Question:
Why GAO Did This Study

FTA's Capital Investment Grants program is the primary source of federal financial assistance to support transit projects that are locally planned, implemented, and operated. FTA evaluates and rates projects seeking funding through this program according to statutory criteria and recommends to Congress which projects to fund. The funding that project sponsors receive is subject to congressional appropriation.
MAP-21 includes a provision for GAO to biennially review FTA's implementation of the Capital Investment Grants program. This report discusses: (1) FTA's progress in addressing statutory provisions contained in MAP-21 and the FAST Act and (2) how the evaluation and rating process FTA has established for Core Capacity Improvement projects enables FTA to verify that statutory requirements are met before recommending such projects for funding. GAO reviewed the relevant laws and FTA's guidance. GAO also interviewed FTA officials and six project sponsors, representing seven of the eight Core Capacity Improvement projects in the Capital Investment Grants program at the time of GAO's review.

What GAO Found

The Federal Transit Administration (FTA) has not addressed three statutory provisions concerning the Capital Investment Grants program contained in the Moving Ahead for Progress in the 21st Century Act (MAP-21) and the Fixing America's Surface Transportation Act (FAST Act). Specifically, FTA has not:
issued regulations regarding the evaluation and rating process for Core Capacity Improvement projects, which are a category of eligible projects within the program;
established a program of interrelated projects designed to allow for the simultaneous development of more than one transit project within the Capital Investment Grants program; or
implemented a pilot program designed to create a fast-track approval process for transit projects that meet specific statutory criteria.
Throughout this review, FTA officials told GAO they do not have immediate plans to address these three statutory provisions. Officials cited a proposal by the President to phase out the Capital Investment Grants program as one of the factors influencing this decision. However, in March the Consolidated Appropriations Act, 2018, provided the program with more than $2.6 billion and required FTA to continue to administer the program in accordance with the procedural and substantive requirements specified in statute. Subsequently, FTA officials told GAO that they are reviewing the Act and determining next steps. However FTA officials did not indicate that they intend to address these provisions. If FTA does not implement the outstanding provisions, FTA and project sponsors—that is, local transit agencies—may be missing opportunities to deliver transit projects more efficiently.
Based on a review of FTA's policy guidance, on FTA's instructions for applying to the Capital Investment Grants program, and on other documentation supporting the two Core Capacity Improvement projects that FTA has recommended for funding as of June 2017, GAO found that FTA has established a process to verify that proposed Core Capacity Improvement projects meet statutory requirements before recommending projects for funding. Core Capacity Improvement projects are capital investments designed to increase the capacity of an existing transit system and must meet specific statutory requirements to be eligible for funding through the program. GAO found that prior to recommending a project for funding FTA works with project sponsors to verify that their proposed project includes elements that will increase transit system capacity versus maintaining the current system, that the required amount of local funding is committed to the project, and that sponsors have the technical and financial capacity to complete the project they are proposing, among other statutory requirements.

What GAO Recommends

FTA should initiate a rulemaking regarding the evaluation and rating process for Core Capacity Improvement projects and take steps to address two other statutory provisions. FTA agreed with the recommendations but disagreed with certain findings on which they are based. GAO believes these findings are valid, as discussed in this report.


Question:
Why GAO Did This Study

The 2018 National Defense Strategy emphasizes that restoring and retaining readiness is critical to success in the emerging security environment. The Navy and Marine Corps are working to rebuild the readiness of their forces while growing and modernizing their aging fleet of ships and aircraft. However, achieving readiness recovery goals will take years as both services continue to be challenged to rebuild readiness amid continued operational demands.
This statement provides information on current and future readiness challenges facing (1) the Navy ship and submarine fleet and (2) Navy and Marine Corps aviation. GAO also discusses prior recommendations on Navy and Marine Corps readiness and progress to address them.
This statement is based on previously published work since 2015 related to Navy and Marine Corps readiness challenges, including shipyard workforce and capital investment, ship crewing, weapon system sustainment, the fighter pilot workforce, and modernizing force structure. GAO conducted site visits to the Pacific fleet in November 2018 and analyzed updated data, as appropriate.

What GAO Found

The Navy has taken steps to address training shortfalls in the surface fleet, but faces persistent maintenance and personnel challenges as it seeks to rebuild ship and submarine readiness. While the Navy has corrective actions underway, they will take years to implement. Following ship collisions in 2017, the Navy has taken steps to ensure its crews are trained to standards prior to deployment and made significant progress in those efforts. However, the Navy has struggled to complete ship maintenance—with only 30 percent of maintenance completed on time since fiscal year 2012—leading to thousands of days that ships were unavailable for training and operations (see figure). Additionally, manning shortfalls and experience gaps continue to contribute to high sailor workload and are likely to continue through at least fiscal year 2021. The Navy has developed a plan to improve shipyards and is re-examining its ship manning, among other actions; however, these positive steps have not yet fully addressed GAO's recommendations. Looking to the future, the Navy has indicated that it wants to grow its fleet to meet demands. However, the costs of such growth are not yet known and would likely require resourcing well above currently planned levels.
Navy and Marine Corps aircraft availability has been limited due to numerous challenges (see figure). Specifically, the seven aircraft GAO reviewed have generally experienced decreasing availability since fiscal year 2011 and did not meet availability goals in fiscal years 2017 and 2018. The F-35—the future of naval aviation—also has not met availability goals due to part shortages and poor sustainment planning. In September 2018, the Department of Defense established aggressive targets for aircraft availability. While the Navy and Marine Corps are taking actions to improve aircraft availability, including addressing GAO's recommendations, aviation readiness will take many years to recover.

What GAO Recommends

GAO has made a total of 45 recommendations in the prior work described in this statement. The Department of Defense concurred with most of them, and has many actions underway, but has not yet fully implemented any. Attention to these recommendations can assist the Navy and the Marine Corps as they seek to rebuild the readiness of their forces.


Question:
Why GAO Did This Study

International trade and travel to the United States is increasing. On a typical day in fiscal year 2016, CBP officers inspected nearly 1.1 million passengers and pedestrians and over 74,000 truck, rail, and sea containers at 328 U.S. land, sea, and air ports of entry, according to CBP. To help meet the increased demand for these types of CBP services, since 2013, CBP has entered into public-private partnerships under RSP and DAP. The RSP allows partners to reimburse CBP for providing services that exceed CBP's normal operations, such as paying overtime for CBP personnel that provide services at ports of entry outside normal business hours. The DAP enables partners to donate property or provide funding for port of entry infrastructure improvements.
The Cross-Border Trade Enhancement Act of 2016 included a provision for GAO to review the RSP and DAP. This report examines: (1) how CBP approves and administers RSP and DAP agreements, (2) the status of RSP and DAP agreements, including the purposes for which CBP has used funds and donations, and (3) the extent to which CBP monitors and evaluates program implementation. GAO reviewed partnership agreements and data on program usage. GAO also interviewed CBP and partner officials at 11 ports of entry selected based on a mix of port of entry and agreement types.

What GAO Found

Within the Department of Homeland Security, U.S. Customs and Border Protection (CBP) uses criteria and follows documented procedures to evaluate and approve public-private partnership applications and administer the Reimbursable Services Program (RSP) and Donations Acceptance Program (DAP). For example, RSP applications undergo an initial review by CBP officials at the affected ports of entry before they are scored by an expert panel of CBP officials at headquarters. The panel evaluates RSP applications against seven criteria, such as impact on CBP operations. Similarly, DAP proposals are evaluated by CBP officials against seven operational and six technical criteria, such as real estate implications. Further, if the proposal involves real estate controlled by the General Services Administration (GSA), CBP and GSA officials collaborate on DAP selection decisions and project implementation. To administer the RSP and DAP, CBP has documented policies and procedures, such as standard operating procedures and implementation frameworks. For example, CBP uses a standard procedure to guide the process for RSP partners to request services and to provide reimbursement. For DAP projects, CBP, GSA (if applicable), and partners follow an implementation framework that includes a project planning and design phase.
The number of public-private partnerships is increasing, and partnerships provide a variety of additional services and infrastructure improvements at ports of entry. From fiscal years 2013 through 2017, CBP selected over 100 partners for RSP agreements that could impact 112 ports of entry and other CBP-staffed locations, and the total number of RSP partnerships doubled from fiscal year 2016 to 2017. According to CBP, since partners began requesting reimbursable services in 2014, CBP has provided its partners nearly 370,000 officer overtime hours of services, which led to over $45 million in reimbursed funds. As a result, CBP inspected an additional 8 million travelers and over 1 million personal and commercial vehicles at ports of entry. Similar to the RSP, the number of DAP partnerships more than doubled from fiscal year 2016 to 2017, and totals 16 projects that impact 13 ports of entry as of November 2017. The donations include improvements, such as the installation of new inspection booths and equipment and removal of traffic medians, and are intended to support over $150 million in infrastructure improvements.
CBP uses various processes to monitor and evaluate its partnerships, but could benefit from establishing an evaluation plan to assess overall program performance. For example, CBP conducts regular audits of RSP records to help ensure that CBP bills and collects funds from its partners accurately, and uses guidance, such as the DAP Implementation Roadmap, to identify and monitor project milestones and tasks. However, as of November 2017, CBP had not developed an evaluation plan—which could include, among other things, measurable objectives, performance criteria, and data collection plans—to assess the overall performance of the RSP and DAP, consistent with Office of Management and Budget guidance and leading practices. Given CBP's staffing challenges and anticipated growth of the RSP and DAP, an evaluation plan could better position CBP to further integrate evaluation activities into program management.

What GAO Recommends

GAO recommends that CBP develop an evaluation plan to assess the overall performance of the RSP and DAP. DHS concurred with the recommendation.


Question:
Why GAO Did This Study

GAO has designated DHS management as high risk because of challenges in building a cohesive department. PLCY supports cohesiveness by, among other things, coordinating departmentwide policy and strategy. In the past, however, questions have been raised about PLCY's efficacy. In December 2016, the NDAA codified PLCY's organizational structure, roles, and responsibilities.
GAO was asked to evaluate PLCY's effectiveness. This report addresses the extent to which (1) DHS established an organizational structure and processes and procedures that position PLCY to be effective, (2) DHS and PLCY have ensured alignment of workforce with priorities, and (3) PLCY has engaged relevant component staff to help identify and respond to emerging needs. GAO analyzed the NDAA, documents describing specific responsibilities, and departmentwide policies and strategies. GAO also interviewed officials in PLCY and all eight operational components.

What GAO Found

According to our analysis and interviews with operational components, the Department of Homeland Security's (DHS) Office of Strategy, Policy, and Plans' (PLCY) organizational structure and efforts to lead and coordinate departmentwide and crosscutting strategies—a key organizational objective–have been effective. For example, PLCY's coordination efforts for a strategy and policy executive steering committee have been successful, particularly for strategies. However, PLCY has encountered challenges leading and coordinating efforts to develop, update, or harmonize policies that affect multiple DHS components. In large part, these challenges are because DHS does not have clearly-defined roles and responsibilities with accompanying processes and procedures to help PLCY lead and coordinate policy in a predictable, repeatable, and accountable manner. Until PLCY's roles and responsibilities for policy are more clearly defined and corresponding processes and procedures are in place, situations where the lack of clarity hampers PLCY's effectiveness in driving policy are likely to continue. Development of a delegation of authority, which involves reaching agreement about PLCY's roles and responsibilities and clearly documenting them, had been underway. However, it stalled due to changes in department leadership. As of May 2018, the effort had been revived, but it is not clear whether and when DHS will finalize it.
PLCY does some workforce planning as part of its annual budgeting process, but does not systematically apply key principles of the DHS Workforce Planning Guide to help ensure that PLCY's workforce aligns with its and DHS's priorities and goals. According to PLCY officials, the nature of its mission requires a flexible staffing approach. As such, a portion of the staff functions as generalists who can be assigned to meet the needs of different situations, including unexpected changing priorities due to an emerging need. However, shifting short-term priorities requires tradeoffs, which may divert attention and resources from longer-term priorities. As of June 5, 2018, PLCY also had a number of vacancies in key leadership positions, which further limited attention to certain priorities. According to PLCY officials, PLCY recently began a review to identify the office's authorities in the National Defense Authorization Act for Fiscal Year 2017 (NDAA) and other statutes, compare these authorities to the current organization and operations, and address any workforce capacity gaps. Employing workforce planning principles—in particular, systematic identification of workforce demand, capacity gaps, and strategies to address them—consistent with the DHS Workforce Planning Guide could better position PLCY to use its workforce as effectively as possible under uncertain conditions and to communicate effectively with DHS leadership about tradeoffs.
Officials from PLCY and DHS operational components praised existing mechanisms to coordinate and communicate at the senior level, especially about strategy, but component officials identified opportunities to better connect PLCY and component staff to improve communication flow about emerging policy and strategy needs. Among the ideas offered by component officials to enhance communication and collaboration were holding routine small-group meetings, creating forums for periodic knowledge sharing, and maintaining accurate and up-to-date contact information for all staff-level stakeholders.

What GAO Recommends

GAO is making four recommendations. DHS concurred with three recommendations, including that DHS finalize a delegation of authority defining PLCY's roles and responsibilities and develop corresponding processes and procedures. DHS did not concur with a recommendation to apply the DHS Workforce Planning Guide to identify and communicate workforce needs. GAO believes this recommendation is valid as discussed in the report.


Question:
Why GAO Did This Study

The number of individuals receiving long term care services from Medicaid in community residential settings is expected to grow. These settings, which include assisted living facilities, provide a range of services that allow aged and disabled beneficiaries, who might otherwise require nursing home care, to remain in the community.
State Medicaid programs and CMS, the federal agency responsible for overseeing the state programs, share responsibility for ensuring that beneficiaries' health and welfare is protected. GAO was asked to examine state and federal oversight of assisted living services in Medicaid. This report (1) describes state spending on and coverage of these services, (2) describes how state Medicaid agencies oversee the health and welfare of beneficiaries in these settings, and (3) examines the extent that CMS oversees state Medicaid agency monitoring of assisted living services.
GAO surveyed all state Medicaid agencies and interviewed officials in a nongeneralizeable sample of three states with varied oversight processes for their assisted living programs. GAO reviewed regulations and guidance, and interviewed CMS officials.

What GAO Found

State Medicaid agencies in 48 states that covered assisted living services reported spending more than $10 billion (federal and state) on assisted living services in 2014. These 48 states reported covering these services for more than 330,000 beneficiaries through more than 130 different programs. Most programs were operated under Medicaid waivers that allow states to target certain populations, limit enrollment, or restrict services to certain geographic areas.
With respect to oversight of their largest assisted living programs, state Medicaid agencies reported varied approaches to overseeing beneficiary health and welfare, particularly in how they monitored critical incidents involving beneficiaries receiving assisted living services. State Medicaid agencies are required to protect beneficiary health and welfare and operate systems to monitor for critical incidents—cases of potential or actual harm to beneficiaries such as abuse, neglect, or exploitation.
Twenty-six state Medicaid agencies could not report to GAO the number of critical incidents that occurred in assisted living facilities, citing reasons including the inability to track incidents by provider type (9 states), lack of a system to collect critical incidents (9 states), and lack of a system that could identify Medicaid beneficiaries (5 states).
State Medicaid agencies varied in what types of critical incidents they monitored. All states identified physical, emotional, or sexual abuse as a critical incident. A number of states did not identify other incidents that may indicate potential harm or neglect such as medication errors (7 states) and unexplained death (3 states).
State Medicaid agencies varied in whether they made information on critical incidents and other key information available to the public. Thirty-four states made critical incident information available to the public by phone, website, or in person, while another 14 states did not have such information available at all.
Oversight of state monitoring of assisted living services by the Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), is limited by gaps in state reporting. States are required to annually report to CMS information on deficiencies affecting beneficiary health and welfare for the most common program used to provide assisted living services. However, states have latitude in what they consider a deficiency. States also must describe their systems for monitoring critical incidents, but CMS does not require states to annually report data from their systems. Under federal internal control standards, agencies should have processes to identify information needed to achieve objectives and address risk. Without clear guidance on reportable deficiencies and no requirement to report critical incidents, CMS may be unaware of problems. For example, CMS found, after an in-depth review in one selected state seeking to renew its program, that the state lacked an effective system for assuring beneficiary health and welfare, including reporting insufficient information on the number of unexpected or suspicious beneficiary deaths. The state had not reported any deficiencies in annual reports submitted to CMS in 5 prior years.

What GAO Recommends

GAO recommendations to CMS include clarifying state requirements for reporting program deficiencies and requiring annual reporting of critical incidents. HHS concurred with GAO's recommendations to clarify deficiency reporting and stated that it would consider annual reporting requirements for critical incidents after completing an ongoing review.


Question:
Why GAO Did This Study

In 2006, federal banking regulators jointly issued guidance that described their expectations for sound risk management practices for banks with CRE concentrations. The guidance includes two CRE thresholds that regulators use to identify banks that are potentially exposed to significant CRE concentration risk and could be subject to greater supervisory scrutiny. Concentrations in CRE loans at U.S. banks have been steadily increasing—raising safety and soundness concerns. In December 2015, the regulators jointly issued a public statement to remind banks of the 2006 CRE guidance.
In light of the joint 2015 statement and GAO's ongoing monitoring of regulatory efforts to identify and respond to emerging threats to the banking system, GAO examined (1) trends in the CRE lending market, including changes in risk, and (2) actions taken by regulators to help ensure that banks with CRE concentrations are effectively managing the related risks. To address these issues, GAO analyzed CRE-related data; reviewed agency policies and guidance; and reviewed a nongeneralizable sample of 54 bank examinations conducted from 2013 through 2016 based on the banks' CRE concentrations, total assets, primary regulator, and geographic location. GAO also interviewed officials from the federal banking regulators.

What GAO Found

While the commercial real estate (CRE) sector has recovered since the 2007–2009 financial crisis, GAO's trend and econometric analyses generally indicate that risk in CRE lending by banks has increased over the past several years. Since the early 2000s, community banks have tended toward providing CRE loans more than other kinds of loans. Indicators of CRE market conditions and loan performance have been improving since 2011. At the same time, GAO's analyses of changes in CRE underwriting standards, property prices, and other data suggest that credit and concentration risks have increased in bank CRE lending. For example, the number of banks with relatively high CRE concentrations—measured by the ratio of a bank's CRE loans to its total capital—has been increasing. In addition, commercial property prices have been increasing rapidly, and property valuations also have risen in recent years. Similarly, GAO's predictive econometric models of CRE loan performance suggest that risk has increased, based largely on the simultaneous increase in bank CRE lending and CRE prices observed over the last several years, but is lower than the level associated with the 2007–2009 financial crisis.
GAO found that federal banking regulators subjected banks with relatively high CRE concentrations to greater supervisory scrutiny based on its review of a nongeneralizable sample of 54 bank examinations covering 40 banks done by the Federal Deposit Insurance Corporation, Board of Governors of the Federal Reserve System, and Office of the Comptroller of the Currency from 2013 through 2016. Of the 54 examinations that GAO reviewed, 41 of them covered banks with relatively high CRE concentrations. In all of these examinations, regulators examined whether the banks had adequate risk management practices and capital to manage their CRE concentration risk. In 26 of the 41 examinations, regulators did not find any risk management weaknesses. However, in 15 of the 41 examinations, regulators found the banks had weaknesses in one or more risk management areas, such as board and management oversight, management information systems, or underwriting. The regulators generally communicated their findings to the banks in the reports of examination and directed the banks to correct their risk management weaknesses.


Question:
Why GAO Did This Study

Concerns over efforts by U.S. taxpayers to use offshore accounts to hide income or evade taxes contributed to the passage of FATCA in 2010, which sought to create greater transparency and accountability over offshore assets held by U.S. taxpayers.
House Report 114-624 included a provision for GAO to evaluate FATCA implementation and determine the effects of FATCA on U.S. citizens living abroad. GAO—among other things—(1) assessed IRS's efforts to use FATCA-related information to improve taxpayer compliance; (2) examined the extent to which Treasury administers overlapping reporting requirements on financial assets held overseas; and (3) examined the effects of FATCA implementation unique to U.S. persons living abroad.
GAO reviewed applicable documentation; analyzed tax data; and interviewed officials from IRS, other federal agencies and organizations, selected tax practitioners, and more than 20 U.S. persons living overseas.

What GAO Found

Data quality and management issues have limited the effectiveness of the Internal Revenue Service's (IRS) efforts to improve taxpayer compliance using foreign financial asset data collected under the Foreign Account Tax Compliance Act (FATCA). Specifically, IRS has had difficulties matching the information reported by foreign financial institutions (FFI) with U.S. taxpayers' tax filings due to missing or inaccurate Taxpayer Identification Numbers provided by FFIs. Further, IRS lacks access to consistent and complete data on foreign financial assets and other data reported in tax filings by U.S. persons, in part, because some IRS databases do not store foreign asset data reported from paper filings. IRS has also stopped pursuing a comprehensive plan to leverage FATCA data to improve taxpayer compliance because, according to IRS officials, IRS moved away from updating broad strategy documents to focus on individual compliance campaigns. Ensuring access to consistent and complete data collected from U.S. persons—and employing a plan to leverage such data—would help IRS better leverage such campaigns and increase taxpayer compliance.
Due to overlapping statutory reporting requirements, IRS and the Financial Crimes Enforcement Network (FinCEN)—both within the Department of the Treasury (Treasury)—collect duplicative foreign financial account and other asset information from U.S. persons. Consequently, in tax years 2015 and 2016, close to 75 percent of U.S. persons who reported information on foreign accounts and other assets on their tax returns also filed a separate form with FinCEN. The overlapping requirements increase the compliance burden on U.S. persons and add complexity that can create confusion, potentially resulting in inaccurate or unnecessary reporting. Modifying the statutes governing the requirements to allow for the sharing of FATCA information for the prevention and detection of financial crimes would eliminate the need for duplicative reporting. This is similar to other statutory allowances for IRS to disclose return information for other purposes, such as for determining Social Security income tax withholding.
According to documents GAO reviewed, and focus groups and interviews GAO conducted, FFIs closed some U.S. persons' existing accounts or denied them opportunities to open new accounts after FATCA was enacted due to increased costs, and risks they pose under FATCA reporting requirements. According to Department of State (State) data, annual approvals of renunciations of U.S. citizenship increased from 1,601 to 4,449—or nearly 178 percent—from 2011 through 2016, attributable in part to the difficulties cited above.
Treasury previously established joint strategies with State to address challenges U.S. persons faced in accessing foreign financial services. However, it lacks a collaborative mechanism to coordinate efforts with other agencies to address ongoing challenges in accessing such services or obtaining Social Security Numbers. Implementation of a formal means to collaboratively address burdens faced by Americans abroad from FATCA can help federal agencies develop more effective solutions to mitigate such burdens by monitoring and sharing information on such issues, and jointly developing and implementing steps to address them.

What GAO Recommends

GAO is making one matter for congressional consideration to address overlap in foreign asset reporting requirements. GAO is making seven recommendations to IRS and other agencies to enhance IRS's ability to leverage FATCA data to enforce compliance, address unnecessary reporting, and better collaborate to mitigate burdens on U.S. persons living abroad. State and Social Security Administration agreed with GAO's recommendations. Treasury and IRS neither agreed nor disagreed with GAO's recommendations.


Question:
Why GAO Did This Study

The Secret Service incurs millions of dollars in travel expenses to provide security during the fast-paced operational tempo of a presidential campaign. In connection with the 2016 presidential campaign, the Secret Service provided protection for four presidential candidates, two vice presidential candidates, and six of the candidates' family members.
GAO was asked to review the Secret Service's travel-related expenses for the 2016 presidential campaign. This report examines (1) how much the Secret Service incurred in travel-related expenses, and (2) the extent to which travel-related payments and reimbursements were made in accordance with laws, regulations, and policies. GAO analyzed Secret Service data to determine the travel expenses incurred by the agency for the 2016 presidential campaign. GAO also randomly selected 40 overnight trips to assess the Secret Service's compliance with provisions of its lodging policies and the Federal Travel Regulation. GAO analyzed the Secret Service's payments to campaign committees to determine whether committees were reimbursed the correct amounts for charter flights.

What GAO Found

The U.S. Secret Service's (Secret Service) travel expenses during the 2016 presidential campaign totaled approximately $58 million. Of the $58 million, $17.1 million was for reimbursements to the four campaign committees for chartered aircraft flights. In the case of campaign travel, Secret Service special agents often fly with protected individuals on aircraft chartered by the campaign committees. The Secret Service reimburses the campaign committees for the number of seats occupied by special agents on board each charter flight.
For the 40 overnight trips GAO reviewed, the Secret Service generally followed its policies and regulations for lodging payments. However, GAO found that the agency overpaid the campaign committees at least an estimated $3.9 million when reimbursing them for special agents' seats on charter flights. Since at least 1977, the Secret Service's policy has been to pay the lower of two fares when reimbursing campaign committees for special agents' travel on chartered aircraft flights. Specifically, the Secret Service is to pay the lower of the following two fares: the lowest commercially available first-class airfare, or the pro rata fare—the cost of the agent's seat on the charter flight calculated by taking the total cost of the charter divided by the number of passengers on board. However, during the 2016 presidential campaign, Secret Service officials misinterpreted a Federal Election Commission regulation, and as a result, did not conduct the comparison. Instead, the Secret Service solely paid the pro rata fare to the campaign committees. Eight months before the end of the 2016 presidential campaign, Secret Service officials determined the interpretation was erroneous, but did not ensure the agency reverted to its long standing policy. During these 8 months, 66 percent of all campaign-related flights with special agents on board were taken.
Federal agencies are generally required to collect on debts that have been determined by an appropriate official of the federal government to be owed to the United States. Debts include overpayments. Pursuing debt collection, however, will require the Secret Service to calculate the specific amount it overpaid to the campaign committees and determine how to proceed with seeking repayment from the various committees, as appropriate.

What GAO Recommends

GAO is making five recommendations, including that the Secret Service should (1) calculate its overpayments to the campaign committees for special agents' seats on chartered aircraft flights, and (2) determine how it should proceed with respect to collecting on identified debts. The Department of Homeland Security concurred with the recommendations and identified actions underway to address them.


Question:
Why GAO Did This Study

Managing employee performance has been a long-standing government-wide issue and the subject of numerous reforms since the beginning of the modern civil service. Without effective performance management, agencies risk not only losing the skills of top talent, they also risk missing the opportunity to effectively address increasingly complex and evolving mission challenges.
GAO was asked to examine federal non-Senior Executive Service performance management systems. This report examines (1) government-wide trends in employee perceptions of performance management as measured by the results of selected FEVS statements, (2) practices that selected agencies use to improve performance management, and (3) OPM's guidance and resources to support agency efforts to improve performance management government-wide.
GAO analyzed responses to selected FEVS statements related to the five performance management phases from 2010 through 2017; selected four agencies based on the highest average scores for the five phases, among other criteria, to identify practices which may contribute to improved performance management; reviewed OPM documents; and interviewed OPM and other agency officials.

What GAO Found

GAO found that from 2010 through 2017, surveyed employees generally demonstrated positive responses to selected Federal Employee Viewpoint Survey (FEVS) statements related to four of the Office of Personnel Management's (OPM) five performance management phases, including: planning and setting expectations, monitoring performance, developing the capacity to perform, and rating performance. Employees responded least positively to statements related to rewarding performance, with only 39 percent of employees, on average, agreeing with statements regarding this phase.
Of the four agencies with among the highest average scores for the performance management phases (Bureau of Labor Statistics, Centers for Disease Control and Prevention, Drug Enforcement Administration, and Office of the Comptroller of the Currency), GAO identified practices that may contribute to improved performance management including strong organizational culture and dedication to mission; use of FEVS and other survey data; and a focus on training.
OPM provides guidance and opportunities for agencies to share promising practices on performance management; however, some of this information is not easily accessible on its performance management website. In addition, OPM does not leverage its leadership position to formally identify and share emerging performance management research and innovation with agencies. As a result, agencies, and therefore their employees, may not benefit from the best information available.

What GAO Recommends

GAO is making three recommendations, including that OPM improve its website and share innovations in performance management with agencies. OPM agreed with GAO's recommendations.


Question:
Why GAO Did This Study

The Department of Defense's (DOD) major acquisition programs continue to experience cost and schedule overruns. GAO previously found that selecting skilled program managers is a key factor to achieving successful program outcomes. DOD relies on military and civilian program managers to deliver its most expensive new weapon systems, meaning its approach to training, mentoring, retaining, and selecting program managers is critical.
House Report 114-537 included a provision for GAO to review the career paths, development, and incentives for program managers. This report addresses how leading organizations train, mentor, retain, and ultimately select program managers; and the extent to which military service practices align with those leading practices. To conduct this work, GAO identified leading practices documented in prior work and by the Project Management Institute, and interviewed commercial companies identified by the Institute as leaders in this field. GAO also analyzed military service practices for developing program managers and compared those to leading practices.

What GAO Found

Leading organizations use 10 key practices to train, mentor, retain, and ultimately select skilled program managers. GAO found that military service practices for developing program managers align extensively with four of the leading practices, as shown in the table below.
At least one military service's practices do not align extensively with five of the leading practices, as shown in the table below.
For the remaining leading practice, none of the military services' practices align extensively, as shown in the table below.
Military service officials generally agreed with the assessments. More consistent alignment with leading practices—adapted for military and civilian personnel as appropriate and including greater use of existing financial rewards—would enhance the services' ability to manage acquisition programs.

What GAO Recommends

GAO is making eight recommendations, including that the military services improve practices that do not align extensively with leading practices and make greater use of existing financial rewards for good performance. DOD concurred with the recommendations.


Question:
Why GAO Did This Study

This testimony summarizes the information contained in GAO's March 2018 report, entitled U.S. Patent and Trademark Office: Assessment of the Covered Business Method Patent Review Program ( GAO-18-320 ).

What GAO Found

From September 2012 through September 2017, entities facing patent infringement lawsuits filed 524 petitions challenging the validity of 359 patents under the U.S. Patent and Trademark Office's (USPTO) covered business method (CBM) program, resulting in decisions against about one-third of these patents. The CBM program provides entities facing infringement lawsuits an opportunity to challenge the validity of a business method patent by demonstrating that it did not meet requirements for patentability. Business method patents focus on ways of doing business in areas such as banking or e-commerce. The rate of filing petitions over this period has fluctuated but has generally declined since 2015, and none were filed in August or September 2017.
USPTO has taken several steps to ensure the timeliness of trial decisions, review past decisions, and engage with stakeholders to improve proceedings under the program:
Timeliness: USPTO regularly informs relevant parties about paperwork requirements and due dates throughout trials. According to program data, as of September 2017, all 181 completed trials were completed within statutorily required time frames.
Decision review: USPTO has taken several steps to review its decisions and has monitored the rate at which the Court of Appeals for the Federal Circuit affirms or reverses them. However, USPTO does not have guidance, such as documented procedures, for reviewing trial decisions, or the processes leading to decisions, for consistency. Without guidance, such as documented procedures, USPTO cannot fully ensure that it is meeting its objective of ensuring consistency of decisions.
Stakeholder engagement: USPTO judges have engaged with stakeholders by participating in public roundtables and webinars, and attending judicial conferences, among other things.
Stakeholders GAO interviewed generally agreed that the CBM program has reduced lawsuits involving business method patents in the federal courts. While many stakeholders favored maintaining aspects of the program, there was not strong consensus among stakeholders for how future trials should be designed.


Question:
Why GAO Did This Study

FPS, within DHS's NPPD, conducts physical security and law enforcement activities for about 9,000 federal facilities and the millions of employees or visitors who work in or visit these facilities. FPS moved from GSA to DHS's ICE in 2003 and to NPPD in 2009. GAO has reported that FPS faced challenges in each location. Legislation enacted in November 2018 requires DHS to review placement options for FPS and could result in FPS moving again within DHS or to another executive branch agency.
GAO was asked to review issues related to organizational placement options for FPS. This report examines (1) the potential effects of FPS's placement in selected agencies and (2) steps DHS has taken to assess placement options for FPS. GAO identified five key organizational placement criteria based on prior work and identified eight agencies as potential placement options. The agencies were selected because they have the largest number of law enforcement officers or perform physical security, among other reasons. GAO reviewed documentation and interviewed officials from FPS, selected agencies, and key stakeholders. GAO compared agencies to FPS to determine if they meet the organizational placement criteria. An agency meets the criteria if it has similarities to FPS.

What GAO Found

In considering organizational placement options for the Department of Homeland Security's (DHS) Federal Protective Service (FPS), GAO found that none of the eight agencies GAO selected met all the key organizational placement criteria; thus, any of the organizational placement options could result in both benefits and trade-offs. For example, keeping FPS in DHS's National Protection and Programs Directorate (NPPD) could provide FPS some benefits because FPS and NPPD have missions that include the protection of infrastructure or specific facilities, facility protection responsibilities, and access to and sharing of information related to national homeland security. However, unlike FPS, NPPD does not perform both physical security and law enforcement activities, which is a potential trade-off. In another example, the General Services Administration (GSA) and the United States Marshals Service (Marshals) could provide benefits because they currently coordinate with FPS on facility protection. However, Marshals does not have a mission or goals that explicitly focus on the protection of infrastructure or facilities and GSA does not perform law enforcement, which are potential trade-offs.
DHS has not taken key steps to fully assess potential placement options. Specifically, DHS has not assessed the organizational structure of FPS, such as its placement in NPPD, even though FPS and NPPD have evolved since FPS was placed in NPPD in 2010. Standards for Internal Control state that agency management should establish an organizational structure to achieve the agency's objectives and that an effective management practice for attaining this outcome includes periodically evaluating the structure to ensure that it has adapted to changes. Additionally, because DHS did not analyze FPS's current placement in NPPD, DHS does not have a benchmark for comparison to other agencies. DHS recently established a working group to assess the placement of FPS. However, the group's planned activities are limited in several ways. For example, the group's draft charter does not indicate that the working group will describe what DHS expects to achieve by changing FPS's placement. Further, the draft charter does not indicate that the working group will evaluate the benefits and trade-offs of placement options. GAO has previously identified these and other steps as key to successful organizational change or analysis of alternatives. These steps would help DHS address the 2018 legislation to review placement options for FPS—including, how DHS considered the results of GAO's review. Regardless of the legislation, DHS may not be positioning itself to make an informed decision as to what organization best supports FPS.

What GAO Recommends

DHS should identify the expectations for changing FPS's placement and take steps to fully evaluate placement options. DHS concurred with the recommendations and outlined steps it plans to take to address them.


Question:
Why GAO Did This Study

A goal for the 2020 Census is to count everyone once, only once, and in the right place. Achieving a complete and accurate census is becoming an increasingly complex task, in part because the nation's population is growing larger, more diverse, and more reluctant to participate. When the census misses a person who should have been included, it results in an undercount. Historically, certain sociodemographic groups have been undercounted in the census, which is particularly problematic given the many uses of census data.
GAO was asked to review the Bureau's plans for enumerating hard-to-count groups in the 2020 Census. This report examines (1) the Bureau's plans for improving the enumeration of the hard-to-count in 2020, and how that compares with 2010; and (2) the challenges the Bureau faces in improving the enumeration of the hard-to-count in 2020. GAO reviewed Bureau planning, budget, operational, and evaluation documents as well as documents of the hard-to-count related working groups of the Bureau's National Advisory Committee; and interviewed Bureau officials.

What GAO Found

The Census Bureau's (Bureau) plans for enumerating groups considered hard-to-count, such as minorities, renters, and young children, in the 2020 Census includes the use of both traditional and enhanced initiatives. For example, the Bureau plans to continue using certain outreach efforts used in 2010, such as a communications campaign with paid advertising, partnerships with local organizations, and targeted outreach to immigrant and faith-based organizations. The Bureau also plans enhancements to its outreach efforts compared to 2010. For example, to help address the undercount of young children, the Bureau revised the census questionnaire and instructions to enumerators to more explicitly include grandchildren in counts. Other planned changes include:
Expanded languages: The Bureau plans to offer more non-English language response options and instructional materials than for 2010.
More partnership specialists: The Bureau plans to hire nearly twice as many partnership specialists as it had planned for the 2010 Census to recruit partner organizations in local communities.
Earlier partnership hiring : The Bureau started hiring a small number of partnership staff in October 2015—2 years earlier than it did for 2010.
While efforts have been made, enumerating hard-to-count persons in 2020 will not be easy. Aside from the inherent difficulties of counting such individuals, the Bureau faces certain management challenges related to its hard-to-count efforts.
First, the Bureau's hard-to-count efforts are distributed across over one third of its 35 operations supporting the 2020 Census. And while decentralized operations can provide flexibility, to enhance visibility over these hard-to-count efforts, the Bureau recently developed a draft operational document. However, the Bureau will continue to face challenges in ensuring its hard-to-count efforts integrate with each other. For example, some of the detailed plans for 10 of the hard-to-count efforts were released in 2016 and are awaiting updates, while 4 plans have yet to be released. With less than 2 years until Census Day (April 1, 2020), there is little room for delay. Therefore, to ensure that emerging plans related to the hard-to-count efforts integrate with existing plans, Bureau management will need to continue its focus on control of the changes in hard-to-count efforts moving forward.
Second, the Bureau faces a challenge of a tighter labor market than existed prior to 2010 that could potentially create shortfalls or delays in its hiring of partnership staff who are needed to reach small and hard-to-count communities. In early hiring for 2020, Bureau officials reported smaller than expected applicant pools, declined offers, and turnover. Although it has plans to identify critical skills for 2020 and for tailored recruiting, collecting data on its hiring efforts will also be important. Currently, the Bureau lacks data from its 2010 Census that could have helped inform its partnership-staff hiring efforts for 2020.

What GAO Recommends

GAO recommends that the Bureau take steps to ensure that forthcoming changes and decisions on its hard-to-count related efforts are integrated with other operational efforts and that it collects data on its 2020 partnership hiring efforts.
The Department of Commerce agreed with GAO's recommendations, and the Bureau provided technical comments that were incorporated, as appropriate.


Question:
Why GAO Did This Study

Misuse of prescription opioids can lead to overdose and death. In 2016, over 14 million Medicare Part D beneficiaries received opioid prescriptions, and spending for opioids was almost $4.1 billion. GAO and others have reported on inappropriate activities and risks associated with these prescriptions.
This statement is based on GAO's October 2017 report (GAO-18-15) and discusses (1) CMS oversight of beneficiaries who receive opioid prescriptions under Part D, and (2) CMS oversight of providers who prescribe opioids to Medicare Part D beneficiaries. For the October 2017 report, GAO reviewed CMS opioid utilization and prescriber data, CMS guidance for plan sponsors, and CMS's strategy to prevent opioid misuse. GAO also interviewed CMS officials, the six largest Part D plan sponsors, and 12 national associations selected to represent insurance plans, pharmacy benefit managers, physicians, patients, and regulatory and law enforcement authorities.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS), within the Department of Health and Human Services (HHS), provides guidance on the monitoring of Medicare beneficiaries who receive opioid prescriptions to plan sponsors—private organizations that implement the Medicare drug benefit, Part D—but lacks information on most beneficiaries at risk of harm from opioid use.
CMS provides guidance to plan sponsors on how they should monitor opioid overutilization among Medicare Part D beneficiaries, and requires them to implement drug utilization review systems that use criteria similar to CMS's. CMS's criteria focused on beneficiaries who do all the following: (1) receive prescriptions of high doses of opioids, (2) receive prescriptions from four or more providers, and (3) fill prescriptions at four or more pharmacies. According to CMS, this approach focused actions on beneficiaries the agency determined to have the highest risk of harm.
CMS's criteria, including recent revisions, do not provide sufficient information about the larger population of potentially at-risk beneficiaries. CMS estimates that while 33,223 beneficiaries would have met the revised criteria in 2015, 727,016 would have received high doses of opioids regardless of the number of providers or pharmacies. In 2016, CMS began to collect information on some of these beneficiaries using a higher dosage threshold for opioid use. This approach misses some who could be at risk of harm, based on Centers for Disease Control and Prevention guidelines. As a result, CMS is limited in its ability to assess progress toward meeting the broader goals of its Opioid Misuse Strategy for the Medicare and Medicaid programs, which includes activities to reduce the risk of harm to beneficiaries from opioid use.
CMS oversees the prescribing of drugs at high risk of abuse through a variety of projects, but does not analyze data specifically on opioids. According to CMS officials, CMS and plan sponsors identify providers who prescribe large amounts of drugs with a high risk of abuse, and those suspected of fraud or abuse may be referred to law enforcement. However, GAO found that CMS does not identify providers who may be inappropriately prescribing large amounts of opioids separately from other drugs, and does not require plan sponsors to report actions they take when they identify such providers. As a result, CMS is lacking information that it could use to assess how opioid prescribing patterns are changing over time, and whether its efforts to reduce harm are effective.

What GAO Recommends

In the October 2017 report, GAO made three recommendations that CMS (1) gather information on the full number of at-risk beneficiaries receiving high doses of opioids, (2) identify providers who prescribe high amounts of opioids, and (3) require plan sponsors to report to CMS on actions related to providers who inappropriately prescribe opioids. HHS concurred with the first two recommendations, but not with the third. GAO continues to believe the recommendation is valid, as discussed in the report and in this statement.


Question:
Why GAO Did This Study

Congress has often asked GAO to evaluate the implementation of procedural and analytical requirements that apply to agencies' rulemaking and guidance processes. The importance of improving the transparency of those processes, including providing public participation and sufficient oversight, is a common theme throughout GAO's body of work on federal regulation.
Based on GAO's prior work, this testimony addresses: (1) the extent to which USDA, Education, HHS, and DOL adhered to OMB requirements and internal controls when developing regulatory guidance, and (2) agencies' compliance with the CRA for regulations promulgated during presidential transitions.

What GAO Found

Agencies GAO reviewed—Departments of Agriculture (USDA), Education (Education), Health and Human Services (HHS), and Labor (DOL) did not consistently adhere to Office of Management and Budget (OMB) requirements and internal controls when developing regulatory guidance, as GAO reported in 2015. Unlike regulations, regulatory guidance is not generally legally binding and is subject to different requirements for regulatory oversight. Agencies weighed various factors when they determined whether to issue guidance. The agencies GAO reviewed issued different amounts of guidance for various purposes, such as explaining plans for implementing regulations. Agencies found few of their guidance documents to be “significant,” guidance with a broad and substantial impact on regulated entities. USDA and Education had written procedures for the approval of significant guidance as directed by OMB; DOL's procedures needed updating and to be distributed to appropriate agency officials; HHS did not have any. GAO found that USDA, Education, and DOL consistently applied OMB's requirements for public feedback and access, for example public access to guidance through websites, while HHS did not. Agencies can better ensure consistent application of review processes and public access to significant guidance through better adherence to OMB requirements. GAO also found opportunities for agencies to improve adherence to internal controls for guidance that did not meet OMB's definition of “significant.” For example, most subagencies GAO reviewed did not have written procedures for the production of guidance and about half did not regularly evaluate whether issued guidance was effective and up-to-date. Adherence to these internal controls could promote quality and consistency in guidance development processes.
GAO found that agencies did not consistently comply with the Congressional Review Act (CRA) for regulations promulgated during the 120-day presidential transition periods (September 23 through January 20), as defined by the Presidential Transitions Improvements Act of 2015. GAO reported that during the transition from the end of one presidential administration to the next, the Clinton, Bush, and Obama administrations published on average roughly 2.5 times more economically significant regulations during transition periods than during nontransition periods; increases are typical during transition periods. For these regulations, agencies more frequently provided advanced notice to the public, thus providing the public opportunities to influence the development of these transition period regulations before they were finalized. In their published regulations, agencies generally reported complying with four of five procedural requirements for promulgating regulations during both transition and nontransition periods. Agencies are required to 1) assess the impact of regulations on small entities, 2) minimize the burden that information collections impose on the public, 3) assess the costs and benefits of regulations that include federal mandates, and 4) for certain agencies, obtain direct input from small entities during rulemaking. Also, a fifth requirement, agencies must comply with CRA, which provides Congress an opportunity to review and possibly disapprove regulations before they take effect. Agencies less often complied with CRA, during both transition and nontransition periods. The most common deficiency was agencies' failure to provide Congress the required time to review regulations, which GAO has also identified as a deficiency in previous work.

What GAO Recommends

In the April 2015 report on regulatory guidance, GAO made eleven recommendations to USDA, Education, HHS, and DOL to ensure adherence to OMB requirements and applicable elements of internal controls. Three of these recommendations to HHS remain open: 1) to develop written procedures for the approval of significant guidance, 2) strengthen application of internal controls over guidance processes, and 3) improve its website.
In the March 2018 report on rulemaking at the end of presidents' terms, GAO recommended OMB, as part of its regulatory review process, identify economically significant regulations at risk of not complying with the CRA and work with agencies to ensure compliance. OMB staff did not agree or disagree with the recommendation.


Question:
Why GAO Did This Study

DOD offers health care services to approximately 9.4 million eligible beneficiaries through TRICARE, DOD's regionally structured health care program. In each of its regions, DOD uses contractors to manage health care delivery through civilian provider networks, among other tasks.
The NDAA 2017 made several changes to the TRICARE program, including the establishment of a new preferred provider network health plan option called TRICARE Select. The NDAA 2017 also required DOD to develop an implementation plan for TRICARE Select that addresses seven specific mandated elements on access to care, beneficiary complaints, and quality metrics for network providers.
The NDAA 2017 included a provision for GAO to review the implementation plan. This report examines the extent to which DOD's implementation plan addressed the mandated elements. GAO evaluated DOD's implementation plan using leading planning practices identified in GAO's prior work and standards for internal control. GAO examined program policies, procedures, and contracts and interviewed DOD officials and TRICARE regional contractors.

What GAO Found

The Department of Defense's (DOD) TRICARE Select Implementation Plan addressed the seven specific elements mandated by the National Defense Authorization Act for Fiscal Year 2017 (NDAA 2017). These elements are
Element A: ensuring that at least 85 percent of the TRICARE Select beneficiary population is covered by the network by January 1, 2018;
Element B: ensuring access standards for health care appointments;
Element C: establishing mechanisms for monitoring compliance with standards for access to care;
Element D: establishing health care provider-to-beneficiary ratios;
Element E: monitoring complaints by beneficiaries with respect to network adequacy and health care provider availability;
Element F: establishing requirements for mechanisms to monitor the responses to complaints by beneficiaries; and
Element G: establishing mechanisms to evaluate the quality metrics of the network providers.
GAO also assessed the implementation plan against leading practices for sound strategic management planning and found that it incorporated many of the practices, such as establishing goals, strategies to achieve goals, and plans to assess progress. However, a few of the leading practices were only partially incorporated or not incorporated at all. For example, the implementation plan did not always fully address the leading practice that planning documents include strategies to achieve goals and plans to assess progress. DOD officials explained that some of the details of their approach to the elements had not been finalized when they were completing the implementation plan. These officials added that their approach to the implementation plan was to create a strategic overview, and that some of the details are contained in contract documents and monitored through their oversight responsibilities.
Furthermore, GAO's assessment of the plan's elements found that the approach outlined in the implementation plan for ensuring access standards for health care appointments (Element B) is different from the approach DOD intends to use. The plan noted that DOD will use the access standards for TRICARE Prime—a managed care option—for TRICARE Select. However, DOD officials told GAO that the contractors are responsible for developing their own access standards, which DOD must approve. These officials added that DOD did not include information about the contractors proposing their own access standards because DOD was still developing its approach to this element when the plan was submitted. Because the implementation plan does not reflect DOD's current approach, Congress may not have the information it needs about the contractors' responsibilities for providing access to care, impeding its ability to provide oversight.

What GAO Recommends

GAO recommends that DOD provide written documentation of its approach for developing and approving the TRICARE Select access standards, as well as the final access standards, to Congress. DOD agreed with GAO's recommendation.


Question:
Why GAO Did This Study

ORR is responsible for coordinating and implementing the care and placement of unaccompanied children—that is, children who enter the United States with no lawful immigration status. The number of these children taken into custody by DHS and placed in ORR's care rose from about 6,600 in fiscal year 2011 to nearly 57,500 in fiscal year 2014, many coming from Central America. Though declining somewhat, the number has remained well above historical levels. In fiscal year 2017, DHS referred 40,810 such children to ORR.
This testimony discusses efforts by DHS and HHS to improve the placement and care of unaccompanied children in four key areas: (1) the process by which unaccompanied children are transferred from DHS to ORR custody; (2) how ORR monitors the care of unaccompanied children in its custody; (3) how ORR identifies and screens sponsors before children are transferred to their care; and (4) what is known about services these children receive after they leave ORR custody.
This testimony is based primarily on the findings from two prior GAO reports: a 2015 report on actions needed to ensure unaccompanied children receive required care in DHS custody; and a 2016 report on further actions HHS could take to monitor their care. This testimony also includes updated information on the progress agencies have made in implementing GAO's recommendations, and more recent statistics from publicly available sources.

What GAO Found

The Department of Homeland Security (DHS) and Department of Health and Human Services (HHS) have agreed to establish a joint collaborative process for the referral and placement of unaccompanied children, but the process has not yet been implemented. In 2015, GAO reported that the interagency process for referring unaccompanied children from DHS to HHS's Office of Refugee Resettlement (ORR) shelters was inefficient and vulnerable to error, and that each agency's role and responsibilities were unclear. GAO recommended that DHS and HHS jointly develop and implement an interagency process with clearly defined roles and responsibilities, as well as procedures to disseminate placement decisions, for all agencies involved. In February 2018, HHS officials told GAO that the agency was reviewing a draft of the DHS-HHS joint concept of operations.
ORR has reported taking steps to improve monitoring of grantees that provided services to unaccompanied children. In 2016, GAO reported that ORR relied on grantees to document and annually report on the care they provide for unaccompanied children, such as housing and educational, medical, and therapeutic services, but documents were often missing and ORR was not able to complete all of its planned visits. GAO recommended that ORR review its monitoring program to ensure that onsite visits are conducted in a timely manner, that case files are systematically reviewed, and that grantees properly document the services they provide. Since 2016, ORR has reported that its grantee monitoring has improved, with more timely completion of on-site monitoring of all its grantees.
ORR relies on grantees to identify and screen sponsors before placing children with them. In 2016, GAO reported that most unaccompanied children from certain Central American countries were released to a parent or other relative, in accordance with ORR policy (see figure).
Sponsors' Relationship to Unaccompanied Children from El Salvador, Guatemala, and Honduras (Released from Custody from January 7, 2014, through April 17, 2015)
In 2016, GAO reported that limited information was available on the services provided to children after they leave ORR care, and recommended that HHS develop processes to ensure its post-release activities provide reliable and useful summary data. Subsequent data from ORR indicate that the percentage of children receiving these services has increased, from about 10 percent in fiscal year 2014, to about 32 percent in fiscal year 2017. Also, in August 2017, ORR officials said that new case reporting requirements had been added to ORR's policy guide; however, further steps are needed to ensure the systematic collection of these data to provide useful information on post-release services across agencies, as GAO recommended.


Question:
Why GAO Did This Study

DOD's MAIS programs are intended to help the agency sustain its key operations. In April 2017, recognizing that MAIS programs met different mission needs, DOD categorized its MAIS programs into business and non-business systems.
The National Defense Authorization Act for Fiscal Year 2012 includes a provision for GAO to select, assess, and report on DOD's MAIS programs annually through March 2018. GAO's objectives, among others, were to (1) assess DOD's policies for managing and overseeing MAIS programs and (2) describe the extent to which selected MAIS programs have changed their planned cost and schedule estimates and met technical performance goals. To address these objectives, GAO compared DOD's policies for managing and overseeing all 34 MAIS programs (24 non-business programs and 10 business programs) to leading IT management practices. GAO also compared 15 selected programs' initial cost, schedule, and performance baselines to their current acquisition program estimates.

What GAO Found

The strength of Department of Defense's (DOD) policies for managing and overseeing major automated information system (MAIS) programs varies. Specifically, the policy for managing 24 non-business MAIS programs adheres to leading information technology (IT) management practices, but the policy for managing 10 MAIS business programs does not always do so (see table).
When DOD categorized 10 of the 34 MAIS programs as MAIS business programs, it also directed these programs to adhere to DOD's business systems policy (DOD Instruction 5000.75). However, the department directed those programs to use a policy for the management and oversight of MAIS business programs that was not fully comprehensive. Until DOD updates its business systems policy to address gaps in establishing performance information such as baseline estimates on program cost and schedule goals, identifying thresholds to identify high risk, and requiring periodic reports to be provided to stakeholders at regular intervals, stakeholders will likely not have all the information they need to manage and oversee MAIS business programs.
While all 15 business and non-business MAIS programs had either increased or decreased their planned cost estimates and the majority had delays in their planned schedule estimates, the majority of the 9 programs that had performance targets met those performance goals. Specifically, the decreases and increases in cost estimates ranged from a decrease of $1.6 billion (-41 percent) to an increase of $1.5 billion (163 percent). The decreases in planned cost were largely due to scope reduction, while cost increases were due to underestimating levels of effort and contracting issues. The slippages in schedule estimates ranged from a delay of 5 years to 5 months; these delays were caused by unrealistic expectations or unplanned changes. Six of the 9 programs that had performance targets met all of them, while the other 3 met several but not all of their performance targets. The other 6 programs were in the early stages of system development and had not begun performance testing.

What GAO Recommends

GAO is making three recommendations, including that DOD update its policy for managing MAIS business programs to include baseline estimates. DOD partially concurred with this recommendation, and fully concurred with the other two recommendations. GAO continues to believe that all the recommendations are warranted.


Question:
Why GAO Did This Study

DOD manages the procurement of billions of dollars in defense items and services on behalf of foreign customers through the FMS program. These sales help support the defense industrial base and are vital to U.S. foreign policy and national security interests.
The FMS process generally begins with a request by a foreign government for information about a U.S. defense item or service. Requests for price and availability data are an optional step in the process. DOD guidance is to generally respond to such requests within 45 days.
The fiscal year 2018 National Defense Authorization Act included a provision for GAO to review DOD's process for developing price and availability data for foreign customers. This report addresses, among other objectives, (1) price and availability requests DOD received from fiscal years 2014 through 2018, (2) how DOD develops price and availability data, and (3) the factors that can influence the timeliness of DOD's responses to foreign customers with price and availability data.
GAO analyzed DOD price and availability data for fiscal years 2014 through 2018, the latest data available; and reviewed documents for a non-generalizable sample of five price and availability responses—varying by estimate value—provided to foreign customers by the Army, Navy, and Air Force. GAO also interviewed defense contractors and DOD officials.
GAO is not making any recommendations at this time.

What GAO Found

The Department of Defense (DOD) reported receiving 3,038 requests for Foreign Military Sales (FMS) price and availability data in fiscal years 2014 through 2018 from 93 countries across six geographic regions, as shown in the figure. Foreign customer requests included services and items such as training and support services for weapon systems, missiles, aircraft, and communication equipment.
Not all countries in each region submitted a price and availability request.
DOD officials indicated they generally strove to offer price and availability data that reflected rough order of magnitude estimates of total anticipated costs for a complete and sustainable capability. Contractors often provide input to DOD for these cost and schedule estimates. In the five examples GAO reviewed, DOD officials considered factors such as possible production delays and included anticipated costs for support services, operations, and sustainment, when needed. DOD officials also included FMS administrative charges and, as applicable, nonrecurring and transportation costs. GAO found that when DOD considered these factors in developing the response to the customer, at times, they made adjustments to the estimates provided by contractors to more fully reflect expected costs if the items are purchased.
Among the five examples, GAO found that response times ranged from 45 to 320 days and that a number of factors can affect timeliness. For example, the complexity of the system or capability the customer is interested in acquiring may require involvement from multiple program offices and defense contractors, requiring more time than the 45 days suggested by DOD's guidance.


Question:
Why GAO Did This Study

GAO has previously found that DHS's components had acquisition programs that did not meet requirements and that those requirements were, in some cases, poorly defined. Poorly defined requirements increase the risk that acquisitions will not meet the needs of users in the field—for example, border patrol agents or emergency responders.
GAO was asked to examine DHS components' practices for developing requirements. This report addresses the policies, organizations, and workforce that selected DHS components use to develop requirements for their acquisition programs.
GAO selected seven DHS components with significant acquisition programs and a non-generalizable sample of programs—based on cost, component, and acquisition phase—as case studies. GAO analyzed policies and program documentation; and interviewed DHS and component officials, as well as end users of DHS programs. GAO compared components' practices to industry best practices and federal internal control standards.

What GAO Found

GAO has identified several best practices to ensure that operational requirements for acquisitions are well-defined and found some Department of Homeland Security's (DHS) components met them while others did not. These practices include a formal policy for developing requirements, an independent requirements organization, and an understanding of workforce needs and training. The table below shows GAO's assessment of seven of DHS's components against these practices.
Establishing a formal policy to guide the process is critical to developing well-defined requirements. However, only the Coast Guard has an approved policy for requirements development among the seven components reviewed. Without well-defined requirements, components are at risk of acquiring capabilities that will not meet mission needs. DHS officials told GAO that components have generally prioritized obtaining funding and starting programs over developing requirements.
Three components have a requirements development organization, separating requirements from acquisition in addressing capability gaps. Officials from components without such organizations told GAO that they have fewer major acquisitions and rely on DHS to assist in requirements development. DHS policy and best practices, however, maintain the importance of this separation regardless of the number of major acquisitions to guard against possible bias by acquisition officials toward a specific materiel solution.
Two components have assessed requirements development workforce needs, but both need to be updated; and one component has provided requirements development training and certification. Other component officials told GAO that they lack the resources necessary to take these steps. Best practices indicate that without an appropriately sized and trained workforce, components remain at risk of acquiring capabilities that fail to meet end user needs.

What GAO Recommends

GAO is making 25 recommendations, including to individual components to establish policies and independent organizations for requirements development, assess workforce needs, and establish training and certifications. DHS concurred with all the recommendations.


Question:
Why GAO Did This Study

NNSA is responsible for ensuring a sustainable supply of strategic materials critical to the nation's nuclear security missions, as well as the capability to process these materials. NNSA estimates that strategic materials management activities will cost about $7.7 billion over the next 5 years.
The House Report accompanying H.R. 4909, a bill for the National Defense Authorization Act for Fiscal Year 2017, included a provision for GAO to review NNSA's management of its strategic materials programs. This report examines (1) the extent to which NNSA has, for these programs, defined requirements, including program manager roles and responsibilities, and (2) the progress of NNSA's implementation of those program requirements.
GAO reviewed NNSA program management policies and documents related to its strategic materials program manager positions and interviewed NNSA officials and program managers.

What GAO Found

The Department of Energy's (DOE) National Nuclear Security Administration (NNSA) manages strategic materials programs for uranium, plutonium, tritium, and lithium—materials that are critical to national security. NNSA has set program requirements that each of the programs must follow and has established the roles and responsibilities of the program managers. NNSA has defined these requirements in two documents:
Program Execution Instruction (2016). Outlines requirements for program management documents, such as a program plan, cost and schedule estimates, and an integrated master schedule that includes the entire scope of work for successful execution.
Program Management Policy (2017). Outlines the program managers' authority and requirements for managing the strategic materials programs, such as managing risk, and requires each program to develop documents, such as a mission strategy and technology development plan.
NNSA officials reported that the agency is making progress implementing the requirements outlined for each of the strategic materials programs, although some of the programs are farther along than others. For example:
The uranium and domestic uranium enrichment programs established in 2014 are the furthest along and have developed the documents needed to meet strategic program requirements.
The plutonium program has met some of the requirements, such as developing a program plan, work breakdown structure, and decision analysis, but does not yet have an integrated master schedule.
The tritium program met the requirements during the course of GAO's review.
The lithium program, which is the newest, has made the least amount of progress and to date has developed only a mission strategy, a mission requirements matrix, and a technology development plan.
According to NNSA officials, shortage of staff assigned to the strategic materials programs has been the primary reason hampering progress in implementing the program requirements. For example, a lithium program manager has not yet been assigned, and all the other programs have identified the need for additional staff beyond the one or two staff currently assigned to each. According to officials, competing agency priorities and perceived staffing limits are the primary impediments to assigning more staff to these programs. However, GAO also found that NNSA has not determined the critical skills and competencies needed for these programs. GAO's prior work has identified certain activities or practices that can help an agency strategically manage its human capital. These activities include determining the critical skills and competencies that will be needed to achieve the program's mission and developing strategies to address gaps in the number, deployment, and alignment of staff needed. By determining the critical skills and competencies needed for the strategic materials programs and using this determination to develop strategies to address any gaps in the number, deployment, and alignment of program staff, NNSA may have the information it needs to better justify increased staffing levels for the programs.

What GAO Recommends

GAO recommends that NNSA determine the critical skills and competencies that will be needed for the strategic materials programs and use this determination to develop strategies for addressing any gaps related to the number, deployment, and alignment of program staff. NNSA agreed with GAO's recommendation.


Question:
Why GAO Did This Study

FEMA, a component of DHS, provides preparedness grants to state, local, tribal, and territorial governments to help prepare for, prevent, protect against, respond to, recover from and mitigate terrorist attacks or other disasters. SHSP grants fund the nation's 56 states and territories, while UASI grants fund eligible urban areas. Grant allocations have been based, in part, on FEMA's risk-based grant assessment model, with states and urban areas deemed to be at higher risk receiving more grant dollars than those deemed at lower risk. Since 2008, GAO and others have assessed the model and made recommendations to strengthen it.
This report 1) describes SHSP and UASI grant awards during fiscal years 2008 through 2018, and factors affecting grant distributions; and 2) examines the steps that FEMA has taken to strengthen its risk assessment model for allocating preparedness grants, and any additional opportunities to improve the model. GAO analyzed the information in FEMA's model, and data on SHSP and UASI grant awards for fiscal years 2008 through 2018. GAO also interviewed FEMA and DHS officials and collected documents.

What GAO Found

GAO found that various factors affected Federal Emergency Management Agency (FEMA) State Homeland Security Program (SHSP) and Urban Area Security Initiative (UASI) grant awards from fiscal year 2008 through 2018. SHSP grant awards to states were based on two factors—(1) minimum amounts set in law each year, and (2) FEMA's risk model. For example, in fiscal year 2012, each state was to receive a minimum of approximately $2.74 million, with each state receiving additional funds based on its relative risk score. Conversely, UASI grant awards are made based on its FEMA's risk-based grant assessment model, which ranks each urban area relative to others in that year, and Department of Homeland Security (DHS) leadership decisions on how funding should be allocated. From fiscal year 2008 through 2018, the number of USAI grantees varied from year to year (see figure below).
Since 2008, FEMA has taken steps to strengthen its risk-based grant assessment model, but has not incorporated additional scientific practices into its model. For example, in 2011 FEMA included more information in its model on potential targets and their vulnerability in each state and urban area, addressing a prior GAO recommendation. More recently in 2018, FEMA added additional factors to better assess vulnerability in each state and urban area, such as the number of special events where large crowds gather and soft targets susceptible to lone wolf attacks, among other things. However, GAO found that FEMA does not fully utilize scientific practices recognized by the National Research Council and the Office of Management and Budget as best practices. Specifically, FEMA did not fully document its model's underlying assumptions, such as the weights in its model or the justification for changes to these weights. FEMA also did not perform the level of analysis needed to determine how changes to its model could affect the resulting risk scores. Finally, FEMA has not coordinated an independent external peer review of its model. Applying such scientific practices could assist FEMA in further strengthening its model.

What GAO Recommends

GAO is making three recommendations to FEMA to further strengthen its risk-based grant assessment model by (1) fully documenting the model's assumptions and justifications, (2) performing additional in-depth analyses, and (3) coordinating an external peer review. FEMA concurred with our recommendations.


Question:
Why GAO Did This Study

The emergence of increasingly sophisticated threats and continuous reporting of cyber incidents underscores the continuing and urgent need for effective information security. GAO first designated information security as a government-wide high- risk area in 1997. GAO expanded the high-risk area to include the protection of cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.
Federal law and policy provide DHS with broad authorities to improve and promote cybersecurity. DHS plays a key role in strengthening the cybersecurity posture of the federal government and promoting cybersecurity of systems supporting the nation's critical infrastructures.
This statement highlights GAO's work related to federal programs implemented by DHS that are intended to improve federal cybersecurity and cybersecurity over systems supporting critical infrastructure. In preparing this statement, GAO relied on a body of work issued since fiscal year 2016 that highlighted, among other programs, DHS's NCPS, national integration center activities, and cybersecurity workforce assessment efforts.

What GAO Found

In recent years, the Department of Homeland Security (DHS) has acted to improve and promote the cybersecurity of federal and private-sector computer systems and networks, but further improvements are needed. Specifically, consistent with its statutory authorities, DHS has made important progress in implementing programs and activities that are intended to mitigate cybersecurity risks on the computer systems and networks supporting federal operations and our nation's critical infrastructure. For example, the department has:
issued cybersecurity related binding operational directives to federal agencies;
served as the federal-civilian interface for sharing cybersecurity related information with federal and nonfederal entities;
Framework for Improving Critical Infrastructure Cybersecurity ; and
Nevertheless, the department has not taken sufficient actions to ensure that it successfully mitigates cybersecurity risks on federal and private-sector computer systems and networks. For example, GAO reported in 2016 that DHS's National Cybersecurity Protection System (NCPS) had only partially met its stated system objectives of detecting and preventing intrusions, analyzing malicious content, and sharing information. GAO recommended that DHS enhance capabilities, improve planning, and support greater adoption of NCPS.
In addition, although the department's National Cybersecurity and Communications Integration Center generally performed required functions such as collecting and sharing cybersecurity related information with federal and non-federal entities, GAO reported in 2017 that the center needed to evaluate its activities more completely. For example, the extent to which the center had performed its required functions in accordance with statutorily defined implementing principles was unclear, in part, because the center had not established metrics and methods by which to evaluate its performance against the principles. Further, in its role as the lead federal agency for collaborating with eight critical infrastructure sectors including the communications and dams sectors, DHS had not developed metrics to measure and report on the effectiveness of its cyber risk mitigation activities or on the cybersecurity posture of the eight sectors.
GAO reported in 2018 that DHS had taken steps to assess its cybersecurity workforce; however, it had not identified all of its cybersecurity positions and critical skill requirements.
Until DHS fully and effectively implements its cybersecurity authorities and responsibilities, the department's ability to improve and promote the cybersecurity of federal and private-sector networks will be limited.

What GAO Recommends

Since fiscal year 2016, GAO has made 29 recommendations to DHS to enhance the capabilities of NCPS, establish metrics and methods for evaluating performance, and fully assess its cybersecurity workforce, among other things. As of April 2018, DHS had not demonstrated that it had fully implemented most of the recommendations.


Question:
Why GAO Did This Study

Within the limits of their statutory authority, agencies may design their regulations in different ways to achieve intended policy outcomes. Agencies also decide how they will promote compliance with their regulations and ensure that regulated entities are informed of regulatory requirements.
GAO was asked to review how agencies make regulatory design and enforcement decisions. This report describes how selected agencies report (1) making decisions on regulatory designs among available options, (2) making decisions to designate resources among available compliance and enforcement activities, and (3) evaluating those decisions, and also identifies (4) key considerations for decision makers related to regulatory design and enforcement. To describe how agencies make and evaluate these decisions, GAO reviewed regulatory processes and spoke with officials at six executive departments—the Departments of Agriculture (USDA), Commerce, Health and Human Services (HHS), Labor (Labor), and Transportation and the Environmental Protection Agency (EPA)—based on volume of significant rulemaking, and 13 subcomponents within those departments. To identify key considerations for regulatory decision makers, GAO reviewed existing criteria, including statutory and Executive requirements, conducted a literature review, and obtained input on identified considerations with subject matter specialists.
GAO is not making any recommendations in this report. USDA, HHS, Labor, and the EPA provided technical comments that were incorporated as appropriate.

What GAO Found

Agencies have multiple available regulatory designs. Selected agency processes for choosing among them are informed by statutory and Executive requirements, regulatory objectives, and statutory discretion. Officials reported a preference for “performance” designs that establish an outcome but allow flexibility in how to achieve it, but stated that in some cases their objectives could require use of more prescriptive “design-based” regulations that specify a certain required technology or action. Officials at all selected agencies stated that they discuss potential regulatory designs internally, but some agency processes also included practices such as documentation of identified design options and assessments of the options' risks and enforcement implications.
Selected agencies used multiple tools and approaches for allocating resources to elicit compliance. Agencies generally have flexibility to use a mix of tools, including providing compliance assistance to help regulated entities understand requirements, and monitoring and enforcement through inspections. Selected agency processes to allocate compliance resources vary, and agencies reported using collected data to target enforcement resources to address risks.
Selected agencies supplemented feedback on effectiveness of their regulatory design and enforcement approaches with evaluations, which agency officials said could prompt changes. When agencies identify noncompliance, selected agencies may update their regulation or their compliance strategy.
GAO identified key considerations to strengthen agency decisions related to regulatory design and enforcement (see figure). These build on current directives, academic research, and the experiences of selected agencies and are intended to serve as a resource for decision makers in designing—or redesigning—their regulations and determining how best to elicit compliance.


Question:
Why GAO Did This Study

Enacted in December 2014, TSARA introduced legislative reforms to promote greater transparency and accountability in TSA's SRT acquisitions.
TSARA contains a provision that GAO submit two reports to Congress on TSA's progress in implementing TSARA. In February 2016, GAO issued the first report that found TSA had taken actions to address TSARA.
This second report examines TSA's (1) progress in addressing TSARA requirements since 2016, (2) reporting to Congress on SRT acquisitions, and (3) internal communication of its implementation decisions. GAO examined TSARA and TSA documents and guidance; analyzed TSA contract data and reports from TSARA's enactment in December 2014 through July 2018 and September 2018, respectively; and interviewed DHS and TSA officials on actions taken to implement TSARA. GAO also conducted interviews with TSA officials on parameters for reporting on SRT acquisitions.

What GAO Found

Since 2016, the Transportation Security Administration (TSA) generally addressed Transportation Security Acquisition Reform Act (TSARA) requirements through its policies and procedures for acquisition justifications, baseline requirements, and management of inventory. TSA also, among other actions, submitted a technology investment plan and annual small-business contracting goals reports to Congress as required.
Since December 2014, TSA reported limited security-related technology (SRT) acquisitions to Congress under TSARA, submitting its first report in August 2018. TSARA contains a report and certification provision pursuant to which TSA is to submit information to Congress 30 days prior to the award of a contract for an SRT acquisition exceeding $30 million. Through July 2018, TSA obligated about $1.4 billion on SRT and associated services. TSA officials explained that none of these obligations—including 7 SRT orders, each in excess of $30 million—invoked the report and certification provision because the obligations did not align with TSA's implementation policy, which provides that the $30 million threshold relates to the contract ceiling of the initial SRT contract and not to individual task and delivery orders. Revising TSA's policy to include contracts for services that enhance the capabilities of SRT, including any orders for SRT and associated services in excess of $30 million, would better ensure that Congress has the information it needs to effectively oversee TSA's SRT acquisitions.
TSA has not effectively communicated internally its implementation decisions for what constitutes an SRT under TSARA. TSA officials described to GAO that SRT must be equipment that is public facing, but TSA's policy does not clearly state the parameters of what is considered an SRT. Without clear guidance, TSA staff may be unaware of these parameters and how they apply to future acquisitions under TSARA. For example, TSA acquisition program staff were initially unable to confirm for GAO whether the technologies TSA had acquired were SRTs and thus subject to TSARA. Updating TSA policy to include detailed parameters for what constitutes an SRT would better ensure consistency in applying the act.

What GAO Recommends

GAO recommends that TSA revise its policies for the report and certification provision of TSARA to include reporting on task and delivery orders and services associated with SRT, and clarify in policy what constitutes an SRT under TSARA. DHS generally concurred with the recommendations and described steps it plans to take to implement them.