily through the regional offices, which (1) review NPDES permits, (2) review and comment on state regulatory frameworks for trading, (3) conduct periodic on-site inspections, and (4) provide national-level guidance and training to state programs and stakeholders.
According to stakeholders, two key factors have affected participation in nutrient credit trading—the presence of discharge limits for nutrients and the challenges of measuring the results of nonpoint sources' nutrient reduction activities. Officials from the three states GAO reviewed and other stakeholders cited the importance of discharge limits for nutrients as a driver to create demand for trading. Without such a driver, point sources have little incentive to purchase nutrient credits. The challenges of measuring nutrient reductions by nonpoint sources create uncertainties about the value of credits generated by nonpoint sources. In part, because of these uncertainties, the states GAO reviewed either did not allow nonpoint sources to trade or created special rules for nonpoint sources. State officials and stakeholders also told GAO that even if a program allows nonpoint sources to trade, point sources often prefer to trade with other point sources because they have similar permit and monitoring requirements.


Question:
Why GAO Did This Study

Each year, the federal government sells millions of dollars of timber from federal forests. Federal law generally prohibits the export of unprocessed logs harvested from federal lands in the western United States. It also prohibits substitution of federal logs for privately sourced timber in domestic mills when the privately sourced timber is exported without processing.
GAO was asked to examine the issue of illegal federal timber export and substitution. This report (1) describes the extent to which the Forest Service and BLM identified violations of the timber export and substitution ban that occurred from 2007 through 2017 and the likelihood of violations and (2) examines the agencies' regulations, policies, and practices to help prevent, detect, and respond to illegal timber export and substitution.
GAO reviewed laws, regulations, and policies regarding illegal timber export and substitution; compared agency regulations with laws, and agency policies with federal internal control standards; and interviewed agency officials and stakeholders—such as trade groups and state officials— selected to provide a range of perspectives.

What GAO Found

The Forest Service, within the Department of Agriculture, and the Bureau of Land Management (BLM), within the Department of the Interior, found no violations of the ban on federal timber export and substitution from 2007 through 2017, according to agency documents and officials. All agency officials and stakeholders GAO interviewed said the likelihood of illegal timber export and substitution is low, citing several reasons, including economic factors associated with log markets, which have changed over the years. For example, many officials and stakeholders said the timber harvested from federal lands is smaller and of lower quality compared to what was harvested in the 1990s, making it less likely to be exported.
The Forest Service and BLM did not issue new regulations related to illegal federal timber export and substitution, and some agency policies related to export and substitution are outdated or unclear. The agencies did not issue regulations to implement the Forest Resources Conservation and Shortage Relief Act of 1997, as required by the act. Without issuing new regulations or obtaining legislative relief from this requirement, the agencies will continue to be out of compliance with the act. The agencies have policies to help prevent, detect, and respond to illegal timber export and substitution, such as policies that require the marking of logs to identify them as coming from federal lands. However, the agencies have not reviewed their policies for continued relevance and effectiveness as called for by federal standards for internal control, and some policies are outdated or unclear. For example, Forest Service policy calls for the collection of a certification form to help determine whether timber purchasers are engaged in export or substitution, but the form expired in 1999. Also, it is unclear what BLM considers a violation of the export ban because agency policy does not define what constitutes a violation. Forest Service officials said the agency has not reviewed its policies since 1997, largely due to competing priorities, but agreed it would be beneficial to do so. BLM officials said they reviewed the agency's export regulations in 2010, but this effort did not include a review of timber export policies. By reviewing agency policies and making changes as necessary, the agencies will have better assurance that their policies are relevant and effective for addressing the risk of illegal timber export and substitution.

What GAO Recommends

GAO recommends that the Forest Service and BLM issue new regulations or seek legislative relief from the requirement to do so, and review their policies for relevance and effectiveness and issue new policies as necessary. The agencies generally agreed with GAO's recommendations.


Question:
Why GAO Did This Study

A key component of mitigating and responding to cyber threats is having a qualified, well-trained cybersecurity workforce. The Federal Cybersecurity Workforce Assessment Act of 2015 requires OPM and federal agencies to take several actions related to cybersecurity workforce planning.
GAO is to monitor agencies' progress in implementing the act's requirements. For this report, GAO assessed whether: (1) OPM developed a coding structure and procedures for assigning codes to cybersecurity positions and submitted a progress report to Congress; (2) CFO Act agencies submitted complete, reliable baseline assessments of their cybersecurity workforces; and (3) CFO Act agencies established procedures to assign codes to cybersecurity positions. GAO examined OPM's coding procedures and progress report on the act's implementation, and baseline assessments and coding procedures from the 24 CFO Act agencies. GAO also interviewed relevant OPM and agency officials about efforts to address the act's requirements.

What GAO Found

As required by the Federal Cybersecurity Workforce Assessment Act of 2015 (act), the Office of Personnel Management (OPM) developed a cybersecurity coding structure under the National Initiative for Cybersecurity Education (NICE) as well as procedures for assigning codes to federal civilian cybersecurity positions. However, OPM issued the coding structure and procedures 5 and 4 months later than the act's deadlines because OPM was working with the National Institute of Standards and Technology (NIST) to align the structure and procedures with the draft NICE Cybersecurity Workforce Framework , which NIST issued later than planned. OPM also submitted a progress report to Congress on the implementation of the act 1 month after it was due. The delays in issuing the coding structure and procedures have extended the expected time frames for implementing subsequent provisions of the act.
Most of the 24 agencies covered by the Chief Financial Officers (CFO) Act submitted baseline assessment reports to Congress but the results may not be reliable. As of March 2018, 21 of the 24 CFO Act agencies had conducted baseline assessments identifying the extent to which their cybersecurity employees held professional certifications and had submitted the assessment reports to Congress as required by the act. Three agencies had not conducted the assessments for various reasons, such as a lack of resources and tools to do so. Of the 21 agencies that did, 4 did not address all of the reportable information, such as the extent to which personnel without professional certifications were ready to obtain them or strategies for mitigating any gaps. Additionally, agencies were limited in their ability to obtain complete or consistent information about their cybersecurity employees and the certifications they held. This was because agencies had not yet fully identified all members of their cybersecurity workforces or did not have a consistent list of appropriate certifications for cybersecurity positions. As a result, the agencies had limited assurance that their assessment results accurately reflected all relevant employees or the extent to which those employees held appropriate certifications. This diminishes the usefulness of the assessments in determining the certification and training needs of these agencies' cybersecurity employees.
Most of the 24 CFO Act agencies established coding procedures, but 6 agencies only partially addressed certain activities required by OPM in their procedures. Of the 24 agencies reviewed, 23 had established procedures to identify their civilian cybersecurity positions and assign the appropriate employment codes to the positions as called for by the act. However, 6 of the 23 agencies did not address one or more of 7 activities required by OPM in their procedures, such as the activities to review all filled and vacant positions and annotate reviewed position descriptions with the appropriate employment code. These 6 agencies cited a variety of reasons for not addressing all of the required activities in their coding procedures. For example, these agencies stated that they addressed the activities in existing guidance or did not include activities that their components did not have the responsibility to perform. By not addressing all of the required activities in their coding procedures, the 6 agencies lack assurance that the activities will be performed or performed consistently throughout their agency.

What GAO Recommends

GAO is making 30 recommendations to 13 agencies to fully implement two of the act's requirements on baseline assessments and coding procedures. Of the 12 agencies to which we made recommendations that provided comments on the report, 7 agreed with the recommendations made to them, 4 did not state whether they agreed or disagreed, and 1 did not agree with one of two recommendations made to it. GAO continues to believe that the recommendation is valid as discussed in this report.


Question:
Why GAO Did This Study

This testimony summarizes the information contained in GAO's January 2018 report, entitled Intellectual Property: Agencies Can Improve Efforts to Address Risks Posed by Changing Counterfeits Market , ( GAO-18-216 ).

What GAO Found

Changes in the market for counterfeit goods entering the United States pose new challenges for consumers, the private sector, and U.S. agencies that enforce intellectual property rights (IPR). Specifically, growth in e-commerce has contributed to a shift in the sale of counterfeit goods in the United States, with consumers increasingly purchasing goods online and counterfeiters producing a wider variety of goods that may be sold on websites alongside authentic products. For example, 20 of 47 items GAO purchased from third-party sellers on popular consumer websites were counterfeit, according to testing by the products' rights holders (see table), highlighting potential risks to consumers. The changes in the market for counterfeit goods can also pose challenges to the private sector—for example, the challenge of distinguishing counterfeit from authentic goods listed for sale online—and complicate the enforcement efforts of U.S. Customs and Border Protection (CBP) and U.S. Immigration and Customs Enforcement (ICE).
CBP and ICE engage in a number of activities to enhance IPR enforcement; however, while ICE has assessed some of its efforts, CBP has taken limited steps to do so. CBP's and ICE's IPR enforcement activities broadly include detecting imports of potentially IPR-infringing goods, conducting special operations at U.S. ports, engaging with international partners, and undertaking localized pilot programs or port-led initiatives. CBP and ICE have collected some performance data for each of the eight activities GAO reviewed, and ICE has taken some steps to understand the impact of its efforts. However, CBP has conducted limited evaluation of its efforts to enhance IPR enforcement. Consequently, CBP may lack information needed to ensure it is investing its resources in the most efficient and effective activities.
CBP and ICE generally collaborate on IPR enforcement, but according to private sector representatives, restrictions on CBP's information sharing limit private sector enforcement efforts. GAO found that CBP and ICE have undertaken efforts that align with selected key practices for interagency collaboration, such as participating in developing a national IPR enforcement strategy and agreeing on roles and responsibilities. However, sharing additional information about seized items with rights-holding companies and e-commerce websites could improve enforcement, according to private sector representatives. CBP officials said they share information to the extent allowed under current regulations, but CBP has not completed an assessment of what, if any, additional information would be beneficial to share with private sector entities. Without such an assessment, CBP will not know if sharing additional information requires regulatory or legal changes.


Question:
Why GAO Did This Study

IHS is charged with providing health care to AI/AN people who are members or descendants of 573 tribes. According to IHS, AI/AN people born today have a life expectancy that is 5.5 years less than all races in the United States, and they die at higher rates than other Americans from preventable causes. The ability to recruit and retain a stable clinical workforce capable of providing quality and timely care is critical for IHS. GAO was asked to review provider vacancies at IHS.
This report examines (1) IHS provider vacancies and challenges filling them; (2) strategies IHS has used to recruit and retain providers; and (3) strategies IHS has used to mitigate the negative effects of provider vacancies. GAO reviewed IHS human resources data for the provider positions that the agency tracks. GAO also reviewed policies, federal internal control standards, and legal authorities related to providers in federally operated IHS facilities. GAO interviewed IHS officials at the headquarters and area level and at selected facilities. GAO selected facilities based on variation in their number of direct care outpatient visits and inpatient hospital beds in 2014.

What GAO Found

Indian Health Service (IHS) data show sizeable vacancy rates for clinical care providers in the eight IHS geographic areas where the agency provides substantial direct care to American Indian/Alaska Native (AI/AN) people. The overall vacancy rate for providers—physicians, nurses, nurse practitioners, certified registered nurse anesthetists, certified nurse midwives, physician assistants, dentists, and pharmacists—was 25 percent, ranging from 13 to 31 percent across the areas.
IHS officials told GAO that challenges to filling these vacancies include the rural location of many IHS facilities and insufficient housing for providers. Officials said long-standing vacancies have a negative effect on patient access, quality of care, and employee morale.
IHS uses multiple strategies to recruit and retain providers, including offering increased salaries for certain positions, but it still faces challenges matching local market salaries. IHS also offers other financial incentives, and has made some housing available when possible. In addition, IHS uses strategies, such as contracting with temporary providers, to maintain patient access to services and reduce provider burnout. Officials said these temporary providers are more costly than salaried employees and can interrupt patients' continuity of care. However, IHS lacks agency-wide information on the costs and number of temporary providers used at its facilities, which impedes IHS officials' ability to target its resources to address gaps in provider staffing and ensure access to health services across IHS facilities.

What GAO Recommends

GAO recommends that IHS obtain, on an agency-wide basis, information on temporary provider contractors, including their associated cost and number of full-time equivalents, and use this information to inform decisions about resource allocation and provider staffing.
IHS concurred with GAO's recommendation.


Question:
Why GAO Did This Study

DOD continues to confront organizational challenges that hinder collaboration. To address these challenges, section 911 of the NDAA for FY 2017 directed the Secretary of Defense to issue an organizational strategy that identifies critical objectives that span multiple functional boundaries; establish cross-functional teams to support this strategy and provide related guidance and training; and take actions to streamline the Office of the Secretary of Defense. Further, section 921 of the NDAA for FY 2019 calls for the Secretary of Defense to reform the department's enterprise business operations.
The NDAAs for FY 2017 and 2019 also included provisions for GAO to assess DOD's actions in response to sections 911 and 921, respectively. This report assesses the extent to which DOD has made progress in (1) addressing the requirements of section 911, and (2) reforming the department's enterprise business operations under section 921. GAO reviewed documentation on DOD's implementation of sections 911 and 921; interviewed cross-functional team leaders, members, and other DOD officials; and compared DOD's implementation of its cross-functional teams to GAO's key practices.

What GAO Found

The Department of Defense (DOD) has implemented four statutory requirements in section 911 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2017, but has not addressed five requirements intended to support cross-functional teams and promote department-wide collaboration (see table).
For two of these requirements, DOD has missed the statutory deadline by more than a year. GAO previously recommended that DOD take actions to improve its implementation of section 911, and DOD reported it is doing so, such as revising its draft cross-functional team guidance to address statutory requirements. Fully implementing GAO's prior recommendations and the remaining statutory requirements would better position DOD to effectively implement its cross-functional teams and advance a collaborative culture, as required by the NDAA.
Nine cross-functional teams are driving DOD's enterprise business reform efforts under section 921 of the FY 2019 NDAA, but the teams' progress has been uneven. As of September 2018, DOD reported that these nine teams were pursuing a total of 135 business reform initiatives. However, 104 of these initiatives have not reached the implementation phase. A key challenge facing the teams is that some lack resources to fully implement their approved initiatives. For example, DOD officials stated that the department did not fulfill four of nine funding requests from the teams in fiscal year 2018 to implement their initiatives. As of September 2018, DOD officials estimated that the teams need about $6.7 billion to implement their initiatives from FYs 2018 through 2024, but DOD has not identified sources for this funding. GAO's prior work on efficiency initiatives found that up-front investments may be required to realize long-term savings. In addition, GAO's prior work on leading practices for implementing effective cross-functional teams highlights the importance of providing teams with access to resources and having well-defined team operations with established rules and procedures. However, DOD has not established a process for identifying and prioritizing available funding for implementing the teams' initiatives. Without such a process, DOD and the teams may not be able to adequately plan for and execute their reform initiatives.

What GAO Recommends

GAO recommends that DOD establish a process to identify and prioritize funding for implementing its cross-functional teams' business reform initiatives. DOD concurred with this recommendation.


Question:
Why GAO Did This Study

As the demand for VHA's services grows—due, in part, to increasing demand from servicemembers returning from the United States' military operations in Afghanistan and Iraq and the growing needs of an aging veteran population—attracting, hiring, and retaining top talent is critical to VHA's mission to provide high quality and timely care for the nation's veterans.
Physicians—who provide and supervise a broad range of care including primary and specialty care—serve an integral role in VHA's mission. Certain physician types are consistently among the most difficult to recruit and retain, and are thus considered mission-critical by VHA.
Over the past two decades, GAO and others have expressed concern about VHA's ability to ensure that it has the appropriate clinical workforce, including physicians, to meet the current and future needs of veterans.
This statement is based on GAO's October 2017 report and examines (1) VHA information on how many mission critical physicians provided care at VAMCs, (2) VHA guidance for determining its physician staffing needs, and (3) the strategies VHA used to support the recruitment and retention of physicians at VAMCs, and the extent to which it has evaluated these strategies to determine their effectiveness.
For this statement, GAO updated the information from its October 2017 report and obtained information from VHA officials in June 2018 about steps they have taken to implement the 2017 recommendations.

What GAO Found

The Department of Veterans Affairs (VA) Veterans Health Administration (VHA) continues to face challenges related to physician staffing, recruitment, and retention, though it has begun work to implement recommendations made in GAO's October 2017 report. Specifically, GAO's report found the following:
VHA's data on the number of physicians that provided care at VA medical centers (VAMC) were incomplete. GAO found that data were incomplete because they did not include data on the number of contract physicians and contained only limited data on the number of physician trainees—two types of physicians that augment the care provided by physicians employed by VHA. Thus, VHA data underestimated the total number of physicians providing care in its medical centers leaving it unable to ensure that its workforce planning processes sufficiently addressed gaps in staffing. GAO recommended that VHA implement a process to accurately count all its physicians. VHA did not concur with this recommendation, stating that it used other tools for workforce planning. VHA has since implemented a new human resources (HR) database—HR Smart—that has the capability to track each position at its VAMCs. However, VHA officials told us they do not plan to include information on physician contractors in this database.
VHA provided VAMCs with guidance on how to determine the number of physicians and support staff needed for some physician occupations, although it lacked sufficient guidance for its medical and surgical specialties. GAO recommended that VHA issue guidance to VAMCs on determining appropriate staffing levels for all physicians. VHA concurred and reported it would develop staffing guidance for its medical and surgical specialties. VHA officials told GAO VHA signed a specialty care workgroup charter November 27, 2017; the primary goal of the workgroup was to develop a specialty care staffing model that would include staffing information for all specialty care. VHA anticipates completing its work and issuing staffing guidance by December 2018.
VHA used various strategies to recruit and retain its physician workforce, but had not comprehensively evaluated them to assess effectiveness . Without such an evaluation, VHA did not have complete information on the underlying causes of the difficulties VAMCs face, or whether its recruitment and retention strategies were meeting physician workforce needs. GAO recommended VHA (1) establish a system-wide method to share information about physician trainees to help fill vacancies across VAMCs and (2) conduct a comprehensive, system-wide evaluation of VAMCs' physician recruitment and retention efforts and establish an ongoing monitoring program. VHA concurred and reported it has since taken steps to address the recommendations. For example, VHA's Office of Workforce Management and Consulting has partnered with its Partnered Evidence-based Policy Resource Center to evaluate and recommend a systematic approach for allocating workforce management resources. In addition, VHA has added the capability to track physician trainees to its HR Smart database. VHA expects to complete its efforts by September 2018 and September 2019, respectively.


Question:
Why GAO Did This Study

Deficiencies identified in multiple DOL Inspector General audits since 2009 and two student deaths in 2015 have raised concerns regarding the safety and security of Job Corps students. GAO was asked to review safety and security of students in the Job Corps program. GAO's June 2017 testimony summarized preliminary observations. This report further examines (1) the number and types of reported safety and security incidents involving Job Corps students; (2) student perceptions of their safety at Job Corps centers; and (3) the extent to which ETA has taken steps to address safety and security at Job Corps centers.
GAO analyzed ETA's reported incident data for Job Corps centers from July 1, 2016, through June 30, 2017. GAO also analyzed ETA's student survey data from the same period, reviewed relevant documentation, and interviewed ETA officials at its national office and all six regions. GAO also visited two Job Corps centers that had different operators and at least 100 recent incidents. These two centers are not generalizable to all centers.

What GAO Found

Job Corps centers reported 13,673 safety and security incidents involving students from July 2016 to June 2017, according to GAO's analysis of the Department of Labor's (DOL) Employment and Training Administration's (ETA) data. Most reported incidents occurred onsite and involved recently enrolled male students under age 20. During that time, the program served about 79,000 students at 125 Job Corps centers, according to ETA officials. ETA's Office of Job Corps administers the program, which is the nation's largest residential, educational, and career and technical training program for low-income youth generally between the ages of 16 and 24. Drug-related incidents and assaults accounted for 48 percent of all reported incidents (see fig.).
Students generally felt safe at Job Corps centers, yet fewer felt safe in some situations, based on GAO's analysis of ETA's September 2016 and March 2017 Job Corps student satisfaction surveys. At least 70 percent of students reported that they felt safe on half of the 12 safety-related questions in the 49 question survey about their experiences in the Job Corps program; but fewer students reported feeling safe when asked if they were made to feel unimportant or if they heard students threaten each other. ETA plans to administer a new survey nationally by January 2019 that focuses solely on safety and security issues.
ETA has initiated several actions to improve safety and security at Job Corps centers, but insufficient guidance for its monitoring staff and absence of a comprehensive plan for safety and security may put the success of these actions at risk. Among its actions, ETA adopted a new risk-based monitoring strategy to identify emerging problems at the centers. Officials GAO spoke with in five of ETA's regional offices said that the new strategy has improved monitoring, but that more guidance on how to interpret and apply safety and security policies is needed to promote consistency across centers. Also, ETA lacks a comprehensive plan linking its new efforts to an overall safety and security framework. ETA officials told GAO that limited staff capacity and lack of expertise have hindered their efforts in developing such a plan. Without a comprehensive plan, ETA runs the risk that its new efforts will not be successful.

What GAO Recommends

GAO is making three recommendations to DOL, including that ETA develop additional monitoring guidance and a comprehensive plan for safety and security. DOL agreed with GAO's three recommendations.


Question:
Why GAO Did This Study

DHS is the lead agency tasked with protecting the nation's critical infrastructure from cyber threats. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 required DHS to identify, categorize, and assign employment codes to all of the department's cybersecurity workforce positions. These codes define work roles and tasks for cybersecurity specialty areas such as program management and system administration. Further, the act required DHS to identify and report its cybersecurity workforce critical needs.
The act included a provision for GAO to analyze and monitor DHS's implementation of the requirements. GAO's objectives were to assess the extent to which DHS has (1) identified, categorized, and assigned employment codes to its cybersecurity positions and (2) identified its cybersecurity workforce areas of critical need. GAO analyzed DHS and OPM workforce documentation and administered a data collection instrument to six major DHS components. GAO also interviewed relevant DHS and OPM officials.

What GAO Found

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities. Further, DHS has not yet completed its efforts to identify all of the department's cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions. In August 2017, DHS reported to the Congress that it had coded 95 percent of the department's identified cybersecurity positions. However, GAO's analysis determined that the department had, at that time, coded approximately 79 percent of the positions. DHS's 95 percent estimate was overstated primarily because it excluded vacant positions, even though the act required DHS to report these positions.
In addition, although DHS has taken steps to identify its workforce capability gaps, it has not identified or reported to the Congress on its department-wide cybersecurity critical needs that align with specialty areas. The department also has not reported annually its cybersecurity critical needs to the Office of Personnel Management (OPM), as required, and has not developed plans with clearly defined time frames for doing so. (See table).
Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify its critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department's and the nation's federal networks and critical infrastructure from cyber threats. The commitment of DHS's leadership to addressing these matters is essential to helping the department fulfill the act's requirements.

What GAO Recommends

GAO recommends that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed. DHS concurred with our six recommendations and described actions the department plans to take to address them. OPM did not have any comments.


Question:
Why GAO Did This Study

The Navy is planning to dismantle and dispose of CVN 65 after 51 years of service. In 2013, the estimated cost to complete the CVN 65 work as originally planned increased to well over $1 billion, leading the Navy to consider different dismantlement and disposal options.
The Senate Report accompanying a bill for the National Defense Authorization Act for Fiscal Year 2018 included a provision for GAO to review the Navy's plans for CVN 65. This report addresses (1) dismantlement and disposal options under consideration; (2) nuclear regulatory authority considerations; and (3) funding and reporting practices.
GAO reviewed budget, cost, and schedule documentation, as well as applicable laws, regulations, executive orders, policies, and guidance. GAO interviewed officials from the Navy and commercial companies about the dismantlement and disposal options, and NRC and state agencies about regulatory considerations.

What GAO Found

The Navy is assessing two options to dismantle and dispose of its first nuclear-powered aircraft carrier—ex-USS Enterprise (also known as CVN 65). CVN 65 dismantlement and disposal will set precedents for processes and oversight that may inform future aircraft carrier dismantlement decisions.
Characteristics of the Navy's Potential CVN 65 Dismantlement and Disposal Options
Source: GAO analysis of Navy and Nuclear Regulatory Commission information. | GAO-18-523
The Navy could rely on its extensive regulatory experience for the naval shipyard option. However, the Navy's ability to effectively evaluate the full commercial option is hampered by a disagreement with the Nuclear Regulatory Commission (NRC), which oversees the commercial nuclear industry. Naval Reactors officials assert that NRC's regulatory authority should apply to the full commercial option. NRC disagrees with this position. Coordination between the two agencies to identify the applicable regulatory authority and craft a regulatory plan would help ensure accountability, solidify cost estimates, and facilitate a CVN 65 decision.
The budget documentation and reporting that the Navy typically uses for ship dismantlement and disposal projects will not enable adequate oversight of CVN 65—a multi-year project with a cost that may exceed $1 billion. The documents that support Navy budget requests for dismantlement and disposal funding do not provide data that decision makers can readily use to track dismantlement costs against an established baseline or to evaluate funding plans for future years. Further, the Navy has no reporting requirements to support accountability for CVN 65 activities. Large defense acquisition programs generally are required to submit more detailed budget information and report on cost, schedule, and performance. These practices could be adapted for CVN 65 to provide information that will facilitate oversight commensurate with the scale of the effort.

What GAO Recommends

Congress should consider requiring Naval Reactors to coordinate with NRC to identify the applicable regulatory authority for a CVN 65 commercial dismantlement and disposal. GAO is also making four recommendations, including that the Navy take action to provide additional budget information and reporting to facilitate improved transparency and accountability for the CVN 65 cost, schedule, and risks. The Department of Defense agreed with all four recommendations.


Question:
Why GAO Did This Study

Since 2005, the federal government has enacted various statutes aimed at accelerating the environmental review process for highway and transit projects. In addition, the Clean Water Act and the Endangered Species Act may require three federal agencies—the Corps, FWS, and NMFS—to issue permits or perform consultations before a project can proceed.
GAO is required by statute to assess the extent to which statutory provisions have accelerated and improved environmental permitting and consulting processes for highway and transit projects. This report examines, among other things: 1) the impact of streamlining provisions on consulting and permitting time frames, and (2) additional actions used by federal resource agencies to streamline their reviews. GAO analyzed permitting and consulting data from the 3 federal agencies and interviewed officials from the 3 agencies, 16 agency field offices, and 7 state DOTs for their perspectives on the effect of streamlining provisions and other efforts. GAO selected these offices to include a range of locations and those with a greater number of permits and consultations, among other factors.

What GAO Found

Federally funded highway and transit projects must be analyzed for their potential environmental effects, as required by the National Environmental Policy Act, and may be subject to other environmental protection laws, including the Clean Water Act and the Endangered Species Act. These laws may require the U.S. Army Corps of Engineers (Corps) to issue permit decisions and the U.S. Fish and Wildlife Service (FWS) and the National Marine Fisheries Service (NMFS) to conduct consultations before a project can proceed. These three agencies are referred to as “resource agencies” for this report. The three most recent transportation reauthorization acts include provisions that are intended to streamline various aspects of the environmental review process; 18 of these provisions could potentially affect time frames for the environmental permitting and consulting processes for highway and transit projects.
While officials GAO interviewed at resource agencies and state departments of transportation (state DOT) noted that some actions called for by the 18 statutory provisions have helped streamline the consultation and permitting processes for highway and transit projects, GAO found that a lack of reliable agency data regarding permitting and consulting time frames hinders a quantitative analysis of the provisions' impact. Officials said, for example, that a provision that allows federal liaison positions at resource agencies to focus solely on processing applications for state DOT projects has helped avoid delays in permit and consultation reviews. However, none of the three resource agencies could provide enough reliable data to analyze changes in the durations of consultations and permit reviews over time for any of the provisions. Further, GAO identified limitations, such as negative or missing values, and inconsistent data entry practices for FWS and NMFS data. FWS and NMFS have limited controls, such as electronic safeguards and other data-entry procedures, to ensure the accuracy and reliability of their data on the duration of consultations. Left unaddressed, these data quality issues may impair the agencies' ability to accurately determine whether they are meeting their 135-day statutory and regulatory deadlines to complete consultations and provide biological opinions, and could affect their ability to provide accurate data on time frames for efforts of the Office of Management and Budget to track agencies' performance in conducting environmental reviews. While FWS and NMFS officials stated that the agencies plan to improve their tracking systems, the agencies do not have documented plans or time frames for the improvements and it is unclear whether the efforts will include internal controls to improve data reliability.
Some federal resource agency and state DOT officials GAO interviewed identified additional actions that have been used to streamline the consultation and permitting processes to avoid delays in agency reviews. For example, 16 of the 23 resource agency and state DOT officials said that field office staff provided training to state DOT staff about the information field offices required for permit or consultation applications. Resource agency and state DOT officials also identified electronic systems with environmental data and for submitting documents as streamlining actions that have been helpful.

What GAO Recommends

GAO is making two recommendations, one to FWS and one to NMFS, to develop plans and time frames for improving their tracking systems and to develop internal controls to improve data reliability.
The Departments of Commerce and Interior concurred with our recommendations.


Question:
Why GAO Did This Study

Fraud poses a significant risk to the integrity of federal programs and erodes public trust in government. Implementing effective fraud risk management processes can help ensure that federal programs fulfill their intended purpose, spend their funding effectively, and safeguard assets.
FRDAA requires agencies to establish internal controls to manage their fraud risks and to report implementation progress for the first 3 years after enactment. It also directs OMB to (1) develop guidelines for agencies to establish fraud risk management controls and (2) establish a working group to share best practices in fraud risk management and data analytics.
GAO was asked to review agencies' and OMB's efforts to implement FRDAA. This report examines steps (1) agencies and (2) OMB have taken to implement FRDAA. GAO conducted a survey of the 72 agencies subject to the act, held a roundtable discussion with 14 selected agencies, reviewed 24 selected annual financial reports, examined OMB guidelines, and interviewed OMB staff.

What GAO Found

At varying stages, agencies have begun planning for and implementing fraud risk activities (like conducting an evaluation of fraud risks) required by the Fraud Reduction and Data Analytics Act of 2015 (FRDAA), according to GAO's survey of agencies subject to the act. Overall, most of the 72 surveyed agencies (85 percent) indicated that they have started planning how they will meet FRDAA requirements, and about 78 percent indicated that they have also started taking steps to implement the requirements.
To assist agencies in implementing fraud risk management activities, the Office of Management and Budget (OMB) established FRDAA-related guidelines and a working group, as required by the act. However, agencies experienced challenges with OMB's guidelines and the working group, among other things, according to GAO's survey and roundtable discussion results (see figure below).
Implementation guidelines. To meet FRDAA requirements, OMB updated Circular No. A-123 guidelines that govern executive agencies. However, this update included limited information on the methodologies agencies can use to assess, document, and report on internal controls required by FRDAA, according to GAO's review of the guidelines. Surveyed agencies had mixed perspectives on the usefulness of OMB's guidelines for implementing FRDAA controls. Similarly, agencies identified the lack of clear requirements and guidance as top challenges in GAO's roundtable discussion with 14 selected agencies.
Reporting on implementation progress. Although not required by FRDAA, OMB updated annual financial report guidelines to include FRDAA requirements, but GAO found that the guidelines did not contain enough information to aid agencies in producing complete and detailed progress reports in 2017, the first year of reporting. Additional guidelines from OMB could help agencies produce more complete and detailed reports for 2019, the final year of required reporting. Without a longer reporting period, however, Congress may not have the useful information for continued oversight of agencies' progress.
Working Group. OMB has taken steps to establish the working group, but GAO found the working group did not fully meet FRDAA requirements. As Chair, OMB did not (1) involve all agencies subject to the act in the working group or (2) hold the required number of meetings in 2017. Most surveyed agencies indicated a lack of involvement with and information from the working group as challenges in implementing FRDAA.

What GAO Recommends

GAO is making three recommendations, including that OMB (1) enhance its guidelines for establishing controls, (2) enhance guidelines for reporting on agencies' progress, and (3) fully implement the working group. OMB did not concur with the need for the recommendations. GAO continues to believe the recommendations are valid, as discussed in the report. Additionally, Congress should consider extending agencies' reporting requirements.


Question:
Why GAO Did This Study

In 2010, the Patient Protection and Affordable Care Act (PPACA) authorized the establishment of PCORI to carry out CER and improve its quality and relevance. PPACA also established new requirements for HHS to, among other things, disseminate findings from federally funded CER, including findings published by PCORI; and coordinate with relevant federal health programs to build data capacity for this research. To fund CER activities, PPACA established the Trust Fund from which PCORI and HHS are expected to receive an estimated $4.0 billion from fiscal years 2010 through 2019.
PPACA included a provision for GAO to review PCORI's and HHS's use of the Trust Fund. This report examines (1) PCORI's use of the Trust Fund for CER activities, including the dissemination and use of research findings; and (2) HHS's use of the Trust Fund for these activities.
GAO examined PCORI and HHS documents and data related to use of the Trust Fund, such as commitment, obligation, and expenditure data; PCORI's audited financial statements; and descriptions of CER activities. GAO also interviewed PCORI and HHS officials responsible for planning and carrying out CER activities and interviewed officials from stakeholder organizations representing potential users of CER, including public and private payer organizations, provider organizations, and patient organizations. PCORI and HHS provided technical comments, which GAO incorporated as appropriate.

What GAO Found

The Patient-Centered Outcomes Research Institute (PCORI) made about $2 billion in commitments for awards in fiscal years 2010 through 2017. PCORI is a federally funded, nonprofit corporation established to carry out and improve comparative clinical effectiveness research (CER), which evaluates and compares the health outcomes and the clinical effectiveness, risks, and benefits of two or more medical treatments, services, or items. PCORI provides funding through award commitments from the Patient Centered Outcomes Research Trust Fund (Trust Fund) and may pay these awards over multiple years. Of the $2 billion PCORI committed as of the end of fiscal year 2017, about $1.6 billion (or 79 percent of its commitments) is for research awards, and $325 million (or 16 percent) is for building the capacity to use existing health data for research. Through fiscal year 2017, commitments for dissemination and implementation awards—intended to share CER findings with potential users of this research—were limited because most PCORI-funded research was still underway. PCORI projects to commit an additional $721 million for awards in fiscal years 2018 through 2021. In addition to awards, PCORI spent $310 million on program and administrative support services in fiscal years 2010 through 2017 and projects to spend an additional $206 million for these services through fiscal year 2024.
From fiscal years 2011 through 2017, the Department of Health and Human Services (HHS) obligated about $448 million from the Trust Fund. Of this amount, HHS obligated about $260 million (or 58 percent of all obligations) to the dissemination and implementation of CER findings. As most PCORI-funded CER had not yet been completed due to the time needed to conduct this research, HHS efforts focused instead on the dissemination and implementation of CER funded by other federal entities. Additionally, HHS obligated funds for efforts to train researchers on conducting CER, build data capacity, and on administrative activities. HHS projects to obligate an additional $120 million for these activities in fiscal years 2018 through 2020.


Question:
Why GAO Did This Study

DOD must be able to rapidly deploy forces to respond to a range of worldwide contingencies, and in 2007 it established the GRF to enhance that capability. The GRF is a set, or “menu,” of forces from the military services, each of which possesses unique capabilities, and which the Secretary of Defense can deploy rapidly anywhere in the world.
House Report 114-537, accompanying a bill for the National Defense Authorization Act for Fiscal Year 2017, included a provision for GAO to evaluate challenges DOD may be facing regarding the GRF. GAO reviewed the extent to which (1) DOD has used the GRF, and assessed any risks associated with its use of the GRF; and (2) GRF-assigned units are trained to meet GRF missions individually and as a joint force. GAO reviewed GRF deployment information from 2010 to 2017 and the GRF Execute Order, observed a training exercise, and interviewed knowledgeable officials.

What GAO Found

The Department of Defense's (DOD) Global Response Force (GRF) has two distinct uses: one is to enhance DOD's ability to rapidly deploy forces in response to a range of worldwide contingencies with a tailorable joint force; and the other is to provide a set, or “menu,” of units that combatant commands can request to augment their capabilities in light of unexpected challenges when requirements exceed their capabilities. Since 2010, according to officials, DOD has used the GRF 35 times in support of worldwide contingencies, with 32 of those times involving deployment of individual GRF units to augment combatant commander needs, and 3 times involving their use as part of a joint task force. This predominant use of individual GRF units to augment combatant commanders' needs has diminished the set of units available for mission scenarios related to the GRF's use as a tailorable joint force. For example, when DOD deployed a ballistic missile defense unit as a part of the GRF to augment a combatant command's missile defense capabilities, the particular capability it supplied to the GRF was not available for participation in a tailorable joint force to respond quickly to a potential worldwide contingency, if such an event occurred. DOD does not know what risks it assumes to readiness for GRF mission scenarios due to its general reliance upon the GRF as an augmentation capability available to individual geographic combatant commands, because DOD has not assessed those risks. Without conducting a risk assessment and taking steps to address any identified risk to accomplishing the GRF's intended uses, DOD's attempt to satisfy one of the uses (that is, individual GRF-assigned units assisting combatant commands) may hamper the other use (that is, deployment of a joint task force for a contingency).
GRF units train individually to meet GRF missions, but DOD does not conduct any GRF-specific joint training exercises, and the individual GRF units have limited opportunities to train as part of an integrated joint force, according to DOD officials. While the GRF Execute Order calls for integrating elements of the GRF into existing joint training, the military services lack the authority to direct other services to supply forces for joint training exercises, even when those forces are currently on a GRF rotation. Moreover, since the disestablishment in 2011 of U.S. Joint Forces Command—which, among other things, was the lead agent for joint force training—and because units designated for the GRF mission may be assigned to different combatant commands or may be service-retained, no single commander has the authority to require joint force training of GRF units. As a result, no joint training exercises are specifically designed to exercise GRF units as a joint task force. Army officials told GAO that joint exercises are important because they give individual units from different services the opportunity to identify challenges and develop solutions, thereby enhancing the GRF's joint task force capability. Without an entity having the responsibility and authority to plan, direct, and conduct joint training exercises focused on GRF-assigned units deploying as a joint task force as appropriate, DOD risks undermining the effectiveness of the rapid deployment of a GRF joint task force in response to unforeseen worldwide contingencies.

What GAO Recommends

GAO recommends that DOD (1) assess the risks assumed in its reliance upon the GRF as both an augmentation capability and a tailorable joint force; (2) design appropriate responses following the risk assessment; and (3) designate an authority to establish and enforce integrated joint training as appropriate for GRF-assigned units. DOD concurred with GAO's three recommendations.